From f38a21e08776b4618e9da7035cb9da60bcfbeace Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Thu, 6 Mar 2025 21:33:01 +0000
Subject: [PATCH 01/25] commit to share and get feedback

---
 custom_documentation/doc/endpoint/metadata/metadata.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/custom_documentation/doc/endpoint/metadata/metadata.md b/custom_documentation/doc/endpoint/metadata/metadata.md
index 2894306df..22a7fc799 100644
--- a/custom_documentation/doc/endpoint/metadata/metadata.md
+++ b/custom_documentation/doc/endpoint/metadata/metadata.md
@@ -44,7 +44,7 @@ This is a relatively small state management document that includes details about
 | host.ip |
 | host.mac |
 | host.name |
-| host.os.Ext.variant |
+| host.os.Ext.variant <br> **Description**: The product name of the host os<br>**Possible Values**<ul><li>windows: The product name from the registry</li><li>linux: the distribution name (ubuntu, red hat, etc)</li><li>macos: this value is always "macOS"</li>
 | host.os.family |
 | host.os.full |
 | host.os.kernel |

From a7e3a1c77a8ef2fa00cd13860b6c225546cc8211 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 7 Mar 2025 23:00:15 +0000
Subject: [PATCH 02/25] python script for reading package definitions and
 dumping to json

---
 .../generate-docs/generate_package_list.py    | 148 ++++++++++++++++++
 1 file changed, 148 insertions(+)
 create mode 100644 scripts/generate-docs/generate_package_list.py

diff --git a/scripts/generate-docs/generate_package_list.py b/scripts/generate-docs/generate_package_list.py
new file mode 100644
index 000000000..9ee5fa97d
--- /dev/null
+++ b/scripts/generate-docs/generate_package_list.py
@@ -0,0 +1,148 @@
+import argparse
+import json
+import pathlib
+import yaml
+from pydantic import BaseModel
+from typing import List, Optional, Any, Dict
+
+class MultiField(BaseModel):
+    """
+    fields can have a number of multi_fields
+    """
+    name: str
+    type: str
+    norms: Optional[bool] = None
+    normalizer: Optional[str] = None
+    ignore_above: Optional[int] = None
+    default_field: Optional[bool] = None
+
+    class Config:
+        """
+         this config setting ensures that the model will raise an error if any extra fields are present
+        """
+        extra = "forbid"
+
+
+class Field(BaseModel):
+    """
+    Field field as defined in fields.yml
+    """
+    name: str
+    title: Optional[str] = None
+    default_field: Optional[bool] = None
+    level: Optional[str] = None
+    type: Optional[str] = None
+    ignore_above: Optional[int] = None
+    description: Optional[str] = None
+    fields: Optional[List["Field"]] = None
+    required: Optional[bool] = None
+    group: Optional[int] = None
+    multi_fields: Optional[List[MultiField]] = None
+    example: Optional[Any] = None
+    format: Optional[str] = None
+    enabled: Optional[bool] = None
+    doc_values: Optional[bool] = None
+    index: Optional[bool] = None
+    footnote: Optional[str] = None
+    pattern: Optional[str] = None
+    path: Optional[str] = None
+
+    class Config:
+        """
+         this config setting ensures that the model will raise an error if any extra fields are present
+        """
+        extra = "forbid"
+
+
+class Package(BaseModel):
+    """
+    A package consists of a name, a list of fields and an optional sample event
+    """
+    name: str
+    fields: List[Field]
+    sample_event: Optional[Dict[Any, Any]] = None
+
+    @classmethod
+    def from_package_dir(cls, package_dir: pathlib.Path):
+        """
+        takes a directory and returns a Package object
+        - name is the name of the directory (package)
+        - fields are read from fields/fields.yml
+        - sample_event is read from sample_event.json if it exists
+
+        Args:
+            package_dir: directory holding the package data
+        """
+        #
+        # read fields from fields.yml and create Field objects
+        #
+        fields_path = package_dir / "fields" / "fields.yml"
+        fields_data = yaml.safe_load(fields_path.read_text())
+        fields = [Field(**field) for field in fields_data]
+
+        #
+        # read sample event if it exists
+        #
+        sample_event = None
+        sample_event_path = package_dir / "sample_event.json"
+        if sample_event_path.exists():
+            sample_event = json.loads(sample_event_path.read_text())
+
+        #
+        # return the Package object
+        #
+        return cls(name=package_dir.name, fields=fields, sample_event=sample_event)
+
+class PackageList(BaseModel):
+    """
+    PackageList is a list of packages
+    """
+    packages: List[Package] = []
+
+    @classmethod
+    def from_packages_dir(cls, packages_dir: pathlib.Path):
+        """
+        from_packages_dir creates a PackageList from a directory of packages
+
+        Args:
+            packages_dir: top level directory holding the packages
+        """
+        package_paths = list(packages_dir.glob("*"))
+        packages = [Package.from_package_dir(package_path) for package_path in package_paths]
+        return cls(packages=packages)
+
+
+def resolve_packages_dir() -> pathlib.Path:
+    """
+    resolve_packages_dir returns the directory where the packages are stored relative to this file
+    """
+    this_file = pathlib.Path(__file__).resolve()
+    root_dir = this_file.parents[2]
+    return root_dir / "package" / "endpoint" / "data_stream"
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(description="Dump packages as JSON")
+    parser.add_argument(
+        "--packages-dir",
+        default=resolve_packages_dir(),
+        type=pathlib.Path,
+        help="directory holding the packages",
+    )
+    parser.add_argument(
+        "--output",
+        default=pathlib.Path("packages.json"),
+        type=pathlib.Path,
+        help="output file",
+    )
+    args = parser.parse_args()
+
+    #
+    # Create the PackageList object and dump it to a file
+    #
+    package_list = PackageList.from_packages_dir(args.packages_dir)
+    with open(args.output, "w") as f:
+        #
+        # Dump to json with indentation and exclude None values
+        #
+        f.write(package_list.model_dump_json(indent=4, exclude_none=True))

From edc824420921c09983bfddc9715dc3a7e5acc673 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Mon, 10 Mar 2025 17:04:14 +0000
Subject: [PATCH 03/25] committing work for feedback

---
 .gitignore                                    |     1 +
 scripts/generate-docs/doc.md                  |   363 +
 scripts/generate-docs/output/README.md        |    17 +
 .../generate-docs/output/action_responses.md  |   187 +
 scripts/generate-docs/output/actions.md       |   225 +
 scripts/generate-docs/output/alerts.md        |   359 +
 scripts/generate-docs/output/api.md           |   161 +
 scripts/generate-docs/output/collection.md    |    53 +
 scripts/generate-docs/output/file.md          |   196 +
 scripts/generate-docs/output/heartbeat.md     |    79 +
 scripts/generate-docs/output/library.md       |   201 +
 scripts/generate-docs/output/metadata.md      |   103 +
 scripts/generate-docs/output/metrics.md       |   104 +
 scripts/generate-docs/output/network.md       |   194 +
 scripts/generate-docs/output/packages.json    | 36484 ++++++++++++++++
 scripts/generate-docs/output/policy.md        |   104 +
 scripts/generate-docs/output/process.md       |   205 +
 scripts/generate-docs/output/registry.md      |   183 +
 scripts/generate-docs/output/security.md      |   194 +
 scripts/generate-docs/packages.json           | 36484 ++++++++++++++++
 scripts/generate-docs/pydocgen/__init__.py    |     0
 scripts/generate-docs/pydocgen/__main__.py    |    60 +
 scripts/generate-docs/pydocgen/markdown.py    |    56 +
 .../models.py}                                |    58 +-
 24 files changed, 76031 insertions(+), 40 deletions(-)
 create mode 100644 scripts/generate-docs/doc.md
 create mode 100644 scripts/generate-docs/output/README.md
 create mode 100644 scripts/generate-docs/output/action_responses.md
 create mode 100644 scripts/generate-docs/output/actions.md
 create mode 100644 scripts/generate-docs/output/alerts.md
 create mode 100644 scripts/generate-docs/output/api.md
 create mode 100644 scripts/generate-docs/output/collection.md
 create mode 100644 scripts/generate-docs/output/file.md
 create mode 100644 scripts/generate-docs/output/heartbeat.md
 create mode 100644 scripts/generate-docs/output/library.md
 create mode 100644 scripts/generate-docs/output/metadata.md
 create mode 100644 scripts/generate-docs/output/metrics.md
 create mode 100644 scripts/generate-docs/output/network.md
 create mode 100644 scripts/generate-docs/output/packages.json
 create mode 100644 scripts/generate-docs/output/policy.md
 create mode 100644 scripts/generate-docs/output/process.md
 create mode 100644 scripts/generate-docs/output/registry.md
 create mode 100644 scripts/generate-docs/output/security.md
 create mode 100644 scripts/generate-docs/packages.json
 create mode 100644 scripts/generate-docs/pydocgen/__init__.py
 create mode 100644 scripts/generate-docs/pydocgen/__main__.py
 create mode 100644 scripts/generate-docs/pydocgen/markdown.py
 rename scripts/generate-docs/{generate_package_list.py => pydocgen/models.py} (68%)

diff --git a/.gitignore b/.gitignore
index 23ccece1a..7290b93c3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,4 @@ vendor/
 generated/
 .DS_Store
 *.swp
+*.pyc
diff --git a/scripts/generate-docs/doc.md b/scripts/generate-docs/doc.md
new file mode 100644
index 000000000..49ae0b5ac
--- /dev/null
+++ b/scripts/generate-docs/doc.md
@@ -0,0 +1,363 @@
+/git/endpoint-dev/ElasticCommonSchema/endpoint-package/package/endpoint/data_stream
+# alerts
+
+## Fields
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### Events
+
+#### Description
+events array
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### Endpoint
+
+#### Description
+Fields describing the state of the Elastic Endpoint when an event occurs.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### Memory_protection
+
+#### Description
+These fields contain information specific to Memory Protection alerts.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### Ransomware
+
+#### Description
+These fields contain information specific to ransomware alerts.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### Responses
+
+#### Description
+responses array contains rule response action results
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### Target
+
+#### Description
+These fields contain information about a target.
+These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### cloud
+
+#### Description
+Fields related to the cloud or infrastructure the events are coming from.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### container
+
+#### Description
+Container fields are used for meta information about the specific container that is the source of information.
+These fields help correlate data based containers from any runtime.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### destination
+
+#### Description
+Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### dll
+
+#### Description
+These fields contain information about code libraries dynamically loaded into processes.
+
+Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
+* Dynamic-link library (`.dll`) commonly used on Windows
+* Shared Object (`.so`) commonly used on Unix-like operating systems
+* Dynamic library (`.dylib`) commonly used on macOS
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### dns
+
+#### Description
+Fields describing DNS queries and answers.
+DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### elastic
+
+#### Description
+Holds fields and properties of data points and concepts in the elastic domain or namespace.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### file
+
+#### Description
+A file is defined as a set of information that has been created on, or has existed on a filesystem.
+File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### group
+
+#### Description
+The group fields are meant to represent groups that are relevant to the event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### orchestrator
+
+#### Description
+Fields that describe the resources which container orchestrators manage or act upon.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### process
+
+#### Description
+These fields contain information about a process.
+These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### registry
+
+#### Description
+Fields related to Windows Registry operations.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### rule
+
+#### Description
+Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
+Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### source
+
+#### Description
+Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### threat
+
+#### Description
+Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.
+These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service").
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+
diff --git a/scripts/generate-docs/output/README.md b/scripts/generate-docs/output/README.md
new file mode 100644
index 000000000..941b9fbd2
--- /dev/null
+++ b/scripts/generate-docs/output/README.md
@@ -0,0 +1,17 @@
+# Packages
+
+- [alerts](alerts.md)
+- [policy](policy.md)
+- [registry](registry.md)
+- [process](process.md)
+- [security](security.md)
+- [metadata](metadata.md)
+- [action_responses](action_responses.md)
+- [collection](collection.md)
+- [library](library.md)
+- [heartbeat](heartbeat.md)
+- [actions](actions.md)
+- [file](file.md)
+- [api](api.md)
+- [network](network.md)
+- [metrics](metrics.md)
diff --git a/scripts/generate-docs/output/action_responses.md b/scripts/generate-docs/output/action_responses.md
new file mode 100644
index 000000000..b75fabb1a
--- /dev/null
+++ b/scripts/generate-docs/output/action_responses.md
@@ -0,0 +1,187 @@
+# action_responses
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### action_id
+
+#### Description
+The action id
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent_id
+
+#### Description
+Alias field that maps to {agent: {id}}
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### completed_at
+
+#### Description
+Request completion timestamp when the response is done executing. Usually matches with @timestamp.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data.alert_id
+
+#### Description
+List of alert ids that triggered the action
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data.command
+
+#### Description
+The action that is requested
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data.comment
+
+#### Description
+A comment that describes the action that is requested
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### started_at
+
+#### Description
+Timestamp of start of request
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### status
+
+#### Description
+The status of the request that distinguishes if the request is queued, running or completed.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### EndpointActions
+
+#### Description
+Fields to describe the endpoint  action requests and responses.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### error
+
+#### Description
+These fields can represent errors of any kind.
+Use them for errors that happen while fetching events or in cases where the event itself contains an error.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/actions.md b/scripts/generate-docs/output/actions.md
new file mode 100644
index 000000000..9b53af66e
--- /dev/null
+++ b/scripts/generate-docs/output/actions.md
@@ -0,0 +1,225 @@
+# actions
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### action_id
+
+#### Description
+The action id
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agents
+
+#### Description
+Alias field that maps to {agent: {id}}
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data.alert_id
+
+#### Description
+List of alert ids that triggered the action
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data.command
+
+#### Description
+The action that is requested
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data.comment
+
+#### Description
+A comment that describes the action that is requested
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### expiration
+
+#### Description
+Request expiration timestamp
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### input_type
+
+#### Description
+The input type of the action, distinguishes endpoint actions as `endpoint`
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### type
+
+#### Description
+Distinguishes the type of input. Usually set to `INPUT_ACTION`
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user_id
+
+#### Description
+The user id
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### EndpointActions
+
+#### Description
+Fields to describe the endpoint  action requests and responses.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### error
+
+#### Description
+These fields can represent errors of any kind.
+Use them for errors that happen while fetching events or in cases where the event itself contains an error.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### rule
+
+#### Description
+Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
+Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/alerts.md b/scripts/generate-docs/output/alerts.md
new file mode 100644
index 000000000..4a83c10bd
--- /dev/null
+++ b/scripts/generate-docs/output/alerts.md
@@ -0,0 +1,359 @@
+# alerts
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### Events
+
+#### Description
+events array
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### Endpoint
+
+#### Description
+Fields describing the state of the Elastic Endpoint when an event occurs.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### Memory_protection
+
+#### Description
+These fields contain information specific to Memory Protection alerts.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### Ransomware
+
+#### Description
+These fields contain information specific to ransomware alerts.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### Responses
+
+#### Description
+responses array contains rule response action results
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### Target
+
+#### Description
+These fields contain information about a target.
+These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### cloud
+
+#### Description
+Fields related to the cloud or infrastructure the events are coming from.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### container
+
+#### Description
+Container fields are used for meta information about the specific container that is the source of information.
+These fields help correlate data based containers from any runtime.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### destination
+
+#### Description
+Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### dll
+
+#### Description
+These fields contain information about code libraries dynamically loaded into processes.
+
+Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
+* Dynamic-link library (`.dll`) commonly used on Windows
+* Shared Object (`.so`) commonly used on Unix-like operating systems
+* Dynamic library (`.dylib`) commonly used on macOS
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### dns
+
+#### Description
+Fields describing DNS queries and answers.
+DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### elastic
+
+#### Description
+Holds fields and properties of data points and concepts in the elastic domain or namespace.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### file
+
+#### Description
+A file is defined as a set of information that has been created on, or has existed on a filesystem.
+File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### group
+
+#### Description
+The group fields are meant to represent groups that are relevant to the event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### orchestrator
+
+#### Description
+Fields that describe the resources which container orchestrators manage or act upon.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### process
+
+#### Description
+These fields contain information about a process.
+These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### registry
+
+#### Description
+Fields related to Windows Registry operations.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### rule
+
+#### Description
+Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
+Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### source
+
+#### Description
+Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### threat
+
+#### Description
+Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.
+These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service").
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/api.md b/scripts/generate-docs/output/api.md
new file mode 100644
index 000000000..edf7934f3
--- /dev/null
+++ b/scripts/generate-docs/output/api.md
@@ -0,0 +1,161 @@
+# api
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### Target
+
+#### Description
+These fields contain information about a target.
+These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### destination
+
+#### Description
+Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### dll
+
+#### Description
+These fields contain information about code libraries dynamically loaded into processes.
+
+Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
+* Dynamic-link library (`.dll`) commonly used on Windows
+* Shared Object (`.so`) commonly used on Unix-like operating systems
+* Dynamic library (`.dylib`) commonly used on macOS
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### network
+
+#### Description
+The network is defined as the communication path over which a host or network event happens.
+The network.* fields should be populated with details about the network activity associated with an event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### process
+
+#### Description
+These fields contain information about a process.
+These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/collection.md b/scripts/generate-docs/output/collection.md
new file mode 100644
index 000000000..351649b48
--- /dev/null
+++ b/scripts/generate-docs/output/collection.md
@@ -0,0 +1,53 @@
+# collection
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/file.md b/scripts/generate-docs/output/file.md
new file mode 100644
index 000000000..06e677344
--- /dev/null
+++ b/scripts/generate-docs/output/file.md
@@ -0,0 +1,196 @@
+# file
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### Effective_process
+
+#### Description
+These fields contain information about an effective process.
+The effective process is the process that requested the a specific action, without directly performing it.
+Processes can have effective parents that differ from their regular parents. For example, on Windows, "wmic process call create notepad" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.
+Events can have effective processes that differ from their regular processes. For example, on Windows, "reg add \\localhost\HKLM\Software\Foo /v Data /t REG_SZ /d 123"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### Persistence
+
+#### Description
+These fields contain information about a Persistence event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### destination
+
+#### Description
+Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### file
+
+#### Description
+A file is defined as a set of information that has been created on, or has existed on a filesystem.
+File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### group
+
+#### Description
+The group fields are meant to represent groups that are relevant to the event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### process
+
+#### Description
+These fields contain information about a process.
+These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### source
+
+#### Description
+Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/heartbeat.md b/scripts/generate-docs/output/heartbeat.md
new file mode 100644
index 000000000..e154f0d08
--- /dev/null
+++ b/scripts/generate-docs/output/heartbeat.md
@@ -0,0 +1,79 @@
+# heartbeat
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### billable
+
+#### Description
+Whether document should be included in billing calculations
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/library.md b/scripts/generate-docs/output/library.md
new file mode 100644
index 000000000..6ad60c1f2
--- /dev/null
+++ b/scripts/generate-docs/output/library.md
@@ -0,0 +1,201 @@
+# library
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### Effective_process
+
+#### Description
+These fields contain information about an effective process.
+The effective process is the process that requested the a specific action, without directly performing it.
+Processes can have effective parents that differ from their regular parents. For example, on Windows, "wmic process call create notepad" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.
+Events can have effective processes that differ from their regular processes. For example, on Windows, "reg add \\localhost\HKLM\Software\Foo /v Data /t REG_SZ /d 123"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### destination
+
+#### Description
+Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### dll
+
+#### Description
+These fields contain information about code libraries dynamically loaded into processes.
+
+Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
+* Dynamic-link library (`.dll`) commonly used on Windows
+* Shared Object (`.so`) commonly used on Unix-like operating systems
+* Dynamic library (`.dylib`) commonly used on macOS
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### file
+
+#### Description
+A file is defined as a set of information that has been created on, or has existed on a filesystem.
+File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### group
+
+#### Description
+The group fields are meant to represent groups that are relevant to the event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### process
+
+#### Description
+These fields contain information about a process.
+These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### source
+
+#### Description
+Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/metadata.md b/scripts/generate-docs/output/metadata.md
new file mode 100644
index 000000000..a9ddaa113
--- /dev/null
+++ b/scripts/generate-docs/output/metadata.md
@@ -0,0 +1,103 @@
+# metadata
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### Endpoint
+
+#### Description
+Fields describing the state of the Elastic Endpoint when an event occurs.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### elastic
+
+#### Description
+Holds fields and properties of data points and concepts in the elastic domain or namespace.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/metrics.md b/scripts/generate-docs/output/metrics.md
new file mode 100644
index 000000000..8d254a845
--- /dev/null
+++ b/scripts/generate-docs/output/metrics.md
@@ -0,0 +1,104 @@
+# metrics
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### Endpoint
+
+#### Description
+Fields describing the state of the Elastic Endpoint when an event occurs.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/network.md b/scripts/generate-docs/output/network.md
new file mode 100644
index 000000000..9d2f8b3d6
--- /dev/null
+++ b/scripts/generate-docs/output/network.md
@@ -0,0 +1,194 @@
+# network
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### destination
+
+#### Description
+Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### dns
+
+#### Description
+Fields describing DNS queries and answers.
+DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### group
+
+#### Description
+The group fields are meant to represent groups that are relevant to the event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### http
+
+#### Description
+Fields related to HTTP activity. Use the `url` field set to store the url of the request.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### network
+
+#### Description
+The network is defined as the communication path over which a host or network event happens.
+The network.* fields should be populated with details about the network activity associated with an event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### process
+
+#### Description
+These fields contain information about a process.
+These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### source
+
+#### Description
+Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/packages.json b/scripts/generate-docs/output/packages.json
new file mode 100644
index 000000000..c181fcdd3
--- /dev/null
+++ b/scripts/generate-docs/output/packages.json
@@ -0,0 +1,36484 @@
+{
+    "packages": [
+        {
+            "name": "alerts",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "Events",
+                    "level": "custom",
+                    "type": "object",
+                    "description": "events array"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Endpoint",
+                    "title": "Endpoint",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
+                    "fields": [
+                        {
+                            "name": "policy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The policy fields are used to hold information about applied policy."
+                        },
+                        {
+                            "name": "policy.applied",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about the policy that is applied"
+                        },
+                        {
+                            "name": "policy.applied.artifacts",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about global protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.channel",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "global artifacts rollout channel"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "the identifiers of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of global artifact applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the sha256 of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.snapshot",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the snapshot date of applied global artifacts or 'latest'"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.update_age",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "number of days since global artifacts were made up-to-date"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about user protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "the identifiers of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of user artifact applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the sha256 of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the id of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of this applied policy"
+                        },
+                        {
+                            "name": "policy.applied.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of this applied policy"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Memory_protection",
+                    "title": "Memory Protection",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information specific to Memory Protection alerts.",
+                    "fields": [
+                        {
+                            "name": "cross_session",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Is this process injecting across operating system sessions?"
+                        },
+                        {
+                            "name": "feature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory Protection feature which triggered the alert.",
+                            "example": "shellcode_thread"
+                        },
+                        {
+                            "name": "parent_to_child",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Is this process injecting into its child?"
+                        },
+                        {
+                            "name": "self_injection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Is this alert about a process injecting into itself?"
+                        },
+                        {
+                            "name": "thread_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The number of threads that this alert applies to. If several alerts occur in a short period of time, they can be combined into a single alert with thread_count > 1."
+                        },
+                        {
+                            "name": "unique_key_v1",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A unique key created by hashing several characteristics of this alert."
+                        },
+                        {
+                            "name": "unique_key_v2",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A unique key created by hashing several characteristics of this alert.",
+                            "example": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Ransomware",
+                    "title": "Ransomware",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information specific to ransomware alerts.",
+                    "fields": [
+                        {
+                            "name": "child_processes.executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "child_processes.feature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ransomware feature which triggered the alert."
+                        },
+                        {
+                            "name": "child_processes.files",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Information about each file event attributed to the ransomware. Expected to be an array."
+                        },
+                        {
+                            "name": "child_processes.files.data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File header or MBR bytes."
+                        },
+                        {
+                            "name": "child_processes.files.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy of file contents."
+                        },
+                        {
+                            "name": "child_processes.files.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot."
+                        },
+                        {
+                            "name": "child_processes.files.metrics",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Suspicious ransomware behaviours associated with the file event."
+                        },
+                        {
+                            "name": "child_processes.files.operation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operation applied to file."
+                        },
+                        {
+                            "name": "child_processes.files.original.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file extension prior to the file event."
+                        },
+                        {
+                            "name": "child_processes.files.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to the file event."
+                        },
+                        {
+                            "name": "child_processes.files.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name."
+                        },
+                        {
+                            "name": "child_processes.files.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Ransomware score for this particular file event."
+                        },
+                        {
+                            "name": "child_processes.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "child_processes.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Total ransomware score for aggregated file events."
+                        },
+                        {
+                            "name": "child_processes.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ransomware artifact version."
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "feature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ransomware feature which triggered the alert."
+                        },
+                        {
+                            "name": "files",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Information about each file event attributed to the ransomware. Expected to be an array."
+                        },
+                        {
+                            "name": "files.data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File header or MBR bytes."
+                        },
+                        {
+                            "name": "files.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy of file contents."
+                        },
+                        {
+                            "name": "files.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot."
+                        },
+                        {
+                            "name": "files.metrics",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Suspicious ransomware behaviours associated with the file event."
+                        },
+                        {
+                            "name": "files.operation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operation applied to file."
+                        },
+                        {
+                            "name": "files.original.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file extension prior to the file event."
+                        },
+                        {
+                            "name": "files.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to the file event."
+                        },
+                        {
+                            "name": "files.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name."
+                        },
+                        {
+                            "name": "files.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Ransomware score for this particular file event."
+                        },
+                        {
+                            "name": "pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Total ransomware score for aggregated file events."
+                        },
+                        {
+                            "name": "version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ransomware artifact version."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Responses",
+                    "title": "Responses",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "responses array contains rule response action results",
+                    "fields": [
+                        {
+                            "name": "@timestamp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp in which action was taken",
+                            "format": "string"
+                        },
+                        {
+                            "name": "action",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Dictionary representing requested response action"
+                        },
+                        {
+                            "name": "action.action",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Response action name"
+                        },
+                        {
+                            "name": "action.field",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Field in the triggering event to use as input for action"
+                        },
+                        {
+                            "name": "action.file.attributes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Destination file attributes"
+                        },
+                        {
+                            "name": "action.file.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Destination file path"
+                        },
+                        {
+                            "name": "action.file.reason",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Combined USN file modification reason"
+                        },
+                        {
+                            "name": "action.key.actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Actions taken by Registry Rollback for key"
+                        },
+                        {
+                            "name": "action.key.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT path of registry key recovered by Rollback"
+                        },
+                        {
+                            "name": "action.key.values",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Values modified"
+                        },
+                        {
+                            "name": "action.key.values.actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Actions taken by Registry Rollback for value"
+                        },
+                        {
+                            "name": "action.key.values.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Value name recovered by Rollback"
+                        },
+                        {
+                            "name": "action.process.message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Status message for Process Rollback"
+                        },
+                        {
+                            "name": "action.process.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path of process killed by Process Rollback"
+                        },
+                        {
+                            "name": "action.process.result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Result code for Process Rollback"
+                        },
+                        {
+                            "name": "action.source.attributes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source file attributes"
+                        },
+                        {
+                            "name": "action.source.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source file path"
+                        },
+                        {
+                            "name": "action.state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Index of event in events array to use for field lookup"
+                        },
+                        {
+                            "name": "action.tree",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Indicates whether or not an action was taken against an entire process tree"
+                        },
+                        {
+                            "name": "message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Result message"
+                        },
+                        {
+                            "name": "process",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Dictionary representing process information"
+                        },
+                        {
+                            "name": "process.entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Entity id of actionable process"
+                        },
+                        {
+                            "name": "process.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of actionable process"
+                        },
+                        {
+                            "name": "process.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "pid of actionable process"
+                        },
+                        {
+                            "name": "result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Response action result code"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Target",
+                    "title": "Target",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
+                    "fields": [
+                        {
+                            "name": "dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "process.Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "process.Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        },
+                        {
+                            "name": "process.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "process.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "process.Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory allocation containing the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Original memory size requested when the memory was allocated.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+                            "example": "PRIVATE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The address where bytes_compressed begins.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether bytes_compressed is present in this event.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A sequence of signature names matched.",
+                            "example": "Windows.EICAR.Not-a-virus"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature identifier"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The first matching details."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The first matching details.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of file matching signature."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of file matching signature."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the first yara rule matched."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the first yara rule matched."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature version"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
+                            "example": "C:\\Windows\\System32\\mshtml.dll"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the file at mapped_path is an executable.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether an executable file was found in memory.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of the memory region.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_start_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 64 bytes at the region base address.",
+                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+                            "example": "COMMIT"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.strings",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Array of strings found within the memory region.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "process.Ext.services",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Services running in this process."
+                        },
+                        {
+                            "name": "process.Ext.session",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Session information for the current process"
+                        },
+                        {
+                            "name": "process.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "process.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "process.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "process.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "process.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "process.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "process.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "process.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "process.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "process.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "process.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "process.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "process.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "process.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "process.Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "process.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "process.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "process.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "process.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "process.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "process.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "process.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "process.exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "process.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "process.parent.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.parent.Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.parent.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "process.parent.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
+                        },
+                        {
+                            "name": "process.parent.Ext.real.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "process.parent.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "process.parent.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "process.parent.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "process.parent.Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "process.parent.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "process.parent.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "process.parent.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "process.parent.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.parent.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "process.parent.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "process.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "process.parent.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "process.parent.exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "process.parent.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.parent.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.parent.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.parent.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.parent.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "process.parent.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.parent.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.parent.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.parent.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.parent.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.parent.pgid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.parent.ppid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "process.parent.thread.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.parent.thread.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "process.parent.title",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ]
+                        },
+                        {
+                            "name": "process.parent.uptime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "process.parent.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "process.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.pgid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.ppid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "process.thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.instruction_pointer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The return address of this stack frame."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.memory_section.memory_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.memory_section.memory_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.memory_section.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.module_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The name of the DLL/module containing `instruction_pointer`.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.module_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path to the DLL/module containing `instruction_pointer`."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.rva",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The final non-win32 module in the call stack."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_user_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file name of the call_stack_final_user_module.",
+                            "example": "example.dll"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_user_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "process.thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a trampoline was detected, this indicates the original content for the thread start address in memory.",
+                            "example": 4194304
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.",
+                            "example": "48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc"
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_bytes_disasm",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the disassembled code at the original thread start address.",
+                            "example": "mov rax, 0x4141414141414141\\njmp rax"
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_bytes_disasm_hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
+                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.",
+                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
+                        },
+                        {
+                            "name": "process.thread.Ext.parameter",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a thread is created, this is the raw numerical value of its parameter."
+                        },
+                        {
+                            "name": "process.thread.Ext.parameter_bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.thread.Ext.parameter_bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether parameter_bytes_compressed is present in this event."
+                        },
+                        {
+                            "name": "process.thread.Ext.service",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Service associated with the thread.",
+                            "example": "VaultSvc"
+                        },
+                        {
+                            "name": "process.thread.Ext.start",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "The time the thread started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Memory address where the thread began execution.",
+                            "example": 4194304
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.",
+                            "example": "c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_bytes_disasm",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The bytes at the thread start address, disassembled into human-readable assembly code.",
+                            "example": "ret\\nint3"
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_bytes_disasm_hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
+                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The dll/module where the thread began execution.",
+                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
+                        },
+                        {
+                            "name": "process.thread.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "process.thread.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "process.thread.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "process.thread.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "process.thread.Ext.uptime",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Seconds since thread started."
+                        },
+                        {
+                            "name": "process.thread.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.thread.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "process.title",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ]
+                        },
+                        {
+                            "name": "process.uptime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "process.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "ephemeral_id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
+                            "example": "8a4f500f"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
+                            "example": "foo"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "cloud",
+                    "title": "Cloud",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to the cloud or infrastructure the events are coming from.",
+                    "fields": [
+                        {
+                            "name": "account.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
+                            "example": 666777888999
+                        },
+                        {
+                            "name": "instance.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Instance name of the host machine."
+                        },
+                        {
+                            "name": "project.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
+                            "example": "my-project"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
+                            "example": "aws"
+                        },
+                        {
+                            "name": "region",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region in which this host, resource, or service is located.",
+                            "example": "us-east-1"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information."
+                },
+                {
+                    "name": "container",
+                    "title": "Container",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique container id."
+                        },
+                        {
+                            "name": "image.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the image the container was built on."
+                        },
+                        {
+                            "name": "image.tag",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Container image tags."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Container name."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the destination (IPv4 or IPv6)."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dll",
+                    "title": "DLL",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dns",
+                    "title": "DNS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).",
+                    "fields": [
+                        {
+                            "name": "question.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
+                            "example": "www.example.com"
+                        },
+                        {
+                            "name": "question.type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of record being queried.",
+                            "example": "AAAA"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "elastic",
+                    "title": "Elastic",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Holds fields and properties of data points and concepts in the elastic domain or namespace.",
+                    "fields": [
+                        {
+                            "name": "agent",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
+                        },
+                        {
+                            "name": "agent.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this elastic agent (if one exists).",
+                            "example": "c2a9093e-e289-4c0a-aa44-8c32a414fa7a"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "risk_score",
+                            "level": "core",
+                            "type": "float",
+                            "description": "Risk score or priority of the event (e.g. security solutions). Use your system's original value here."
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "file",
+                    "title": "File",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.entry_modified",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
+                        },
+                        {
+                            "name": "Ext.macro.code_page",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Identifies the character encoding used for this macro.  https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers"
+                        },
+                        {
+                            "name": "Ext.macro.collection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object containing hashes for the macro collection."
+                        },
+                        {
+                            "name": "Ext.macro.collection.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.macro.collection.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.macro.collection.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.macro.collection.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.macro.errors",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Errors that occurred when parsing this document file."
+                        },
+                        {
+                            "name": "Ext.macro.errors.count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of times this error that occurred."
+                        },
+                        {
+                            "name": "Ext.macro.errors.error_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of parsing error that occurred."
+                        },
+                        {
+                            "name": "Ext.macro.file_extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The extension of the file containing this macro (e.g. .docm)"
+                        },
+                        {
+                            "name": "Ext.macro.project_file",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Metadata about the corresponding VBA project file"
+                        },
+                        {
+                            "name": "Ext.macro.project_file.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.macro.project_file.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.macro.project_file.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.macro.project_file.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Streams associated with the document."
+                        },
+                        {
+                            "name": "Ext.macro.stream.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the stream."
+                        },
+                        {
+                            "name": "Ext.macro.stream.raw_code",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 100KB of raw stream binary.  Can be useful to analyze false positives and malicious payloads."
+                        },
+                        {
+                            "name": "Ext.macro.stream.raw_code_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The original stream size.  Indicates whether stream.raw_code was truncated."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "Ext.original",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Original file information during a modification event."
+                        },
+                        {
+                            "name": "Ext.original.gid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "Ext.original.group",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "Ext.original.mode",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file mode prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file name prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.owner",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "Ext.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.uid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "Ext.quarantine_message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Message describing quarantine results."
+                        },
+                        {
+                            "name": "Ext.quarantine_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint the quarantined file was originally."
+                        },
+                        {
+                            "name": "Ext.quarantine_result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean representing whether or not file quarantine succeeded."
+                        },
+                        {
+                            "name": "Ext.temp_file_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
+                        },
+                        {
+                            "name": "Ext.windows",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Platform-specific Windows fields"
+                        },
+                        {
+                            "name": "Ext.windows.zone_identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Windows zone identifier for a file"
+                        },
+                        {
+                            "name": "accessed",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+                        },
+                        {
+                            "name": "attributes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
+                            "example": "[\"readonly\", \"system\"]"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "created",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "File creation time.\nNote that not all filesystems store the creation time."
+                        },
+                        {
+                            "name": "ctime",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+                        },
+                        {
+                            "name": "device",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device that is the source of the file.",
+                            "example": "sda"
+                        },
+                        {
+                            "name": "directory",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "drive_letter",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1,
+                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
+                            "example": "C"
+                        },
+                        {
+                            "name": "extension",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "gid",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "group",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "inode",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Inode representing the file in the filesystem.",
+                            "example": "256383"
+                        },
+                        {
+                            "name": "mime_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+                        },
+                        {
+                            "name": "mode",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode of the file in octal representation.",
+                            "example": "0640"
+                        },
+                        {
+                            "name": "mtime",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file content was modified."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "owner",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "size",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
+                            "example": 16384
+                        },
+                        {
+                            "name": "target_path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Target path for symlinks.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File type (file, dir, or symlink).",
+                            "example": "file"
+                        },
+                        {
+                            "name": "uid",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "boot.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
+                            "example": "88a1f0ed-5ae5-41ee-af6b-41921c311872"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "pid_ns_ino",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
+                            "example": 256383
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "user.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "user.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "user.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "user.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "user.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "user.email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "user.full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "user.group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "user.group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "user.group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "user.group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "user.group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "user.group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "user.group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "user.hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "user.id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "user.name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "orchestrator",
+                    "title": "Orchestrator",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields that describe the resources which container orchestrators manage or act upon.",
+                    "fields": [
+                        {
+                            "name": "cluster.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the cluster."
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Namespace in which the action is taking place.",
+                            "example": "kube-system"
+                        },
+                        {
+                            "name": "resource.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the resource being acted upon.",
+                            "example": "test-pod-cdcws"
+                        },
+                        {
+                            "name": "resource.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of resource being acted upon.",
+                            "example": "service"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.api.behaviors",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
+                            "example": "[ \"cross-process\", \"rapid_background_polling\", \"multiple_polling_processes\", \"native_api\", \"shellcode\" ]"
+                        },
+                        {
+                            "name": "Ext.api.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the API, usually the name of the function or system call.",
+                            "example": "VirtualAlloc"
+                        },
+                        {
+                            "name": "Ext.api.summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The summary of the API call and its parameters.",
+                            "example": "VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )"
+                        },
+                        {
+                            "name": "Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.created_suspended",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "Ext.dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory allocation containing the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Original memory size requested when the memory was allocated.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+                            "example": "PRIVATE"
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The address where bytes_compressed begins.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether bytes_compressed is present in this event.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A sequence of signature names matched.",
+                            "example": "Windows.EICAR.Not-a-virus"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature identifier"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The first matching details."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The first matching details.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of file matching signature."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of file matching signature."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the first yara rule matched."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the first yara rule matched."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature version"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
+                            "example": "C:\\Windows\\System32\\mshtml.dll"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the file at mapped_path is an executable.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether an executable file was found in memory.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.region_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.region_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "Ext.memory_region.region_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of the memory region.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.memory_region.region_start_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 64 bytes at the region base address.",
+                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
+                        },
+                        {
+                            "name": "Ext.memory_region.region_state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+                            "example": "COMMIT"
+                        },
+                        {
+                            "name": "Ext.memory_region.strings",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Array of strings found within the memory region.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "Ext.services",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Services running in this process."
+                        },
+                        {
+                            "name": "Ext.session",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Session information for the current process"
+                        },
+                        {
+                            "name": "Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "args",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "entry_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "entry_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "entry_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.entry_meta.source.ip",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the source (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "entry_leader.entry_meta.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
+                        },
+                        {
+                            "name": "entry_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "entry_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "entry_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "entry_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "entry_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "entry_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "entry_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "entry_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "env_vars",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"PATH=/usr/local/bin:/usr/bin\", \"USER=ubuntu\"]"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "group_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "group_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "group_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "group_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "group_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "group_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "group_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "group_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "group_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "group_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "group_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "group_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "group_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "parent.Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "parent.Ext.dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "parent.Ext.dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "parent.Ext.dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "parent.Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "parent.Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "parent.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "parent.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
+                        },
+                        {
+                            "name": "parent.Ext.real.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
+                        },
+                        {
+                            "name": "parent.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "parent.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "parent.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "parent.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "parent.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "parent.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "parent.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "parent.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "parent.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "parent.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "parent.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "parent.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "parent.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "parent.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "parent.Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "parent.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "parent.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "parent.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "parent.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "parent.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "parent.exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "parent.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.group_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.group_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "parent.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "parent.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "parent.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "parent.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "parent.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "parent.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "parent.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "parent.pgid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.ppid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "parent.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.thread.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.thread.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "parent.title",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ]
+                        },
+                        {
+                            "name": "parent.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "parent.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "parent.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "parent.uptime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "parent.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "pgid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "ppid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "previous.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "previous.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "previous.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "session_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "session_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "session_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "session_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "session_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "session_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "session_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "session_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "session_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.instruction_pointer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The return address of this stack frame."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.memory_section.memory_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.memory_section.memory_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.memory_section.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.module_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The name of the DLL/module containing `instruction_pointer`.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.module_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path to the DLL/module containing `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.rva",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The module that installed the final API hook in the call stack."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_hook_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_hook_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_hook_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_hook_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The final non-win32 module in the call stack."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_user_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file name of the call_stack_final_user_module.",
+                            "example": "example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_user_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a trampoline was detected, this indicates the original content for the thread start address in memory.",
+                            "example": 4194304
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.",
+                            "example": "48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc"
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_bytes_disasm",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the disassembled code at the original thread start address.",
+                            "example": "mov rax, 0x4141414141414141\\njmp rax"
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_bytes_disasm_hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
+                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.",
+                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
+                        },
+                        {
+                            "name": "thread.Ext.parameter",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a thread is created, this is the raw numerical value of its parameter."
+                        },
+                        {
+                            "name": "thread.Ext.parameter_bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "thread.Ext.parameter_bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether parameter_bytes_compressed is present in this event."
+                        },
+                        {
+                            "name": "thread.Ext.service",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Service associated with the thread.",
+                            "example": "VaultSvc"
+                        },
+                        {
+                            "name": "thread.Ext.start",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "The time the thread started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "thread.Ext.start_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Memory address where the thread began execution.",
+                            "example": 4194304
+                        },
+                        {
+                            "name": "thread.Ext.start_address_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "thread.Ext.start_address_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.",
+                            "example": "c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+                        },
+                        {
+                            "name": "thread.Ext.start_address_bytes_disasm",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The bytes at the thread start address, disassembled into human-readable assembly code.",
+                            "example": "ret\\nint3"
+                        },
+                        {
+                            "name": "thread.Ext.start_address_bytes_disasm_hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
+                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
+                        },
+                        {
+                            "name": "thread.Ext.start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The dll/module where the thread began execution.",
+                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
+                        },
+                        {
+                            "name": "thread.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "thread.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "thread.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "thread.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "thread.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "thread.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "thread.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "thread.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "thread.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "thread.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "thread.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "thread.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "thread.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "thread.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "thread.Ext.uptime",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Seconds since thread started."
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "title",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "working_directory",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "registry",
+                    "title": "Registry",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to Windows Registry operations.",
+                    "fields": [
+                        {
+                            "name": "data.strings",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "wildcard",
+                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
+                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path, including hive, key and value",
+                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
+                        },
+                        {
+                            "name": "value",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the value written.",
+                            "example": "Debugger"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "rule",
+                    "title": "Rule",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.",
+                    "fields": [
+                        {
+                            "name": "author",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.",
+                            "example": "[\"Star-Lord\"]"
+                        },
+                        {
+                            "name": "category",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A categorization value keyword used by the entity using the rule for detection of this event.",
+                            "example": "Attempted Information Leak"
+                        },
+                        {
+                            "name": "description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The description of the rule generating the event.",
+                            "example": "Block requests to public DNS over HTTPS / TLS protocols"
+                        },
+                        {
+                            "name": "id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
+                            "example": 101
+                        },
+                        {
+                            "name": "license",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the license under which the rule used to generate this event is made available.",
+                            "example": "Apache 2.0"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the rule or signature generating the event.",
+                            "example": "BLOCK_DNS_over_TLS"
+                        },
+                        {
+                            "name": "reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Reference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.",
+                            "example": "https://en.wikipedia.org/wiki/DNS_over_TLS"
+                        },
+                        {
+                            "name": "ruleset",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.",
+                            "example": "Standard_Protocol_Filters"
+                        },
+                        {
+                            "name": "uuid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.",
+                            "example": 1100110011
+                        },
+                        {
+                            "name": "version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version / revision of the rule being used for analysis.",
+                            "example": 1.1
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the source (IPv4 or IPv6)."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "threat",
+                    "title": "Threat",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.\nThese fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. \"impact\"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. \"endpoint denial of service\").",
+                    "fields": [
+                        {
+                            "name": "enrichments",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "A list of associated indicators objects enriching the event, and the context of that association/enrichment."
+                        },
+                        {
+                            "name": "enrichments.indicator",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Object containing associated indicators enriching the event."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy calculation of file's header and footer used to check file integrity."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.entry_modified",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.header_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.header_data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of malware_signature fieldset."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "The concatenated names of all yara signatures"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Malware artifact identifier."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of bytes representing yara signature matches"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature sha256."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature id."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature name."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of malware signature matches"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature version."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.monotonic_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "File event monotonic ID."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Original file information during a modification event."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.gid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.group",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.mode",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file mode prior to a modification event"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file name prior to a modification event"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.owner",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to a modification event"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.uid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.quarantine_message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Message describing quarantine results."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.quarantine_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint the quarantined file was originally."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.quarantine_result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean representing whether or not file quarantine succeeded."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.temp_file_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.windows",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Platform-specific Windows fields"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.windows.zone_identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Windows zone identifier for a file"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.accessed",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.attributes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
+                            "example": "[\"readonly\", \"system\"]"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.created",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "File creation time.\nNote that not all filesystems store the creation time."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.ctime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.device",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device that is the source of the file.",
+                            "example": "sda"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.drive_letter",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1,
+                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
+                            "example": "C"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Machine architecture of the ELF file.",
+                            "example": "x86-64"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.byte_order",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Byte sequence of ELF file.",
+                            "example": "Little Endian"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.cpu_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU type of the ELF file.",
+                            "example": "Intel"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.creation_date",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.exports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of exported element names and types."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.abi_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the ELF Application Binary Interface (ABI)."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.class",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Header class of the ELF file."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.data",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Data table of the ELF header."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.entrypoint",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Header entrypoint of the ELF file.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.object_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "\"0x1\" for original ELF files."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.os_abi",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Application Binary Interface (ABI) of the Linux OS."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Header type of the ELF file."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the ELF header."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.chi2",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Chi-square probability distribution of the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.flags",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List flags."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List name."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.physical_offset",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List offset."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List type."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.virtual_address",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List virtual address.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List virtual size.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.segments",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.segments.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF object segment sections."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.segments.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF object segment type."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.shared_libraries",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of shared libraries used by this ELF object."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.telfhash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "telfhash symbol hash for ELF file."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.extension",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.gid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.group",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.inode",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Inode representing the file in the filesystem.",
+                            "example": "256383"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.mime_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.mode",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode of the file in octal representation.",
+                            "example": "0640"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.mtime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file content was modified."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.owner",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
+                            "example": 16384
+                        },
+                        {
+                            "name": "enrichments.indicator.file.target_path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Target path for symlinks.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "enrichments.indicator.file.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File type (file, dir, or symlink).",
+                            "example": "file"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.uid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "enrichments.indicator.first_seen",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source first reported sighting this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.city_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.continent_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.country_iso_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.country_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.location",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.region_iso_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.region_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "enrichments.indicator.ip",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "ip",
+                            "description": "Identifies a threat indicator as an IP address (irrespective of direction).",
+                            "example": "1.2.3.4"
+                        },
+                        {
+                            "name": "enrichments.indicator.last_seen",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source last reported sighting this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.marking.tlp",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Traffic Light Protocol sharing markings.",
+                            "example": "CLEAR"
+                        },
+                        {
+                            "name": "enrichments.indicator.modified_at",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source last modified information for this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.port",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Identifies a threat indicator as a port number (irrespective of direction).",
+                            "example": 443
+                        },
+                        {
+                            "name": "enrichments.indicator.provider",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the indicator's provider.",
+                            "example": "lrz_urlhaus"
+                        },
+                        {
+                            "name": "enrichments.indicator.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Reference URL linking to additional information about this indicator.",
+                            "example": "https://system.example.com/indicator/0001234"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.data.bytes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
+                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.data.strings",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "wildcard",
+                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
+                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.data.type",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Standard registry type for encoding contents",
+                            "example": "REG_SZ"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.hive",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Abbreviated name for the hive.",
+                            "example": "HKLM"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.key",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hive-relative path of keys.",
+                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.path",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path, including hive, key and value",
+                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.value",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the value written.",
+                            "example": "Debugger"
+                        },
+                        {
+                            "name": "enrichments.indicator.scanner_stats",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Count of AV/EDR vendors that successfully detected malicious file or URL.",
+                            "example": 4
+                        },
+                        {
+                            "name": "enrichments.indicator.sightings",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Number of times this indicator was observed conducting threat activity.",
+                            "example": 20
+                        },
+                        {
+                            "name": "enrichments.indicator.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of indicator as represented by Cyber Observable in STIX 2.0.",
+                            "example": "ipv4-addr"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.",
+                            "example": "www.elastic.co"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.extension",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.fragment",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
+                        },
+                        {
+                            "name": "enrichments.indicator.url.full",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.original",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.password",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Password of the request."
+                        },
+                        {
+                            "name": "enrichments.indicator.url.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Path of the request, such as \"/search\"."
+                        },
+                        {
+                            "name": "enrichments.indicator.url.port",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Port of the request, such as 443.",
+                            "example": 443,
+                            "format": "string"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.query",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
+                        },
+                        {
+                            "name": "enrichments.indicator.url.registered_domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.scheme",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme.",
+                            "example": "https"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.subdomain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
+                            "example": "east"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.top_level_domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.username",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of the request."
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.alternative_names",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.",
+                            "example": "*.elastic.co"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.common_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of common name (CN) of issuing certificate authority.",
+                            "example": "Example SHA2 High Assurance Server CA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.country",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of country \\(C) codes",
+                            "example": "US"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.distinguished_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguished name (DN) of issuing certificate authority.",
+                            "example": "C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.locality",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of locality names (L)",
+                            "example": "Mountain View"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.organization",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizations (O) of issuing certificate authority.",
+                            "example": "Example Inc"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.organizational_unit",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizational units (OU) of issuing certificate authority.",
+                            "example": "www.example.com"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.state_or_province",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of state or province names (ST, S, or P)",
+                            "example": "California"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.not_after",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Time at which the certificate is no longer considered valid.",
+                            "example": "2020-07-16T03:15:39Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.not_before",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Time at which the certificate is first considered valid.",
+                            "example": "2019-08-16T01:40:25Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.public_key_algorithm",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Algorithm used to generate the public key.",
+                            "example": "RSA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.public_key_curve",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The curve used by the elliptic curve public key algorithm. This is algorithm specific.",
+                            "example": "nistp521"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.public_key_exponent",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Exponent used to derive the public key. This is algorithm specific.",
+                            "example": 65537,
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.public_key_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The size of the public key space in bits.",
+                            "example": 2048
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.serial_number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.",
+                            "example": "55FBB9C7DEBF09809D12CCAA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.signature_algorithm",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.",
+                            "example": "SHA256-RSA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.common_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of common names (CN) of subject.",
+                            "example": "shared.global.example.net"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.country",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of country \\(C) code",
+                            "example": "US"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.distinguished_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguished name (DN) of the certificate subject entity.",
+                            "example": "C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.locality",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of locality names (L)",
+                            "example": "San Francisco"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.organization",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizations (O) of subject.",
+                            "example": "Example, Inc."
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.organizational_unit",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizational units (OU) of subject."
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.state_or_province",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of state or province names (ST, S, or P)",
+                            "example": "California"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.version_number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of x509 format.",
+                            "example": 3
+                        },
+                        {
+                            "name": "enrichments.matched.atomic",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the atomic indicator value that matched a local environment endpoint or network event.",
+                            "example": "bad-domain.com"
+                        },
+                        {
+                            "name": "enrichments.matched.field",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the field of the atomic indicator that matched a local environment endpoint or network event.",
+                            "example": "file.hash.sha256"
+                        },
+                        {
+                            "name": "enrichments.matched.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the _id of the indicator document enriching the event.",
+                            "example": "ff93aee5-86a1-4a61-b0e6-0cdc313d01b5"
+                        },
+                        {
+                            "name": "enrichments.matched.index",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the _index of the indicator document enriching the event.",
+                            "example": "filebeat-8.0.0-2021.05.23-000011"
+                        },
+                        {
+                            "name": "enrichments.matched.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the type of match that caused the event to be enriched with the given indicator",
+                            "example": "indicator_match_rule"
+                        },
+                        {
+                            "name": "framework",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.",
+                            "example": "MITRE ATT&CK"
+                        },
+                        {
+                            "name": "group.alias",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group alias(es).",
+                            "example": "[ \"Magecart Group 6\" ]"
+                        },
+                        {
+                            "name": "group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group id.",
+                            "example": "G0037"
+                        },
+                        {
+                            "name": "group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group name.",
+                            "example": "FIN6"
+                        },
+                        {
+                            "name": "group.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group reference URL.",
+                            "example": "https://attack.mitre.org/groups/G0037/"
+                        },
+                        {
+                            "name": "indicator.as.number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
+                            "example": 15169
+                        },
+                        {
+                            "name": "indicator.as.organization.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Organization name.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "Google LLC"
+                        },
+                        {
+                            "name": "indicator.confidence",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.",
+                            "example": "Medium"
+                        },
+                        {
+                            "name": "indicator.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Describes the type of action conducted by the threat.",
+                            "example": "IP x.x.x.x was observed delivering the Angler EK."
+                        },
+                        {
+                            "name": "indicator.email.address",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies a threat indicator as an email address (irrespective of direction).",
+                            "example": "phish@example.com"
+                        },
+                        {
+                            "name": "indicator.file.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "indicator.file.Ext.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy calculation of file's header and footer used to check file integrity."
+                        },
+                        {
+                            "name": "indicator.file.Ext.entry_modified",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
+                        },
+                        {
+                            "name": "indicator.file.Ext.header_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "indicator.file.Ext.header_data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of malware_signature fieldset."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "The concatenated names of all yara signatures"
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Malware artifact identifier."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of bytes representing yara signature matches"
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature hash."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature sha256."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature id."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature name."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of malware signature matches"
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature version."
+                        },
+                        {
+                            "name": "indicator.file.Ext.monotonic_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "File event monotonic ID."
+                        },
+                        {
+                            "name": "indicator.file.Ext.original",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Original file information during a modification event."
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.gid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.group",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.mode",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file mode prior to a modification event"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file name prior to a modification event"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.owner",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to a modification event"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.uid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "indicator.file.Ext.quarantine_message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Message describing quarantine results."
+                        },
+                        {
+                            "name": "indicator.file.Ext.quarantine_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint the quarantined file was originally."
+                        },
+                        {
+                            "name": "indicator.file.Ext.quarantine_result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean representing whether or not file quarantine succeeded."
+                        },
+                        {
+                            "name": "indicator.file.Ext.temp_file_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
+                        },
+                        {
+                            "name": "indicator.file.Ext.windows",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Platform-specific Windows fields"
+                        },
+                        {
+                            "name": "indicator.file.Ext.windows.zone_identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Windows zone identifier for a file"
+                        },
+                        {
+                            "name": "indicator.file.accessed",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+                        },
+                        {
+                            "name": "indicator.file.attributes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
+                            "example": "[\"readonly\", \"system\"]"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.created",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "File creation time.\nNote that not all filesystems store the creation time."
+                        },
+                        {
+                            "name": "indicator.file.ctime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+                        },
+                        {
+                            "name": "indicator.file.device",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device that is the source of the file.",
+                            "example": "sda"
+                        },
+                        {
+                            "name": "indicator.file.directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "indicator.file.drive_letter",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1,
+                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
+                            "example": "C"
+                        },
+                        {
+                            "name": "indicator.file.elf.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Machine architecture of the ELF file.",
+                            "example": "x86-64"
+                        },
+                        {
+                            "name": "indicator.file.elf.byte_order",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Byte sequence of ELF file.",
+                            "example": "Little Endian"
+                        },
+                        {
+                            "name": "indicator.file.elf.cpu_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU type of the ELF file.",
+                            "example": "Intel"
+                        },
+                        {
+                            "name": "indicator.file.elf.creation_date",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
+                        },
+                        {
+                            "name": "indicator.file.elf.exports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of exported element names and types."
+                        },
+                        {
+                            "name": "indicator.file.elf.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "indicator.file.elf.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "indicator.file.elf.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.abi_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the ELF Application Binary Interface (ABI)."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.class",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Header class of the ELF file."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.data",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Data table of the ELF header."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.entrypoint",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Header entrypoint of the ELF file.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "indicator.file.elf.header.object_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "\"0x1\" for original ELF files."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.os_abi",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Application Binary Interface (ABI) of the Linux OS."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Header type of the ELF file."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the ELF header."
+                        },
+                        {
+                            "name": "indicator.file.elf.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "indicator.file.elf.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "indicator.file.elf.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.chi2",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Chi-square probability distribution of the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.flags",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List flags."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List name."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.physical_offset",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List offset."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List type."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.virtual_address",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List virtual address.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List virtual size.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "indicator.file.elf.segments",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
+                        },
+                        {
+                            "name": "indicator.file.elf.segments.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF object segment sections."
+                        },
+                        {
+                            "name": "indicator.file.elf.segments.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF object segment type."
+                        },
+                        {
+                            "name": "indicator.file.elf.shared_libraries",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of shared libraries used by this ELF object."
+                        },
+                        {
+                            "name": "indicator.file.elf.telfhash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "telfhash symbol hash for ELF file."
+                        },
+                        {
+                            "name": "indicator.file.extension",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "indicator.file.gid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "indicator.file.group",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "indicator.file.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "indicator.file.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "indicator.file.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "indicator.file.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "indicator.file.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "indicator.file.inode",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Inode representing the file in the filesystem.",
+                            "example": "256383"
+                        },
+                        {
+                            "name": "indicator.file.mime_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+                        },
+                        {
+                            "name": "indicator.file.mode",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode of the file in octal representation.",
+                            "example": "0640"
+                        },
+                        {
+                            "name": "indicator.file.mtime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file content was modified."
+                        },
+                        {
+                            "name": "indicator.file.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "indicator.file.owner",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "indicator.file.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "indicator.file.pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "indicator.file.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "indicator.file.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "indicator.file.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "indicator.file.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "indicator.file.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "indicator.file.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "indicator.file.size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
+                            "example": 16384
+                        },
+                        {
+                            "name": "indicator.file.target_path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Target path for symlinks.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "indicator.file.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File type (file, dir, or symlink).",
+                            "example": "file"
+                        },
+                        {
+                            "name": "indicator.file.uid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "indicator.first_seen",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source first reported sighting this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "indicator.geo.city_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "indicator.geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "indicator.geo.continent_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "indicator.geo.country_iso_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "indicator.geo.country_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "indicator.geo.location",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "indicator.geo.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "indicator.geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "indicator.geo.region_iso_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "indicator.geo.region_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "indicator.geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "indicator.ip",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "ip",
+                            "description": "Identifies a threat indicator as an IP address (irrespective of direction).",
+                            "example": "1.2.3.4"
+                        },
+                        {
+                            "name": "indicator.last_seen",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source last reported sighting this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "indicator.marking.tlp",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Traffic Light Protocol sharing markings.",
+                            "example": "CLEAR"
+                        },
+                        {
+                            "name": "indicator.modified_at",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source last modified information for this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "indicator.port",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Identifies a threat indicator as a port number (irrespective of direction).",
+                            "example": 443
+                        },
+                        {
+                            "name": "indicator.provider",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the indicator's provider.",
+                            "example": "lrz_urlhaus"
+                        },
+                        {
+                            "name": "indicator.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Reference URL linking to additional information about this indicator.",
+                            "example": "https://system.example.com/indicator/0001234"
+                        },
+                        {
+                            "name": "indicator.registry.data.bytes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
+                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
+                        },
+                        {
+                            "name": "indicator.registry.data.strings",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "wildcard",
+                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
+                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
+                        },
+                        {
+                            "name": "indicator.registry.data.type",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Standard registry type for encoding contents",
+                            "example": "REG_SZ"
+                        },
+                        {
+                            "name": "indicator.registry.hive",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Abbreviated name for the hive.",
+                            "example": "HKLM"
+                        },
+                        {
+                            "name": "indicator.registry.key",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hive-relative path of keys.",
+                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
+                        },
+                        {
+                            "name": "indicator.registry.path",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path, including hive, key and value",
+                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
+                        },
+                        {
+                            "name": "indicator.registry.value",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the value written.",
+                            "example": "Debugger"
+                        },
+                        {
+                            "name": "indicator.scanner_stats",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Count of AV/EDR vendors that successfully detected malicious file or URL.",
+                            "example": 4
+                        },
+                        {
+                            "name": "indicator.sightings",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Number of times this indicator was observed conducting threat activity.",
+                            "example": 20
+                        },
+                        {
+                            "name": "indicator.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of indicator as represented by Cyber Observable in STIX 2.0.",
+                            "example": "ipv4-addr"
+                        },
+                        {
+                            "name": "indicator.url.domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.",
+                            "example": "www.elastic.co"
+                        },
+                        {
+                            "name": "indicator.url.extension",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "indicator.url.fragment",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
+                        },
+                        {
+                            "name": "indicator.url.full",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top"
+                        },
+                        {
+                            "name": "indicator.url.original",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch"
+                        },
+                        {
+                            "name": "indicator.url.password",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Password of the request."
+                        },
+                        {
+                            "name": "indicator.url.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Path of the request, such as \"/search\"."
+                        },
+                        {
+                            "name": "indicator.url.port",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Port of the request, such as 443.",
+                            "example": 443,
+                            "format": "string"
+                        },
+                        {
+                            "name": "indicator.url.query",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
+                        },
+                        {
+                            "name": "indicator.url.registered_domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "indicator.url.scheme",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme.",
+                            "example": "https"
+                        },
+                        {
+                            "name": "indicator.url.subdomain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
+                            "example": "east"
+                        },
+                        {
+                            "name": "indicator.url.top_level_domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        },
+                        {
+                            "name": "indicator.url.username",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of the request."
+                        },
+                        {
+                            "name": "indicator.x509.alternative_names",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.",
+                            "example": "*.elastic.co"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.common_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of common name (CN) of issuing certificate authority.",
+                            "example": "Example SHA2 High Assurance Server CA"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.country",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of country \\(C) codes",
+                            "example": "US"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.distinguished_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguished name (DN) of issuing certificate authority.",
+                            "example": "C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.locality",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of locality names (L)",
+                            "example": "Mountain View"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.organization",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizations (O) of issuing certificate authority.",
+                            "example": "Example Inc"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.organizational_unit",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizational units (OU) of issuing certificate authority.",
+                            "example": "www.example.com"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.state_or_province",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of state or province names (ST, S, or P)",
+                            "example": "California"
+                        },
+                        {
+                            "name": "indicator.x509.not_after",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Time at which the certificate is no longer considered valid.",
+                            "example": "2020-07-16T03:15:39Z"
+                        },
+                        {
+                            "name": "indicator.x509.not_before",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Time at which the certificate is first considered valid.",
+                            "example": "2019-08-16T01:40:25Z"
+                        },
+                        {
+                            "name": "indicator.x509.public_key_algorithm",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Algorithm used to generate the public key.",
+                            "example": "RSA"
+                        },
+                        {
+                            "name": "indicator.x509.public_key_curve",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The curve used by the elliptic curve public key algorithm. This is algorithm specific.",
+                            "example": "nistp521"
+                        },
+                        {
+                            "name": "indicator.x509.public_key_exponent",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Exponent used to derive the public key. This is algorithm specific.",
+                            "example": 65537,
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "indicator.x509.public_key_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The size of the public key space in bits.",
+                            "example": 2048
+                        },
+                        {
+                            "name": "indicator.x509.serial_number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.",
+                            "example": "55FBB9C7DEBF09809D12CCAA"
+                        },
+                        {
+                            "name": "indicator.x509.signature_algorithm",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.",
+                            "example": "SHA256-RSA"
+                        },
+                        {
+                            "name": "indicator.x509.subject.common_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of common names (CN) of subject.",
+                            "example": "shared.global.example.net"
+                        },
+                        {
+                            "name": "indicator.x509.subject.country",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of country \\(C) code",
+                            "example": "US"
+                        },
+                        {
+                            "name": "indicator.x509.subject.distinguished_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguished name (DN) of the certificate subject entity.",
+                            "example": "C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net"
+                        },
+                        {
+                            "name": "indicator.x509.subject.locality",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of locality names (L)",
+                            "example": "San Francisco"
+                        },
+                        {
+                            "name": "indicator.x509.subject.organization",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizations (O) of subject.",
+                            "example": "Example, Inc."
+                        },
+                        {
+                            "name": "indicator.x509.subject.organizational_unit",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizational units (OU) of subject."
+                        },
+                        {
+                            "name": "indicator.x509.subject.state_or_province",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of state or province names (ST, S, or P)",
+                            "example": "California"
+                        },
+                        {
+                            "name": "indicator.x509.version_number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of x509 format.",
+                            "example": 3
+                        },
+                        {
+                            "name": "software.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software id.",
+                            "example": "S0552"
+                        },
+                        {
+                            "name": "software.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software name.",
+                            "example": "AdFind"
+                        },
+                        {
+                            "name": "software.platforms",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use MITRE ATT&CK® software platform values.",
+                            "example": "[ \"Windows\" ]"
+                        },
+                        {
+                            "name": "software.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software reference URL.",
+                            "example": "https://attack.mitre.org/software/S0552/"
+                        },
+                        {
+                            "name": "software.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software type.",
+                            "example": "Tool"
+                        },
+                        {
+                            "name": "tactic.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )",
+                            "example": "TA0002"
+                        },
+                        {
+                            "name": "tactic.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)",
+                            "example": "Execution"
+                        },
+                        {
+                            "name": "tactic.reference",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )",
+                            "example": "https://attack.mitre.org/tactics/TA0002/"
+                        },
+                        {
+                            "name": "technique.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
+                            "example": "T1059"
+                        },
+                        {
+                            "name": "technique.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Command and Scripting Interpreter"
+                        },
+                        {
+                            "name": "technique.reference",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
+                            "example": "https://attack.mitre.org/techniques/T1059/"
+                        },
+                        {
+                            "name": "technique.subtechnique.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
+                            "example": "T1059.001"
+                        },
+                        {
+                            "name": "technique.subtechnique.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "PowerShell"
+                        },
+                        {
+                            "name": "technique.subtechnique.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
+                            "example": "https://attack.mitre.org/techniques/T1059/001/"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "build": {
+                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+                    },
+                    "id": "2b1eb7f7-bd61-436a-98af-c2b182043476",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "container": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "image": {
+                        "name": "docker.io/library/nginx",
+                        "tag": "latest"
+                    },
+                    "name": "nginx"
+                },
+                "cloud": {
+                    "account": {
+                        "id": "1234"
+                    },
+                    "instance": {
+                        "name": "webserver-12"
+                    },
+                    "project": {
+                        "id": "1234"
+                    },
+                    "provider": "aws",
+                    "region": "us-east-1"
+                },
+                "orchestrator": {
+                    "cluster": {
+                        "name": "webservers"
+                    },
+                    "namespace": "webapp",
+                    "resource": {
+                        "name": "webservers",
+                        "type": "kubernetes"
+                    }
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw"
+                        ],
+                        "protection": "PsProtectedSignerWinSystem",
+                        "user": "SYSTEM",
+                        "architecture": "x86_64",
+                        "token": {
+                            "elevation": true,
+                            "integrity_level_name": "system",
+                            "domain": "NT AUTHORITY",
+                            "user": "SYSTEM",
+                            "elevation_type": "default",
+                            "sid": "S-1-5-18"
+                        },
+                        "memory_region": {
+                            "region_size": 4096,
+                            "region_protection": "RWX",
+                            "allocation_base": 2401471234048,
+                            "allocation_type": "PRIVATE",
+                            "bytes_allocation_offset": 0,
+                            "region_state": "COMMIT",
+                            "bytes_compressed_present": false,
+                            "region_start_bytes": "58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124",
+                            "allocation_protection": "RW-",
+                            "region_base": 2401471238144,
+                            "allocation_size": 8192,
+                            "bytes_address": 2401471234048
+                        }
+                    },
+                    "parent": {
+                        "Ext": {
+                            "protection": "",
+                            "user": "",
+                            "architecture": "unknown"
+                        },
+                        "name": "System Idle Process",
+                        "start": "2022-04-04T12:15:41.4606245Z",
+                        "pid": 0,
+                        "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
+                        "command_line": "",
+                        "executable": "",
+                        "ppid": 0,
+                        "uptime": 822
+                    },
+                    "pe": {},
+                    "name": "System",
+                    "start": "2022-04-04T12:15:41.4606245Z",
+                    "pid": 4,
+                    "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTQtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
+                    "command_line": "",
+                    "executable": "",
+                    "thread": {
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "instruction_pointer": 140705188471348,
+                                    "memory_section": {
+                                        "memory_address": 140705187827712,
+                                        "memory_size": 1163264,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "ntdll.dll",
+                                    "module_path": "c:\\windows\\system32\\ntdll.dll",
+                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!NtAlpcSendWaitReceivePort+0x14"
+                                },
+                                {
+                                    "instruction_pointer": 140705158956066,
+                                    "memory_section": {
+                                        "memory_address": 140705158664192,
+                                        "memory_size": 921600,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "rpcrt4.dll",
+                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879048422"
+                                },
+                                {
+                                    "instruction_pointer": 140705158944113,
+                                    "memory_section": {
+                                        "memory_address": 140705158664192,
+                                        "memory_size": 921600,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "rpcrt4.dll",
+                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879045571"
+                                },
+                                {
+                                    "instruction_pointer": 140705158854463,
+                                    "memory_section": {
+                                        "memory_address": 140705158664192,
+                                        "memory_size": 921600,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "rpcrt4.dll",
+                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF87902F73F"
+                                },
+                                {
+                                    "instruction_pointer": 140705155101013,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9B155"
+                                },
+                                {
+                                    "instruction_pointer": 140705155097096,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9A208"
+                                },
+                                {
+                                    "instruction_pointer": 140705155090820,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C98984"
+                                },
+                                {
+                                    "instruction_pointer": 140705155093243,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C992FB"
+                                },
+                                {
+                                    "instruction_pointer": 140705155073556,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C94614"
+                                },
+                                {
+                                    "instruction_pointer": 140705155277630,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC633E"
+                                },
+                                {
+                                    "instruction_pointer": 140705158666224,
+                                    "memory_section": {
+                                        "memory_address": 140705158664192,
+                                        "memory_size": 921600,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "rpcrt4.dll",
+                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF8790017F0"
+                                },
+                                {
+                                    "instruction_pointer": 140705155255496,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC0CC8"
+                                },
+                                {
+                                    "instruction_pointer": 140705155775858,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878D3FD72"
+                                },
+                                {
+                                    "instruction_pointer": 140704876148243,
+                                    "memory_section": {
+                                        "memory_address": 140704875483136,
+                                        "memory_size": 708608,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "fastprox.dll",
+                                    "module_path": "c:\\windows\\system32\\wbem\\fastprox.dll",
+                                    "symbol_info": "c:\\windows\\system32\\wbem\\fastprox.dll!0x7FF868293613"
+                                },
+                                {
+                                    "instruction_pointer": 140699640718787,
+                                    "memory_section": {
+                                        "memory_address": 140699634241536,
+                                        "memory_size": 9220096,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "alertstests.exe",
+                                    "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
+                                    "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301AE5C3"
+                                },
+                                {
+                                    "instruction_pointer": 140699640807495,
+                                    "memory_section": {
+                                        "memory_address": 140699634241536,
+                                        "memory_size": 9220096,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "alertstests.exe",
+                                    "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
+                                    "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301C4047"
+                                },
+                                {
+                                    "instruction_pointer": 140705160001044,
+                                    "memory_section": {
+                                        "memory_address": 140705159909376,
+                                        "memory_size": 520192,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "kernel32.dll",
+                                    "module_path": "c:\\windows\\system32\\kernel32.dll",
+                                    "symbol_info": "c:\\windows\\system32\\kernel32.dll!BaseThreadInitThunk+0x14"
+                                },
+                                {
+                                    "instruction_pointer": 140705188161185,
+                                    "memory_section": {
+                                        "memory_address": 140705187827712,
+                                        "memory_size": 1163264,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "ntdll.dll",
+                                    "module_path": "c:\\windows\\system32\\ntdll.dll",
+                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                }
+                            ],
+                            "call_stack_final_hook_module": {
+                                "code_signature": [
+                                    {
+                                        "exists": true,
+                                        "status": "trusted",
+                                        "subject_name": "Microsoft Corporation",
+                                        "trusted": true
+                                    }
+                                ],
+                                "hash": {
+                                    "sha256": "e5bfc1a2967fa513177a0327770927d9a2efa5a4f33ac18f716bae7c3f857994"
+                                },
+                                "path": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\131.0.2903.112\\msedge_elf.dll"
+                            },
+                            "call_stack_final_user_module": {
+                                "code_signature": [
+                                    {
+                                        "exists": true,
+                                        "status": "trusted",
+                                        "subject_name": "Microsoft Windows",
+                                        "trusted": true
+                                    }
+                                ],
+                                "hash": {
+                                    "sha256": "8c9740e7fe9c97d5782b8d3db102c7880c40f0b27f20d3ec9f334fe0161b7e55"
+                                },
+                                "name": "rpcrt4.dll",
+                                "path": "c:\\windows\\system32\\rpcrt4.dll"
+                            },
+                            "call_stack_summary": "ntdll.dll, rpcrt4.dll, combase.dll, rpcrt4.dll, combase.dll, fastprox.dll, alertstests.exe, kernel32.dll, ntdll.dll",
+                            "hardware_breakpoint_set": true,
+                            "start_address": 140699640807104,
+                            "start_address_module": "C:\\Users\\vagrant\\endpoint-dev\\Build\\_WS-vs2019-x64-dbg\\AlertsTests\\Debug\\AlertsTests.exe"
+                        },
+                        "id": 5752
+                    },
+                    "uptime": 822
+                },
+                "rule": {
+                    "ruleset": "production"
+                },
+                "message": "Malware Prevention Alert",
+                "@timestamp": "2022-04-04T12:15:41.5944062Z",
+                "file": {
+                    "Ext": {
+                        "temp_file_path": "C:\\Windows\\TEMP\\90edbe42-fe6c-4965-8a6b-222aa2b15cf2",
+                        "code_signature": [
+                            {
+                                "exists": false
+                            }
+                        ],
+                        "quarantine_path": "C:\\.equarantine\\20a65f043449c96f10e538a860a415b55ff46c93",
+                        "quarantine_message": "Success",
+                        "quarantine_result": true,
+                        "malware_classification": {
+                            "identifier": "endpointpe-v4-model",
+                            "score": 0.692318737506866,
+                            "threshold": 0.58,
+                            "version": "4.0.19000"
+                        }
+                    },
+                    "owner": "Administrators",
+                    "extension": "dll",
+                    "drive_letter": "C",
+                    "created": "2022-04-04T12:15:41.4606245Z",
+                    "accessed": "2022-04-04T12:15:41.4606245Z",
+                    "mtime": "2022-04-04T12:15:41.4606245Z",
+                    "directory": "C:\\sysmon",
+                    "path": "C:\\sysmon\\9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
+                    "code_signature": {
+                        "exists": false
+                    },
+                    "size": 4608,
+                    "pe": {
+                        "file_version": "0.0.0.0",
+                        "description": " ",
+                        "original_file_name": "5t5mpwxc.dll",
+                        "Ext": {
+                            "dotnet": true,
+                            "streams": [
+                                {
+                                    "name": "#~",
+                                    "hash": {
+                                        "md5": "debf08c09d49337fbe7acde4d3749242",
+                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
+                                    }
+                                },
+                                {
+                                    "name": "#Blob",
+                                    "hash": {
+                                        "md5": "debf08c09d49337fbe7acde4d3749242",
+                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
+                                    }
+                                }
+                            ],
+                            "sections": [
+                                {
+                                    "name": ".reloc",
+                                    "hash": {
+                                        "md5": "debf08c09d49337fbe7acde4d3749242",
+                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "name": "9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
+                    "hash": {
+                        "sha1": "9c0e42a47d34240a9a4101cc5d3bc5787dc5ad73",
+                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53",
+                        "md5": "debf08c09d49337fbe7acde4d3749242"
+                    }
+                },
+                "Endpoint": {
+                    "policy": {
+                        "applied": {
+                            "artifacts": {
+                                "global": {
+                                    "identifiers": [
+                                        {
+                                            "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
+                                            "name": "diagnostic-configuration-v1"
+                                        },
+                                        {
+                                            "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
+                                            "name": "diagnostic-endpointpe-v4-blocklist"
+                                        },
+                                        {
+                                            "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
+                                            "name": "diagnostic-endpointpe-v4-exceptionlist"
+                                        },
+                                        {
+                                            "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
+                                            "name": "diagnostic-endpointpe-v4-model"
+                                        },
+                                        {
+                                            "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
+                                            "name": "diagnostic-malware-signature-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
+                                            "name": "diagnostic-ransomware-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
+                                            "name": "diagnostic-rules-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
+                                            "name": "endpointpe-v4-blocklist"
+                                        },
+                                        {
+                                            "sha256": "d784c2aa70a2216dd5bfeecfdd67a83ff5b656e9321bd70cf345a8667a63fb2e",
+                                            "name": "endpointpe-v4-exceptionlist"
+                                        },
+                                        {
+                                            "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
+                                            "name": "endpointpe-v4-model"
+                                        },
+                                        {
+                                            "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
+                                            "name": "global-configuration-v1"
+                                        },
+                                        {
+                                            "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
+                                            "name": "global-exceptionlist-windows"
+                                        },
+                                        {
+                                            "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
+                                            "name": "global-trustlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
+                                            "name": "production-malware-signature-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
+                                            "name": "production-ransomware-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
+                                            "name": "production-rules-windows-v1"
+                                        }
+                                    ],
+                                    "update_age": 0,
+                                    "snapshot": "2023-09-26",
+                                    "version": "1.0.260"
+                                },
+                                "user": {
+                                    "identifiers": [
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-blocklist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-eventfilterlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-exceptionlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-hostisolationexceptionlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-trustlist-windows-v1"
+                                        }
+                                    ],
+                                    "version": "1.0.0"
+                                }
+                            }
+                        }
+                    }
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.alerts"
+                },
+                "elastic": {
+                    "agent": {
+                        "id": "2b1eb7f7-bd61-436a-98af-c2b182043476"
+                    }
+                },
+                "host": {
+                    "hostname": "security-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.34",
+                        "fe80::4850:4f4f:4b53:8103",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "security-win-1",
+                    "id": "bbea673e-eae6-4b03-8724-2183f79da331",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "severity": 73,
+                    "code": "malicious_file",
+                    "risk_score": 73,
+                    "created": "2022-04-04T12:15:41.5944062Z",
+                    "kind": "alert",
+                    "module": "endpoint",
+                    "type": [
+                        "info",
+                        "change",
+                        "denied"
+                    ],
+                    "agent_id_status": "verified",
+                    "sequence": 29414,
+                    "ingested": "2022-04-04T12:19:33Z",
+                    "action": "rename",
+                    "id": "MYfSjQEEEFe1o09b+++++D5Q",
+                    "category": [
+                        "malware",
+                        "intrusion_detection",
+                        "file"
+                    ],
+                    "dataset": "endpoint.alerts",
+                    "outcome": "success"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM"
+                },
+                "Memory_protection": {
+                    "cross_session": false,
+                    "feature": "shellcode_thread",
+                    "parent_to_child": false,
+                    "self_injection": false,
+                    "unique_key_v2": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
+                },
+                "Responses": [
+                    {
+                        "@timestamp": "2023-04-13T16:15:16.0Z",
+                        "action": {
+                            "action": "file_rollback",
+                            "file": {
+                                "attributes": [
+                                    "invalid"
+                                ],
+                                "path": "",
+                                "reason": 2147484160
+                            },
+                            "source": {
+                                "attributes": [
+                                    "archive"
+                                ],
+                                "path": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy55\\git\\endpoint-dev\\Python\\runtime\\failed_test_logs\\20230413_181248\\EndpointRollbackTestCase\\test_rollback_trigger_malware_1_prevent\\tmp\\TRA14KA5Z2\\ExceptionlistTester-Windows.1d1phoq97d"
+                            }
+                        },
+                        "message": "Successful production rollback",
+                        "result": 0
+                    },
+                    {
+                        "@timestamp": "2023-04-13T16:15:16.0Z",
+                        "action": {
+                            "action": "registry_rollback",
+                            "key": {
+                                "actions": [
+                                    "Deleted"
+                                ],
+                                "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback\\1"
+                            }
+                        },
+                        "message": "Successful production registry rollback",
+                        "result": 0
+                    },
+                    {
+                        "@timestamp": "2023-04-13T16:15:16.0Z",
+                        "action": {
+                            "action": "registry_rollback",
+                            "key": {
+                                "actions": [
+                                    "Modified"
+                                ],
+                                "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback.valuetest",
+                                "values": [
+                                    {
+                                        "actions": [
+                                            "Deleted"
+                                        ],
+                                        "name": "SomeValue"
+                                    }
+                                ]
+                            }
+                        }
+                    },
+                    {
+                        "@timestamp": "2023-07-19T14:21:05.0Z",
+                        "action": {
+                            "action": "process_rollback",
+                            "process": {
+                                "path": "C:\\Users\\Pawel Mirski\\AppData\\Local\\Programs\\Python\\Python38-32\\python.exe"
+                            }
+                        },
+                        "message": "Successful production process rollback",
+                        "result": 0
+                    }
+                ]
+            }
+        },
+        {
+            "name": "policy",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Endpoint",
+                    "title": "Endpoint",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
+                    "fields": [
+                        {
+                            "name": "configuration",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
+                        },
+                        {
+                            "name": "configuration.isolation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Configuration setting for Host Isolation from the network"
+                        },
+                        {
+                            "name": "policy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The policy fields are used to hold information about applied policy."
+                        },
+                        {
+                            "name": "policy.applied",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about the policy that is applied"
+                        },
+                        {
+                            "name": "policy.applied.actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "actions applied during the application of the policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.actions.message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "message about the application of the action to further qualify the status of the action"
+                        },
+                        {
+                            "name": "policy.applied.actions.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "name of the action that was applied"
+                        },
+                        {
+                            "name": "policy.applied.actions.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the status of the action"
+                        },
+                        {
+                            "name": "policy.applied.artifacts",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about global protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.channel",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "global artifacts rollout channel"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "the identifiers of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of global artifact applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the sha256 of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.snapshot",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the snapshot date of applied global artifacts or 'latest'"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.update_age",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "number of days since global artifacts were made up-to-date"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about user protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "the identifiers of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of user artifact applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the sha256 of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.endpoint_policy_version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of this applied policy"
+                        },
+                        {
+                            "name": "policy.applied.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the id of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of this applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "the response of actions that failed in the applied policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.response.configurations",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "the configurations of the applied policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.antivirus_registration",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall antivirus registration configuration and status of the applied policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.antivirus_registration.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for antivirus registration"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.antivirus_registration.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.attack_surface_reduction.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for attack surface reduction"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.attack_surface_reduction.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.behavior_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for behavior_protection"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.behavior_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.events",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall event collection configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.events.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for event collection"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.events.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.host_isolation.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for host isolation"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.host_isolation.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.logging",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall logging configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.logging.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for logging"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.logging.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.malware",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall malware configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.malware.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for malware"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.malware.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.memory_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall memory_protection configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.memory_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for memory_protection"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.memory_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.ransomware.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for ransomware"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.ransomware.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.streaming",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall data streaming configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.streaming.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for data streaming"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.streaming.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "the diagnostic configurations of the applied policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.behavior_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of behavior protection"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.behavior_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.credential_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of credential protection"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.credential_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of credential protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.malware.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of malware"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.malware.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.memory_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of memory protection"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.memory_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.memory_scan.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of memory scan"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.memory_scan.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of memory scan, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.ransomware.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of ransomware"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.ransomware.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of this applied policy"
+                        },
+                        {
+                            "name": "state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
+                        },
+                        {
+                            "name": "state.isolation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Current network isolation state of the host"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "build.original",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Extended build information for the agent.\nThis field is intended to contain any build information that a data source may provide, no specific formatting is required.",
+                            "example": "metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "build": {
+                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+                    },
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "message": "Endpoint policy change",
+                "@timestamp": "2022-04-04T18:38:15.7178887Z",
+                "Endpoint": {
+                    "configuration": {
+                        "isolation": false
+                    },
+                    "state": {
+                        "isolation": false
+                    },
+                    "policy": {
+                        "applied": {
+                            "response": {
+                                "configurations": {
+                                    "behavior_protection": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "configure_file_events",
+                                            "configure_network_events",
+                                            "configure_process_events",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "configure_imageload_events",
+                                            "configure_dns_events",
+                                            "configure_security_events",
+                                            "configure_registry_events",
+                                            "configure_malicious_behavior"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "streaming": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "configure_output",
+                                            "workflow"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "malware": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "configure_malware",
+                                            "configure_kernel",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "connect_kernel",
+                                            "configure_user_notification",
+                                            "configure_alerts",
+                                            "detect_file_open_events",
+                                            "detect_sync_image_load_events"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "logging": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "configure_logging",
+                                            "workflow"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "antivirus_registration": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "configure_antivirus_registration",
+                                            "workflow"
+                                        ],
+                                        "status": "unsupported"
+                                    },
+                                    "host_isolation": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "configure_host_isolation",
+                                            "load_config",
+                                            "workflow",
+                                            "connect_kernel",
+                                            "configure_user_notification"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "events": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "detect_network_events",
+                                            "configure_file_events",
+                                            "configure_network_events",
+                                            "configure_process_events",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "detect_file_open_events",
+                                            "detect_file_access_events",
+                                            "detect_async_image_load_events",
+                                            "detect_registry_events",
+                                            "detect_registry_access_events",
+                                            "configure_imageload_events",
+                                            "configure_dns_events",
+                                            "configure_security_events",
+                                            "configure_registry_events"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "ransomware": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "configure_process_events",
+                                            "configure_file_events",
+                                            "configure_ransomware",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "configure_user_notification"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "memory_protection": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "configure_memory_threat",
+                                            "configure_process_events",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "workflow",
+                                            "load_config",
+                                            "detect_process_events",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "detect_thread_events"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "attack_surface_reduction": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "configure_credential_hardening",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "workflow",
+                                            "load_config",
+                                            "configure_kernel",
+                                            "connect_kernel"
+                                        ],
+                                        "status": "success"
+                                    }
+                                },
+                                "diagnostic": {
+                                    "behavior_protection": {
+                                        "concerned_actions": [
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "configure_file_events",
+                                            "configure_network_events",
+                                            "configure_process_events",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "configure_imageload_events",
+                                            "configure_dns_events",
+                                            "configure_security_events",
+                                            "configure_registry_events",
+                                            "configure_diagnostic_rollback",
+                                            "detect_process_handle_events",
+                                            "configure_diagnostic_malicious_behavior"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "malware": {
+                                        "concerned_actions": [
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "configure_diagnostic_malware",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "connect_kernel",
+                                            "configure_kernel",
+                                            "detect_file_open_events",
+                                            "detect_sync_image_load_events",
+                                            "configure_diagnostic_rollback"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "ransomware": {
+                                        "concerned_actions": [
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "configure_process_events",
+                                            "configure_file_events",
+                                            "configure_diagnostic_ransomware",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "configure_diagnostic_rollback"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "memory_protection": {
+                                        "concerned_actions": [
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "detect_process_events",
+                                            "configure_process_events",
+                                            "configure_diagnostic_memory_threat",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "detect_thread_events",
+                                            "configure_diagnostic_rollback"
+                                        ],
+                                        "status": "success"
+                                    }
+                                }
+                            },
+                            "name": "endpoint-1",
+                            "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
+                            "actions": [
+                                {
+                                    "name": "configure_antivirus_registration",
+                                    "message": "Antivirus registration is not possible on servers",
+                                    "status": "unsupported"
+                                },
+                                {
+                                    "name": "configure_ransomware",
+                                    "message": "Successfully enabled ransomware prevention with mbr enabled and canaries enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_memory_threat",
+                                    "message": "Successfully enabled memory threat prevention with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_memory_threat",
+                                    "message": "Successfully enabled memory threat detection with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_host_isolation",
+                                    "message": "Host is not isolated",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_malicious_behavior",
+                                    "message": "Enabled 152 out of 152 malicious behavior rules",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_malicious_behavior",
+                                    "message": "Enabled 196 out of 196 diagnostic malicious behavior rules",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_user_notification",
+                                    "message": "Successfully configured user notification",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_malware",
+                                    "message": "Successfully enabled malware prevention",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_malware",
+                                    "message": "Successfully enabled malware detection",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_rollback",
+                                    "message": "Diagnostic system rollback is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_kernel",
+                                    "message": "Successfully configured kernel",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_output",
+                                    "message": "Successfully configured output connection",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_alerts",
+                                    "message": "Successfully configured alerts",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_logging",
+                                    "message": "Successfully configured logging",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "load_config",
+                                    "message": "Successfully parsed configuration",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "download_user_artifacts",
+                                    "message": "Successfully downloaded user artifacts",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "download_global_artifacts",
+                                    "message": "Global artifacts are available for use",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "connect_kernel",
+                                    "message": "Successfully connected to kernel",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_process_events",
+                                    "message": "Successfully started process event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_sync_image_load_events",
+                                    "message": "Successfully started sync image load event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_async_image_load_events",
+                                    "message": "Successfully started async image load event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_file_write_events",
+                                    "message": "Successfully started file write event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_file_open_events",
+                                    "message": "Successfully stopped file open event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_network_events",
+                                    "message": "Successfully started network event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_registry_events",
+                                    "message": "Successfully started registry event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_thread_events",
+                                    "message": "Successfully configured thread events",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_file_access_events",
+                                    "message": "Successfully configured file access event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_registry_access_events",
+                                    "message": "Successfully configured registry access event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_process_handle_events",
+                                    "message": "Successfully started process handle event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_file_events",
+                                    "message": "Success enabling file events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_network_events",
+                                    "message": "Success enabling network events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_process_events",
+                                    "message": "Success enabling process events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_imageload_events",
+                                    "message": "Success enabling image load events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_dns_events",
+                                    "message": "Success enabling dns events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_registry_events",
+                                    "message": "Success enabling registry events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_security_events",
+                                    "message": "Success enabling security events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_ransomware",
+                                    "message": "Successfully enabled ransomware detection with mbr enabled and canaries enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "agent_connectivity",
+                                    "message": "Successfully connected to Agent",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "workflow",
+                                    "message": "Successfully executed all workflows",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_credential_hardening",
+                                    "message": "Successfully configured credential hardening",
+                                    "status": "success"
+                                }
+                            ],
+                            "endpoint_policy_version": "1",
+                            "version": "2",
+                            "artifacts": {
+                                "global": {
+                                    "channel": "stable",
+                                    "identifiers": [
+                                        {
+                                            "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
+                                            "name": "diagnostic-configuration-v1"
+                                        },
+                                        {
+                                            "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
+                                            "name": "diagnostic-endpointpe-v4-blocklist"
+                                        },
+                                        {
+                                            "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
+                                            "name": "diagnostic-endpointpe-v4-exceptionlist"
+                                        },
+                                        {
+                                            "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
+                                            "name": "diagnostic-endpointpe-v4-model"
+                                        },
+                                        {
+                                            "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
+                                            "name": "diagnostic-malware-signature-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
+                                            "name": "diagnostic-ransomware-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
+                                            "name": "diagnostic-rules-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
+                                            "name": "endpointpe-v4-blocklist"
+                                        },
+                                        {
+                                            "sha256": "b49fdcd8bf63af07ab1e74352137eb20f1e3710640dfcb1bfff3f7273ee14a7f",
+                                            "name": "endpointpe-v4-exceptionlist"
+                                        },
+                                        {
+                                            "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
+                                            "name": "endpointpe-v4-model"
+                                        },
+                                        {
+                                            "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
+                                            "name": "global-configuration-v1"
+                                        },
+                                        {
+                                            "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
+                                            "name": "global-exceptionlist-windows"
+                                        },
+                                        {
+                                            "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
+                                            "name": "global-trustlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
+                                            "name": "production-malware-signature-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
+                                            "name": "production-ransomware-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
+                                            "name": "production-rules-windows-v1"
+                                        }
+                                    ],
+                                    "update_age": 0,
+                                    "snapshot": "2023-09-26",
+                                    "version": "1.0.261"
+                                },
+                                "user": {
+                                    "identifiers": [
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-blocklist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-eventfilterlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-exceptionlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-hostisolationexceptionlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-trustlist-windows-v1"
+                                        }
+                                    ],
+                                    "version": "1.0.0"
+                                }
+                            },
+                            "status": "success"
+                        }
+                    }
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "metrics",
+                    "dataset": "endpoint.policy"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 35122,
+                    "ingested": "2022-04-04T18:38:16Z",
+                    "created": "2022-04-04T18:38:15.7178887Z",
+                    "kind": "state",
+                    "module": "endpoint",
+                    "action": "endpoint_policy_response",
+                    "id": "MYfZG00oEwD2/fqT+++++Bye",
+                    "category": [
+                        "host"
+                    ],
+                    "type": [
+                        "change"
+                    ],
+                    "dataset": "endpoint.policy"
+                }
+            }
+        },
+        {
+            "name": "registry",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Effective_process",
+                    "title": "Effective_process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
+                    "fields": [
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the effective process.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Executable name for the effective process.",
+                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name for the effective process.",
+                            "example": "WMIC.exe"
+                        },
+                        {
+                            "name": "pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process ID.",
+                            "example": 4242
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": true
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "registry",
+                    "title": "Registry",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to Windows Registry operations.",
+                    "fields": [
+                        {
+                            "name": "data.bytes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
+                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
+                        },
+                        {
+                            "name": "data.strings",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "wildcard",
+                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
+                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
+                        },
+                        {
+                            "name": "data.type",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Standard registry type for encoding contents",
+                            "example": "REG_SZ"
+                        },
+                        {
+                            "name": "hive",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Abbreviated name for the hive.",
+                            "example": "HKLM"
+                        },
+                        {
+                            "name": "key",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hive-relative path of keys.",
+                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path, including hive, key and value",
+                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
+                        },
+                        {
+                            "name": "value",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the value written.",
+                            "example": "Debugger"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "registry": {
+                    "hive": "HKLM",
+                    "path": "HKLM\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
+                    "data": {
+                        "strings": [],
+                        "type": "REG_NONE"
+                    },
+                    "value": "Enabled",
+                    "key": "SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
+                },
+                "agent": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "Effective_process": {
+                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
+                    "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
+                    "name": "WMIC.exe",
+                    "pid": 2732
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+                        ],
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows Publisher",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ]
+                    },
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows Publisher",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "name": "svchost.exe",
+                    "pid": 2772,
+                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
+                    "executable": "C:\\Windows\\System32\\svchost.exe",
+                    "thread": {
+                        "id": 340,
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "allocation_private_bytes": 16384,
+                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "protection": "RWX",
+                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                }
+                            ],
+                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                            "hardware_breakpoint_set": true
+                        }
+                    }
+                },
+                "message": "Endpoint registry event",
+                "@timestamp": "2022-04-04T18:53:09.1283846Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.registry"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 36271,
+                    "ingested": "2022-04-04T18:53:18Z",
+                    "created": "2022-04-04T18:53:09.1283846Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "query",
+                    "id": "MYfZG00oEwD2/fqT+++++CMy",
+                    "category": [
+                        "registry"
+                    ],
+                    "type": [
+                        "access"
+                    ],
+                    "dataset": "endpoint.events.registry"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                }
+            }
+        },
+        {
+            "name": "process",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "ephemeral_id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
+                            "example": "8a4f500f"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
+                            "example": "foo"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "cloud",
+                    "title": "Cloud",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to the cloud or infrastructure the events are coming from.",
+                    "fields": [
+                        {
+                            "name": "account.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
+                            "example": 666777888999
+                        },
+                        {
+                            "name": "instance.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Instance name of the host machine."
+                        },
+                        {
+                            "name": "project.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
+                            "example": "my-project"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
+                            "example": "aws"
+                        },
+                        {
+                            "name": "region",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region in which this host, resource, or service is located.",
+                            "example": "us-east-1"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information."
+                },
+                {
+                    "name": "container",
+                    "title": "Container",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique container id."
+                        },
+                        {
+                            "name": "image.hash.all",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.",
+                            "example": "[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]"
+                        },
+                        {
+                            "name": "image.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the image the container was built on."
+                        },
+                        {
+                            "name": "image.tag",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Container image tags."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Container name."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "boot.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
+                            "example": "88a1f0ed-5ae5-41ee-af6b-41921c311872"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "pid_ns_ino",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
+                            "example": 256383
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "orchestrator",
+                    "title": "Orchestrator",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields that describe the resources which container orchestrators manage or act upon.",
+                    "fields": [
+                        {
+                            "name": "cluster.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID of the cluster."
+                        },
+                        {
+                            "name": "cluster.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the cluster."
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Namespace in which the action is taking place.",
+                            "example": "kube-system"
+                        },
+                        {
+                            "name": "resource.ip",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "ip",
+                            "description": "IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running)."
+                        },
+                        {
+                            "name": "resource.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the resource being acted upon.",
+                            "example": "test-pod-cdcws"
+                        },
+                        {
+                            "name": "resource.parent.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).",
+                            "example": "DaemonSet"
+                        },
+                        {
+                            "name": "resource.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of resource being acted upon.",
+                            "example": "service"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "package",
+                    "title": "Package",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.",
+                    "fields": [
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Package name",
+                            "example": "go"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.created_suspended",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.defense_evasions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping."
+                        },
+                        {
+                            "name": "Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "Ext.effective_parent.entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the effective process.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "Ext.effective_parent.executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Executable name for the effective process.",
+                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
+                        },
+                        {
+                            "name": "Ext.effective_parent.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name for the effective process.",
+                            "example": "WMIC.exe"
+                        },
+                        {
+                            "name": "Ext.effective_parent.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process ID.",
+                            "example": 4242
+                        },
+                        {
+                            "name": "Ext.memfd",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for memfd events."
+                        },
+                        {
+                            "name": "Ext.memfd.flag_allow_seal",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Allow sealing operations on this file.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flag_cloexec",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Sets the the close-on-exec flag on the new file descriptor.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flag_exec",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Exec flag is set for file.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flag_hugetlb",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "The anonymous file will be created in the hugetlbfs filesystem using huge pages.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flag_noexec_seal",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Sets both NOEXEC and MFD_ALLOW_SEALING.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Flags passed to the memfd operation.",
+                            "example": "2"
+                        },
+                        {
+                            "name": "Ext.memfd.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Filename for the created file. Appears in /proc/self/fd.",
+                            "example": "anon.txt"
+                        },
+                        {
+                            "name": "Ext.mitigation_policies",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled"
+                        },
+                        {
+                            "name": "Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "Ext.ptrace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for ptrace events."
+                        },
+                        {
+                            "name": "Ext.ptrace.child_pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "PID of the ptrace target."
+                        },
+                        {
+                            "name": "Ext.ptrace.request",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "ptrace request."
+                        },
+                        {
+                            "name": "Ext.relative_file_creation_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future."
+                        },
+                        {
+                            "name": "Ext.relative_file_name_modify_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
+                        },
+                        {
+                            "name": "Ext.session",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Session information for the current process"
+                        },
+                        {
+                            "name": "Ext.session_info.authentication_package",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP"
+                        },
+                        {
+                            "name": "Ext.session_info.client_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Client's IPv4 or IPv6 address as a string, if available."
+                        },
+                        {
+                            "name": "Ext.session_info.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Session ID"
+                        },
+                        {
+                            "name": "Ext.session_info.logon_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Session logon type.  Examples include Interactive, Network, and Service."
+                        },
+                        {
+                            "name": "Ext.session_info.relative_logon_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Process creation time, relative to logon time, in seconds."
+                        },
+                        {
+                            "name": "Ext.session_info.relative_password_age",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Process creation time, relative to the last time the password was changed, in seconds."
+                        },
+                        {
+                            "name": "Ext.session_info.user_flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON."
+                        },
+                        {
+                            "name": "Ext.shmget",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for shmget events."
+                        },
+                        {
+                            "name": "Ext.shmget.flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "flags passed to shmget."
+                        },
+                        {
+                            "name": "Ext.shmget.key",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Key passed to the shmget request."
+                        },
+                        {
+                            "name": "Ext.shmget.size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Requested size."
+                        },
+                        {
+                            "name": "Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "Ext.token.elevation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "Ext.token.security_attributes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.",
+                            "example": "TSA://ProcUnique, LUA://DecHdAutoAp"
+                        },
+                        {
+                            "name": "Ext.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the process is a trusted application"
+                        },
+                        {
+                            "name": "Ext.trusted_descendant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the process is a descendent of a trusted application"
+                        },
+                        {
+                            "name": "args",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "end",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process ended.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "entry_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "entry_leader.attested_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.attested_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.attested_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "entry_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.entry_meta.source.ip",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the source (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "entry_leader.entry_meta.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
+                        },
+                        {
+                            "name": "entry_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "entry_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "entry_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "entry_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "entry_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "entry_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "entry_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "entry_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "env_vars",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"PATH=/usr/local/bin:/usr/bin\", \"USER=ubuntu\"]"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "group_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "group_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "group_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "group_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "group_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "group_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "group_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "group_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "group_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "group_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "group_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "group_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "io",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "A chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input."
+                        },
+                        {
+                            "name": "io.max_bytes_per_process_exceeded",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting."
+                        },
+                        {
+                            "name": "io.text",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "A chunk of output or input sanitized to UTF-8.\nBest efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word."
+                        },
+                        {
+                            "name": "io.total_bytes_captured",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The total number of bytes captured in this event."
+                        },
+                        {
+                            "name": "io.total_bytes_skipped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "parent.Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "parent.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
+                        },
+                        {
+                            "name": "parent.Ext.real.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
+                        },
+                        {
+                            "name": "parent.Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "parent.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "parent.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "parent.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "parent.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "parent.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "parent.exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "parent.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.group_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.group_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "parent.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "parent.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "parent.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "parent.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "parent.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "parent.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "parent.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "parent.pgid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.ppid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "parent.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": true
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack_contains_unbacked",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "parent.thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.thread.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.thread.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "parent.title",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ]
+                        },
+                        {
+                            "name": "parent.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "parent.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "parent.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "parent.uptime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "parent.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "pgid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "ppid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "previous.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "previous.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "previous.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "session_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "session_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "session_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "session_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "session_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "session_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "session_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "session_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "session_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "thread.capabilities.effective",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is the set of capabilities used by the kernel to perform permission checks for the thread.",
+                            "example": "[\"CAP_BPF\", \"CAP_SYS_ADMIN\"]",
+                            "pattern": "^(CAP_[A-Z_]+|\\d+)$"
+                        },
+                        {
+                            "name": "thread.capabilities.permitted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is a limiting superset for the effective capabilities that the thread may assume.",
+                            "example": "[\"CAP_BPF\", \"CAP_SYS_ADMIN\"]",
+                            "pattern": "^(CAP_[A-Z_]+|\\d+)$"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "title",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "tty.columns",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The number of character columns per line. e.g terminal width\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'",
+                            "example": 80
+                        },
+                        {
+                            "name": "tty.rows",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The number of character rows in the terminal. e.g terminal height\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'",
+                            "example": 24
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "working_directory",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "container": {
+                    "id": "8d38b2f18290e973c5ea8f9ee207e970a8aa9191fa89bf3d4ea2a126f2f010a6",
+                    "image": {
+                        "name": "gke.gcr.io/csi-node-driver-registrar:v2.5.0-gke.1",
+                        "tag": [
+                            "v2.5.0-gke.1"
+                        ],
+                        "hash": {
+                            "all": [
+                                "sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d"
+                            ]
+                        }
+                    },
+                    "name": "csi-driver-registrar"
+                },
+                "cloud": {
+                    "account": {
+                        "id": "1234"
+                    },
+                    "instance": {
+                        "name": "webserver-12"
+                    },
+                    "project": {
+                        "id": "1234"
+                    },
+                    "provider": "aws",
+                    "region": "us-east-1"
+                },
+                "orchestrator": {
+                    "cluster": {
+                        "id": "f0cd61d5-327b-43e0-bc94-d9ea922fb4b5",
+                        "name": "webservers"
+                    },
+                    "namespace": "webapp",
+                    "resource": {
+                        "ip": [
+                            "10.1.237.155"
+                        ],
+                        "name": "pdcsi-node-6zh4j",
+                        "type": "pod",
+                        "parent": {
+                            "type": "DaemonSet"
+                        }
+                    }
+                },
+                "process": {
+                    "entry_leader": {
+                        "attested_user": {
+                            "id": "123",
+                            "name": "userA"
+                        },
+                        "attested_groups": {
+                            "name": "groupA"
+                        }
+                    },
+                    "Ext": {
+                        "ancestry": [
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+                        ],
+                        "memfd": {
+                            "flag_hugetlb": false,
+                            "flag_allow_seal": true,
+                            "flags": 2,
+                            "name": "test_memfd",
+                            "flag_exec": false,
+                            "flag_cloexec": false,
+                            "flag_noexec_seal": false
+                        },
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows Publisher",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "created_suspended": true,
+                        "mitigation_policies": [
+                            "Microsoft only, Opt-in to restrict to Microsoft, Windows Store and WHQL",
+                            "CET dynamic APIs can only be called out of proc",
+                            "CF Guard"
+                        ],
+                        "protection": "PsProtectedSignerAntimalware-Light",
+                        "device": {
+                            "volume_device_type": "Disk File System"
+                        },
+                        "authentication_id": "0x3e7",
+                        "token": {
+                            "integrity_level_name": "system",
+                            "security_attributes": [
+                                "TSA://ProcUnique"
+                            ],
+                            "elevation_level": "default"
+                        },
+                        "effective_parent": {
+                            "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
+                            "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
+                            "name": "WMIC.exe",
+                            "pid": 2732
+                        },
+                        "relative_file_creation_time": 48628704.4029488,
+                        "relative_file_name_modify_time": 48628704.4029488,
+                        "session_info": {
+                            "logon_type": "Interactive",
+                            "client_address": "127.0.0.1",
+                            "id": 1,
+                            "authentication_package": "NTLM",
+                            "relative_logon_time": 0.1,
+                            "relative_password_age": 2592000.123,
+                            "user_flags": [
+                                "LOGON_EXTRA_SIDS",
+                                "LOGON_NTLMV2_ENABLED",
+                                "LOGON_WINLOGON"
+                            ]
+                        }
+                    },
+                    "parent": {
+                        "args": [],
+                        "name": "services.exe",
+                        "pid": 600,
+                        "args_count": 0,
+                        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                        "command_line": "",
+                        "executable": "C:\\Windows\\System32\\services.exe",
+                        "thread": {
+                            "Ext": {
+                                "call_stack": [
+                                    {
+                                        "allocation_private_bytes": 16384,
+                                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                        "protection": "RWX",
+                                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                    }
+                                ],
+                                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                                "call_stack_contains_unbacked": true,
+                                "hardware_breakpoint_set": true
+                            }
+                        }
+                    },
+                    "pid": 2772,
+                    "working_directory": "C:\\Windows\\system32\\",
+                    "end": "2022-07-18T21:05:19.9419692Z",
+                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
+                    "executable": "C:\\Windows\\System32\\svchost.exe",
+                    "args": [
+                        "C:\\Windows\\System32\\svchost.exe",
+                        "-k",
+                        "WerSvcGroup"
+                    ],
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows Publisher",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "pe": {
+                        "original_file_name": "svchost.exe"
+                    },
+                    "name": "svchost.exe",
+                    "args_count": 3,
+                    "command_line": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
+                    "hash": {
+                        "sha1": "4fbfc6004084d97032837c21d3f426892d868eac",
+                        "sha256": "cb19fd67b1d028e01f54c426a0924528c4a8d8ed8996cfe0ee0c6e45285436a1",
+                        "md5": "1b280ad032268a636ecfe6f9165431b7"
+                    },
+                    "tty": {
+                        "char_device": {
+                            "major": 4,
+                            "minor": 1
+                        },
+                        "rows": 24,
+                        "columns": 80
+                    },
+                    "io": {
+                        "text": "helloworld",
+                        "total_bytes_captured": 10,
+                        "total_bytes_skipped": 0,
+                        "max_bytes_per_process_exceeded": false
+                    },
+                    "env_vars": [
+                        "NICK=test",
+                        "OTHER=why"
+                    ]
+                },
+                "message": "Endpoint process event",
+                "@timestamp": "2022-04-04T18:53:08.6578986Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.process"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 36236,
+                    "ingested": "2022-04-04T18:53:18Z",
+                    "created": "2022-04-04T18:53:08.6578986Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "start",
+                    "id": "MYfZG00oEwD2/fqT+++++CLz",
+                    "category": [
+                        "process"
+                    ],
+                    "type": [
+                        "start"
+                    ],
+                    "dataset": "endpoint.events.process"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                }
+            }
+        },
+        {
+            "name": "security",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Target",
+                    "title": "Target",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
+                    "fields": [
+                        {
+                            "name": "process.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "file",
+                    "title": "File",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
+                    "fields": [
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "effective.domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "effective.email",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "effective.full_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "effective.hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "effective.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "effective.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "winlog",
+                    "title": "Winlog",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields provide detailed information regarding events logged in the Windows Event Log. The Windows Event Log is a centralized system used by Windows to record events related to system, application, and security activities. Each event log entry is categorized by a specific event type, and contains relevant metadata that can include the event source, event ID, timestamp, user details, and other associated data.",
+                    "fields": [
+                        {
+                            "name": "event_data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The event-specific data. This is a non-exhaustive list of parameters that are used in Windows events."
+                        },
+                        {
+                            "name": "event_data.PrivilegeList",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of sensitive privileges, assigned to the new logon.",
+                            "example": "SeTcbPrivilege, SeSecurityPrivilege"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "Target": {
+                    "process": {
+                        "Ext": {
+                            "authentication_id": "0x3e7"
+                        }
+                    }
+                },
+                "agent": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "file": {
+                    "path": "/User/admin/Downloads/application",
+                    "code_signature": {
+                        "signing_id": "com.developer.identifier",
+                        "team_id": "XYZABC"
+                    }
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+                        ],
+                        "authentication_id": "0x3e7",
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows Publisher",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ]
+                    },
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows Publisher",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "name": "C:\\Windows\\System32\\services.exe",
+                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                    "executable": "C:\\Windows\\System32\\services.exe"
+                },
+                "message": "Endpoint security event",
+                "@timestamp": "2022-04-04T18:53:08.6510289Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.security"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 36385,
+                    "ingested": "2022-04-04T18:53:18Z",
+                    "created": "2022-04-04T18:53:08.6510289Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "log_on",
+                    "id": "MYfZG00oEwD2/fqT+++++CQ/",
+                    "category": [
+                        "authentication",
+                        "session"
+                    ],
+                    "type": [
+                        "start"
+                    ],
+                    "dataset": "endpoint.events.security",
+                    "outcome": "success"
+                },
+                "user": {
+                    "domain": "DESKTOP-1TK590J",
+                    "effective": {
+                        "domain": "DESKTOP-1TK590J",
+                        "name": "EafTestLogon80589",
+                        "id": "S-1-5-18",
+                        "email": "EafTestLogon80589@DESKTOP-1TK590J.local",
+                        "full_name": "EafTestLogon80589",
+                        "hash": "f1297b0233914ec6ebf8fc01195e8712dfd8322f5e8d9d8bbe0083a0fc1860fd"
+                    },
+                    "id": "S-1-5-21-1749029863-1064264096-968553628-1001",
+                    "name": "Default"
+                },
+                "winlog": {
+                    "event_data": {
+                        "PrivilegeList": [
+                            "SeSecurityPrivilege",
+                            "SeTakeOwnershipPrivilege",
+                            "SeLoadDriverPrivilege",
+                            "SeBackupPrivilege",
+                            "SeRestorePrivilege",
+                            "SeDebugPrivilege",
+                            "SeSystemEnvironmentPrivilege",
+                            "SeImpersonatePrivilege",
+                            "SeDelegateSessionUserImpersonatePrivilege"
+                        ]
+                    }
+                }
+            }
+        },
+        {
+            "name": "metadata",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "Endpoint",
+                    "title": "Endpoint",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
+                    "fields": [
+                        {
+                            "name": "capabilities",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 128,
+                            "description": "Enabled capabilities",
+                            "doc_values": false
+                        },
+                        {
+                            "name": "configuration",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
+                        },
+                        {
+                            "name": "configuration.isolation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Configuration setting for Host Isolation from the network"
+                        },
+                        {
+                            "name": "policy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The policy fields are used to hold information about applied policy."
+                        },
+                        {
+                            "name": "policy.applied",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about the policy that is applied"
+                        },
+                        {
+                            "name": "policy.applied.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the id of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of this applied policy"
+                        },
+                        {
+                            "name": "policy.applied.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the status of the applied policy"
+                        },
+                        {
+                            "name": "state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
+                        },
+                        {
+                            "name": "state.isolation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Current network isolation state of the host"
+                        },
+                        {
+                            "name": "status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The current status of the endpoint e.g. enrolled, unenrolled."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
+                            "example": "foo"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "elastic",
+                    "title": "Elastic",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Holds fields and properties of data points and concepts in the elastic domain or namespace.",
+                    "fields": [
+                        {
+                            "name": "agent",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
+                        },
+                        {
+                            "name": "agent.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this elastic agent (if one exists).",
+                            "example": "c2a9093e-e289-4c0a-aa44-8c32a414fa7a"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "build": {
+                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+                    },
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "@timestamp": "2022-04-04T12:33:36.6664577Z",
+                "Endpoint": {
+                    "capabilities": [
+                        "isolation"
+                    ],
+                    "configuration": {
+                        "isolation": false
+                    },
+                    "state": {
+                        "isolation": false
+                    },
+                    "policy": {
+                        "applied": {
+                            "name": "endpoint-1",
+                            "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
+                            "status": "success"
+                        }
+                    },
+                    "status": "enrolled"
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "metrics",
+                    "dataset": "endpoint.metadata"
+                },
+                "elastic": {
+                    "agent": {
+                        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21"
+                    }
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 5054,
+                    "ingested": "2022-04-04T12:33:37Z",
+                    "created": "2022-04-04T12:33:36.6664577Z",
+                    "kind": "metric",
+                    "module": "endpoint",
+                    "action": "endpoint_metadata",
+                    "id": "MYfZG00oEwD2/fqT+++++/SC",
+                    "category": [
+                        "host"
+                    ],
+                    "type": [
+                        "info"
+                    ],
+                    "dataset": "endpoint.metadata"
+                }
+            }
+        },
+        {
+            "name": "action_responses",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "action_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The action id",
+                    "path": "EndpointActions.action_id"
+                },
+                {
+                    "name": "agent_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Alias field that maps to {agent: {id}}",
+                    "path": "agent.id"
+                },
+                {
+                    "name": "completed_at",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Request completion timestamp when the response is done executing. Usually matches with @timestamp.",
+                    "path": "EndpointActions.completed_at"
+                },
+                {
+                    "name": "data.alert_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "List of alert ids that triggered the action",
+                    "path": "EndpointActions.data.alert_id"
+                },
+                {
+                    "name": "data.command",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The action that is requested",
+                    "path": "EndpointActions.data.command"
+                },
+                {
+                    "name": "data.comment",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "A comment that describes the action that is requested",
+                    "path": "EndpointActions.data.comment"
+                },
+                {
+                    "name": "started_at",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Timestamp of start of request",
+                    "path": "EndpointActions.started_at"
+                },
+                {
+                    "name": "status",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The status of the request that distinguishes if the request is queued, running or completed.",
+                    "path": "EndpointActions.status"
+                },
+                {
+                    "name": "EndpointActions",
+                    "title": "Endpoint Actions",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields to describe the endpoint  action requests and responses.",
+                    "fields": [
+                        {
+                            "name": "action_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action id"
+                        },
+                        {
+                            "name": "completed_at",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Request completion timestamp when the response is done executing. Usually matches with @timestamp."
+                        },
+                        {
+                            "name": "data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The action request information"
+                        },
+                        {
+                            "name": "data.alert_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of alert ids that triggered the action"
+                        },
+                        {
+                            "name": "data.command",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action that is requested",
+                            "example": "isolate"
+                        },
+                        {
+                            "name": "data.comment",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "A comment that describes the action that is requested"
+                        },
+                        {
+                            "name": "started_at",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp of start of request"
+                        },
+                        {
+                            "name": "status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The status of the request that distinguishes if the request is queued, running or completed."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "error",
+                    "title": "Error",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.",
+                    "fields": [
+                        {
+                            "name": "code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Error code describing the error."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the error."
+                        },
+                        {
+                            "name": "message",
+                            "level": "core",
+                            "type": "match_only_text",
+                            "description": "Error message."
+                        },
+                        {
+                            "name": "stack_trace",
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "The stack trace of this error in plain text.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of the error, for example the class name of the exception.",
+                            "example": "java.lang.NullPointerException"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "end",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "EndpointActions": {
+                    "completed_at": "2022-04-04T20:44:14.0Z",
+                    "data": {
+                        "comment": "Action completed successfully",
+                        "command": "isolate"
+                    },
+                    "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
+                    "started_at": "2022-04-04T20:44:08.0Z"
+                },
+                "agent": {
+                    "id": "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
+                },
+                "@timestamp": "2022-04-04T20:44:14.0Z",
+                "data_stream": {
+                    "namespace": "default",
+                    "type": ".logs",
+                    "dataset": "endpoint.action.responses"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "ingested": "2022-04-04T20:44:45Z"
+                }
+            }
+        },
+        {
+            "name": "collection",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                }
+            ]
+        },
+        {
+            "name": "library",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Effective_process",
+                    "title": "Effective_process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
+                    "fields": [
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the effective process.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Executable name for the effective process.",
+                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name for the effective process.",
+                            "example": "WMIC.exe"
+                        },
+                        {
+                            "name": "pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process ID.",
+                            "example": 4242
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dll",
+                    "title": "DLL",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.defense_evasions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump."
+                        },
+                        {
+                            "name": "Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "Ext.load_index",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.\nThe first load index is 1."
+                        },
+                        {
+                            "name": "Ext.relative_file_creation_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future."
+                        },
+                        {
+                            "name": "Ext.relative_file_name_modify_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
+                        },
+                        {
+                            "name": "Ext.size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of DLL"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "file",
+                    "title": "File",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": true
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+                        ],
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "protection": "PsProtectedSignerAntimalware-Light"
+                    },
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "name": "VSSVC.exe",
+                    "pid": 4528,
+                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ1MjgtMTMyOTM1NzEwODYuNjI4MzM0NzAw",
+                    "executable": "C:\\Windows\\System32\\VSSVC.exe",
+                    "thread": {
+                        "id": 340,
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "allocation_private_bytes": 16384,
+                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "protection": "RWX",
+                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                }
+                            ],
+                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                            "hardware_breakpoint_set": true
+                        }
+                    }
+                },
+                "dll": {
+                    "Ext": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "device": {
+                            "volume_device_type": "Disk File System"
+                        },
+                        "load_index": 1,
+                        "relative_file_creation_time": 48628704.4029488,
+                        "relative_file_name_modify_time": 48628704.4029488,
+                        "size": 65536
+                    },
+                    "path": "C:\\Windows\\System32\\msxml3.dll",
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "pe": {
+                        "file_version": "8.110.17763.1911",
+                        "imphash": "2e1d1e35c17be5497d2de33f06dc41b4",
+                        "original_file_name": "MSXML3.dll"
+                    },
+                    "name": "msxml3.dll",
+                    "hash": {
+                        "sha1": "02488fb2dbf679a3282338178b451da635b79b54",
+                        "sha256": "a9698adcf789d9e30f37dd5e6c9be0441bc37662ba7402e85071ccec2135d36c",
+                        "md5": "65e4fd0564411bb60c600fae12cde2f9"
+                    }
+                },
+                "message": "Endpoint DLL load event",
+                "@timestamp": "2022-04-04T18:38:08.3185831Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.library"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 34339,
+                    "ingested": "2022-04-04T18:38:16Z",
+                    "created": "2022-04-04T18:38:08.3185831Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "load",
+                    "id": "MYfZG00oEwD2/fqT+++++BRi",
+                    "category": [
+                        "library"
+                    ],
+                    "type": [
+                        "start"
+                    ],
+                    "dataset": "endpoint.events.library"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                },
+                "Effective_process": {
+                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTU2NS0xNjk1MTkyOTQ3",
+                    "executable": "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
+                    "name": "Terminal",
+                    "pid": 565
+                }
+            }
+        },
+        {
+            "name": "heartbeat",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "billable",
+                    "level": "custom",
+                    "type": "boolean",
+                    "description": "Whether document should be included in billing calculations"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "@timestamp": "2023-07-18T20:40:09.279939Z",
+                "agent": {
+                    "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+                },
+                "data_stream": {
+                    "dataset": "endpoint.heartbeat",
+                    "namespace": "default",
+                    "type": ".logs"
+                },
+                "message": "Endpoint heartbeat",
+                "event": {
+                    "ingested": "2023-07-18T20:40:09.279939Z"
+                },
+                "billable": true
+            }
+        },
+        {
+            "name": "actions",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "action_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The action id",
+                    "path": "EndpointActions.action_id"
+                },
+                {
+                    "name": "agents",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Alias field that maps to {agent: {id}}",
+                    "path": "agent.id"
+                },
+                {
+                    "name": "data.alert_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "List of alert ids that triggered the action",
+                    "path": "EndpointActions.data.alert_id"
+                },
+                {
+                    "name": "data.command",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The action that is requested",
+                    "path": "EndpointActions.data.command"
+                },
+                {
+                    "name": "data.comment",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "A comment that describes the action that is requested",
+                    "path": "EndpointActions.data.comment"
+                },
+                {
+                    "name": "expiration",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Request expiration timestamp",
+                    "path": "EndpointActions.expiration"
+                },
+                {
+                    "name": "input_type",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The input type of the action, distinguishes endpoint actions as `endpoint`",
+                    "path": "EndpointActions.input_type"
+                },
+                {
+                    "name": "type",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Distinguishes the type of input. Usually set to `INPUT_ACTION`",
+                    "path": "EndpointActions.type"
+                },
+                {
+                    "name": "user_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The user id",
+                    "path": "user.id"
+                },
+                {
+                    "name": "EndpointActions",
+                    "title": "Endpoint Actions",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields to describe the endpoint  action requests and responses.",
+                    "fields": [
+                        {
+                            "name": "action_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action id"
+                        },
+                        {
+                            "name": "data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The action request information"
+                        },
+                        {
+                            "name": "data.alert_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of alert ids that triggered the action"
+                        },
+                        {
+                            "name": "data.command",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action that is requested",
+                            "example": "isolate"
+                        },
+                        {
+                            "name": "data.comment",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "A comment that describes the action that is requested"
+                        },
+                        {
+                            "name": "expiration",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Request expiration timestamp"
+                        },
+                        {
+                            "name": "input_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The input type of the action, distinguishes endpoint actions as `endpoint`"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguishes the type of input. Usually set to `INPUT_ACTION`"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "error",
+                    "title": "Error",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.",
+                    "fields": [
+                        {
+                            "name": "code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Error code describing the error."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the error."
+                        },
+                        {
+                            "name": "message",
+                            "level": "core",
+                            "type": "match_only_text",
+                            "description": "Error message."
+                        },
+                        {
+                            "name": "stack_trace",
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "The stack trace of this error in plain text.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of the error, for example the class name of the exception.",
+                            "example": "java.lang.NullPointerException"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "end",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "rule",
+                    "title": "Rule",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
+                            "example": 101
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the rule or signature generating the event.",
+                            "example": "BLOCK_DNS_over_TLS"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "EndpointActions": {
+                    "data": {
+                        "comment": "testing isolation",
+                        "command": "isolate"
+                    },
+                    "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
+                    "input_type": "endpoint",
+                    "expiration": "2022-04-18T20:44:07.805Z",
+                    "type": "INPUT_ACTION"
+                },
+                "agent": {
+                    "id": [
+                        "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
+                    ]
+                },
+                "@timestamp": "2022-04-04T20:44:07.805Z",
+                "event": {
+                    "agent_id_status": "auth_metadata_missing",
+                    "ingested": "2022-04-04T20:44:07Z"
+                },
+                "user": {
+                    "id": "user@elastic.co"
+                }
+            }
+        },
+        {
+            "name": "file",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Effective_process",
+                    "title": "Effective_process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
+                    "fields": [
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the effective process.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Executable name for the effective process.",
+                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name for the effective process.",
+                            "example": "WMIC.exe"
+                        },
+                        {
+                            "name": "pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process ID.",
+                            "example": 4242
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Persistence",
+                    "title": "Persistence",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a Persistence event.",
+                    "fields": [
+                        {
+                            "name": "args",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Arguments used to execute the persistence item"
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The persistence item's executable"
+                        },
+                        {
+                            "name": "keepalive",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Keep alive option boolean"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The persistence item's name"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file's path"
+                        },
+                        {
+                            "name": "runatload",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Run at load option boolean"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.correlation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Information about event this should be correlated with."
+                        },
+                        {
+                            "name": "Ext.correlation.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event"
+                        },
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "file",
+                    "title": "File",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "Ext.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy calculation of file's header and footer used to check file integrity."
+                        },
+                        {
+                            "name": "Ext.header_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "Ext.header_data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "Ext.malware_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of malware_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "The concatenated names of all yara signatures"
+                        },
+                        {
+                            "name": "Ext.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Malware artifact identifier."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of bytes representing yara signature matches"
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature hash."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature sha256."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature id."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature name."
+                        },
+                        {
+                            "name": "Ext.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of malware signature matches"
+                        },
+                        {
+                            "name": "Ext.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature version."
+                        },
+                        {
+                            "name": "Ext.monotonic_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "File event monotonic ID."
+                        },
+                        {
+                            "name": "Ext.original",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Original file information during a modification event."
+                        },
+                        {
+                            "name": "Ext.original.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file extension prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.gid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "Ext.original.group",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "Ext.original.mode",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file mode prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file name prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.owner",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "Ext.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.uid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "Ext.windows",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Platform-specific Windows fields"
+                        },
+                        {
+                            "name": "Ext.windows.zone_identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Windows zone identifier for a file"
+                        },
+                        {
+                            "name": "accessed",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+                        },
+                        {
+                            "name": "attributes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
+                            "example": "[\"readonly\", \"system\"]"
+                        },
+                        {
+                            "name": "created",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "File creation time.\nNote that not all filesystems store the creation time."
+                        },
+                        {
+                            "name": "ctime",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+                        },
+                        {
+                            "name": "device",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device that is the source of the file.",
+                            "example": "sda"
+                        },
+                        {
+                            "name": "directory",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "drive_letter",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1,
+                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
+                            "example": "C"
+                        },
+                        {
+                            "name": "extension",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "gid",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "group",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "inode",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Inode representing the file in the filesystem.",
+                            "example": "256383"
+                        },
+                        {
+                            "name": "mime_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+                        },
+                        {
+                            "name": "mode",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode of the file in octal representation.",
+                            "example": "0640"
+                        },
+                        {
+                            "name": "mtime",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file content was modified."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "origin_referrer_url",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 8192,
+                            "description": "The url of the webpage that linked to the file."
+                        },
+                        {
+                            "name": "origin_url",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 8192,
+                            "description": "The url where the file is hosted."
+                        },
+                        {
+                            "name": "owner",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "size",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
+                            "example": 16384
+                        },
+                        {
+                            "name": "target_path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Target path for symlinks.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File type (file, dir, or symlink).",
+                            "example": "file"
+                        },
+                        {
+                            "name": "uid",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "ppid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": true
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "id": "ccb7b1a1-303e-416f-b975-311737e8e125",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "Effective_process": {
+                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
+                    "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
+                    "name": "WMIC.exe",
+                    "pid": 2732
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTYwNC0xMzI5MzU0OTEwOS4zNTg1OTc3MDA=",
+                            "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ3Mi0xMzI5MzU0OTEwOS43NjU4MjcwMA=="
+                        ],
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Elasticsearch, Inc.",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ]
+                    },
+                    "args_count": 1,
+                    "parent": {
+                        "pid": 604,
+                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
+                        "group_leader": {
+                            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+                        }
+                    },
+                    "entry_leader": {
+                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
+                        "parent": {
+                            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+                        }
+                    },
+                    "session_leader": {
+                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+                    },
+                    "group_leader": {
+                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+                    },
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Elasticsearch, Inc.",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "name": "winlogbeat.exe",
+                    "pid": 4512,
+                    "thread": {
+                        "id": 340,
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "allocation_private_bytes": 16384,
+                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "protection": "RWX",
+                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                }
+                            ],
+                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                            "hardware_breakpoint_set": true
+                        }
+                    },
+                    "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
+                    "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
+                },
+                "message": "Endpoint file event",
+                "@timestamp": "2022-04-04T18:37:01.5775771Z",
+                "file": {
+                    "Ext": {
+                        "header_data": [],
+                        "entropy": 5.28353871945538,
+                        "device": {
+                            "volume_device_type": "Disk File System"
+                        },
+                        "header_bytes": "7570646174655f74696d653a20323032",
+                        "windows": {
+                            "zone_identifier": -1
+                        },
+                        "monotonic_id": 3526
+                    },
+                    "path": "C:\\ProgramData\\winlogbeat\\.winlogbeat.yml.new",
+                    "extension": "new",
+                    "size": 1406,
+                    "name": ".winlogbeat.yml.new",
+                    "origin_referrer_url": "https://example.com",
+                    "origin_url": "https://example.com/file.zip"
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.file"
+                },
+                "host": {
+                    "hostname": "response-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.9",
+                        "fe80::4d1:ef01:c0ed:299a",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "response-win-1",
+                    "id": "bcbbe9cb-0278-43f9-aa1b-2dc9839bbf6f",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 32114,
+                    "ingested": "2022-04-04T18:37:29Z",
+                    "created": "2022-04-04T18:37:01.5775771Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "creation",
+                    "id": "MYfZFpbNKturKgFp+++++AlT",
+                    "category": [
+                        "file"
+                    ],
+                    "type": [
+                        "creation"
+                    ],
+                    "dataset": "endpoint.events.file"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                }
+            }
+        },
+        {
+            "name": "api",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Target",
+                    "title": "Target",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
+                    "fields": [
+                        {
+                            "name": "process.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.Ext.created_suspended",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory allocation containing the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Original memory size requested when the memory was allocated.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+                            "example": "PRIVATE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The address where bytes_compressed begins.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether bytes_compressed is present in this event.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the memory region.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A sequence of signature names matched.",
+                            "example": "Windows.EICAR.Not-a-virus"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature identifier"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The first matching details."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The first matching details.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of file matching signature."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of file matching signature."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the first yara rule matched."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the first yara rule matched."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Additional matching details if available.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The second matching details.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of second file matching signature.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of second file matching signature.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the second yara rule matched.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the second yara rule matched.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature version"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
+                            "example": "C:\\Windows\\System32\\mshtml.dll"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.pehash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
+                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "PE Section List name."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the file at mapped_path is an executable.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.pehash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
+                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "PE Section List name."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether an executable file was found in memory.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of the memory region.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_start_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 64 bytes at the region base address.",
+                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+                            "example": "COMMIT"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.strings",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Array of strings found within the memory region.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "process.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "process.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "process.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "process.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "process.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the destination (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "port",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Port of the destination.",
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dll",
+                    "title": "DLL",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "end",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "network",
+                    "title": "Network",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.",
+                    "fields": [
+                        {
+                            "name": "transport",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
+                            "example": "tcp"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
+                            "example": "ipv4"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.api.behaviors",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
+                            "example": "[ \"cross-process\", \"rapid_background_polling\", \"multiple_polling_processes\", \"native_api\", \"shellcode\" ]"
+                        },
+                        {
+                            "name": "Ext.api.metadata",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Information related to the API call."
+                        },
+                        {
+                            "name": "Ext.api.metadata.amsi_filenames",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A list of filenames previously scanned by AMSI.",
+                            "example": "[ \"C:\\script.ps1\" ]"
+                        },
+                        {
+                            "name": "Ext.api.metadata.amsi_logs",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Information related to previous AMSI scans."
+                        },
+                        {
+                            "name": "Ext.api.metadata.amsi_logs.entries",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A subset of the AMSI content buffers scanned prior to this event.",
+                            "example": "[ \"[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport(\"kernel32.dll\")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}\" ]"
+                        },
+                        {
+                            "name": "Ext.api.metadata.amsi_logs.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The AMSI content type scanned prior to this event.",
+                            "example": "PowerShell"
+                        },
+                        {
+                            "name": "Ext.api.metadata.background_callcount",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.",
+                            "example": 6021
+                        },
+                        {
+                            "name": "Ext.api.metadata.client_is_local",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.api.metadata.client_machine",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Client process's machine name (provided by the client and potentially untrustworthy).",
+                            "example": "DESKTOP-EXAMPLE"
+                        },
+                        {
+                            "name": "Ext.api.metadata.client_machine_fqdn",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Client process's machine name FQDN (provided by the client and potentially untrustworthy).",
+                            "example": "DESKTOP-EXAMPLE.elastic.co"
+                        },
+                        {
+                            "name": "Ext.api.metadata.client_process_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Client process id",
+                            "example": 3600
+                        },
+                        {
+                            "name": "Ext.api.metadata.ms_since_last_keyevent",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.",
+                            "example": 94
+                        },
+                        {
+                            "name": "Ext.api.metadata.procedure_symbol",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Summary of the hook procedure.",
+                            "example": "taskbar.dll"
+                        },
+                        {
+                            "name": "Ext.api.metadata.return_value",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Return value of RegisterRawInputDevices API call.",
+                            "example": 1
+                        },
+                        {
+                            "name": "Ext.api.metadata.security_descriptor",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The security descriptor of the device.",
+                            "example": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)"
+                        },
+                        {
+                            "name": "Ext.api.metadata.start_address_allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection attributes associated with the starting address of a thread.",
+                            "example": "RCX"
+                        },
+                        {
+                            "name": "Ext.api.metadata.start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module associated with the starting address of a thread.",
+                            "example": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe"
+                        },
+                        {
+                            "name": "Ext.api.metadata.target_address_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the memory region targeted by the API call.",
+                            "example": "Unbacked"
+                        },
+                        {
+                            "name": "Ext.api.metadata.target_address_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path of the memory region targeted by the API call.",
+                            "example": "C:\\programdata\\example.dll"
+                        },
+                        {
+                            "name": "Ext.api.metadata.thread_info_flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Thread info flags.",
+                            "example": 16
+                        },
+                        {
+                            "name": "Ext.api.metadata.visible_windows_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Number of visible windows owned by the caller thread.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.metadata.windows_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Number of windows owned by the caller thread.",
+                            "example": 2
+                        },
+                        {
+                            "name": "Ext.api.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the API, usually the name of the function or system call.",
+                            "example": "VirtualAlloc"
+                        },
+                        {
+                            "name": "Ext.api.parameters",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Parameter values passed to the API call."
+                        },
+                        {
+                            "name": "Ext.api.parameters.address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The target memory address.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.api.parameters.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`",
+                            "example": "COMMIT|RESERVE"
+                        },
+                        {
+                            "name": "Ext.api.parameters.app_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The application name requesting the AMSI scan.",
+                            "example": "PowerShell"
+                        },
+                        {
+                            "name": "Ext.api.parameters.argument1",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The first argument to the procedure.",
+                            "example": 1
+                        },
+                        {
+                            "name": "Ext.api.parameters.argument2",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The second argument to the procedure.",
+                            "example": 2
+                        },
+                        {
+                            "name": "Ext.api.parameters.argument3",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The third argument to the procedure.",
+                            "example": 3
+                        },
+                        {
+                            "name": "Ext.api.parameters.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The content associated with an AMSI scan.",
+                            "example": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport(\"kernel32.dll\")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20);"
+                        },
+                        {
+                            "name": "Ext.api.parameters.consumer_details",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name."
+                        },
+                        {
+                            "name": "Ext.api.parameters.consumer_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.",
+                            "example": "ExampleConsumer"
+                        },
+                        {
+                            "name": "Ext.api.parameters.consumer_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An example list of consumer type.\n  \"ActiveScriptEventConsumer\" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.\n  \"CommandLineEventConsumer\" - Launches an arbitrary process in the local system context when an event is delivered to it.\n  \"LogFileEventConsumer\" - Writes customized strings to a text log file when events are delivered to it.\n  \"NTEventLogEventConsumer\" - Logs a specific message to the Windows event log when an event is delivered to it.\n  \"SMTPEventConsumer\" - Sends an email message using SMTP each time an event is delivered to it.",
+                            "example": "CommandLineEventConsumer"
+                        },
+                        {
+                            "name": "Ext.api.parameters.content_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The content name, typically a filename, associated with an AMSI scan.",
+                            "example": "C:\\script.ps1"
+                        },
+                        {
+                            "name": "Ext.api.parameters.context_flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`",
+                            "example": 1048607
+                        },
+                        {
+                            "name": "Ext.api.parameters.desired_access",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`."
+                        },
+                        {
+                            "name": "Ext.api.parameters.desired_access_numeric",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`."
+                        },
+                        {
+                            "name": "Ext.api.parameters.device",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the device object.",
+                            "example": "\\Device\\NPCAP"
+                        },
+                        {
+                            "name": "Ext.api.parameters.driver",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the driver object.",
+                            "example": "\\Driver\\npcap"
+                        },
+                        {
+                            "name": "Ext.api.parameters.eax",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.ebp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EBP frame pointer register.",
+                            "example": 15006644
+                        },
+                        {
+                            "name": "Ext.api.parameters.ebx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EBX general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.ecx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 ECX general purpose register. First argument in __fastcall and __thiscall.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.edi",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EDI general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.edx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EDX general purpose register. Second argument in a __fastcall.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.eip",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EIP instruction pointer register.",
+                            "example": 1472790528
+                        },
+                        {
+                            "name": "Ext.api.parameters.esi",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 ESI general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.esp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 ESP stack pointer register.",
+                            "example": 15007744
+                        },
+                        {
+                            "name": "Ext.api.parameters.event_filter_details",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Provide an overview of the query that define when an event should be triggered."
+                        },
+                        {
+                            "name": "Ext.api.parameters.event_filter_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.",
+                            "example": "ExampleFilter"
+                        },
+                        {
+                            "name": "Ext.api.parameters.flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.",
+                            "example": "INPUTSINK"
+                        },
+                        {
+                            "name": "Ext.api.parameters.handle_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This parameter indicates whether the detected access was attempt against a process or a thread.",
+                            "example": "process"
+                        },
+                        {
+                            "name": "Ext.api.parameters.hook_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DLL containing the hook procedure.",
+                            "example": "c:\\windows\\system32\\taskbar.dll"
+                        },
+                        {
+                            "name": "Ext.api.parameters.hook_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of hook procedure to be installed.",
+                            "example": "WH_KEYBOARD_LL"
+                        },
+                        {
+                            "name": "Ext.api.parameters.io_control_code",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The I/O control code for the requested device operation.",
+                            "example": 27365
+                        },
+                        {
+                            "name": "Ext.api.parameters.namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "WMI namespace to which the connection is made.",
+                            "example": "root\\Microsoft\\Windows\\DeviceGuard"
+                        },
+                        {
+                            "name": "Ext.api.parameters.operation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Specifies the connection or request to WMI",
+                            "example": "Win32_Process::Create"
+                        },
+                        {
+                            "name": "Ext.api.parameters.procedure",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The memory address of the procedure or function.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.api.parameters.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
+                            "example": "RWX|GUARD"
+                        },
+                        {
+                            "name": "Ext.api.parameters.protection_old",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
+                            "example": "RCX"
+                        },
+                        {
+                            "name": "Ext.api.parameters.r8",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 R8 general purpose register. Third argument in a __fastcall.",
+                            "example": 3
+                        },
+                        {
+                            "name": "Ext.api.parameters.r9",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 R9 general purpose register. Fourth argument in a __fastcall.",
+                            "example": 4
+                        },
+                        {
+                            "name": "Ext.api.parameters.rax",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RAX general purpose register. Return value in a __fastcall.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rbp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RBP general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rbx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The x64 RBX general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rcx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RCX general purpose register. First argument in a __fastcall.",
+                            "example": 1
+                        },
+                        {
+                            "name": "Ext.api.parameters.rdi",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RDI general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rdx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RDX general purpose register. Second argument in a __fastcall.",
+                            "example": 2
+                        },
+                        {
+                            "name": "Ext.api.parameters.rip",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RIP instruction pointer register.",
+                            "example": 140706153693184
+                        },
+                        {
+                            "name": "Ext.api.parameters.rsi",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The x64 RSI general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rsp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RSP stack pointer register.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.api.parameters.size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.api.parameters.usage",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.",
+                            "example": "KEYBOARD"
+                        },
+                        {
+                            "name": "Ext.api.parameters.usage_page",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.",
+                            "example": "GENERIC"
+                        },
+                        {
+                            "name": "Ext.api.summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The summary of the API call and its parameters.",
+                            "example": "VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.created_suspended",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory allocation containing the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Original memory size requested when the memory was allocated.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+                            "example": "PRIVATE"
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The address where bytes_compressed begins.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether bytes_compressed is present in this event.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the memory region.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A sequence of signature names matched.",
+                            "example": "Windows.EICAR.Not-a-virus"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature identifier"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The first matching details."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The first matching details.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of file matching signature."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of file matching signature."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the first yara rule matched."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the first yara rule matched."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Additional matching details if available.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The second matching details.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of second file matching signature.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of second file matching signature.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the second yara rule matched.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the second yara rule matched.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature version"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
+                            "example": "C:\\Windows\\System32\\mshtml.dll"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.pehash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
+                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "PE Section List name."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the file at mapped_path is an executable.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.pehash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
+                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "PE Section List name."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether an executable file was found in memory.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.region_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.region_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "Ext.memory_region.region_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of the memory region.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.memory_region.region_start_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 64 bytes at the region base address.",
+                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
+                        },
+                        {
+                            "name": "Ext.memory_region.region_state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+                            "example": "COMMIT"
+                        },
+                        {
+                            "name": "Ext.memory_region.strings",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Array of strings found within the memory region.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.instruction_pointer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The return address of this stack frame."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.module_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path to the DLL/module containing `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection_provenance",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the memory region that last modified the protection of this page.  \"Unbacked\" can indicate shellcode."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_contains_unbacked",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The module that installed the final API hook in the call stack."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_hook_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_hook_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_hook_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_hook_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The final non-win32 module in the call stack."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory region that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_user_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file name of the call_stack_final_user_module.",
+                            "example": "example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_user_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory protection for the acting region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.protection_provenance",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the memory region that caused the last modification of the protection of this page. \"Unbacked\" may indicate shellcode.",
+                            "example": "third_party_hook.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.protection_provenance_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path of the module that caused the last modification the protection of this page.",
+                            "example": "C:\\Program Files\\Hook Inc\\third_party_hook.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.reason",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The unexpected call_stack_summary that led to an \"Undetermined\" protection_provenance.",
+                            "example": "ntdll.dll|kernelbase.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "@timestamp": "2023-01-09T19:38:51.5141503Z",
+                "Target": {
+                    "process": {
+                        "Ext": {
+                            "created_suspended": true,
+                            "protection": "PsProtectedSignerWinTcb",
+                            "memory_region": {
+                                "allocation_base": 1649160290304,
+                                "allocation_protection": "RWX",
+                                "allocation_size": 4096,
+                                "allocation_type": "PRIVATE",
+                                "bytes_address": 1649160290304,
+                                "bytes_allocation_offset": 0,
+                                "bytes_compressed": "eJztwbEJACAMALA+5uAtWnAoOPg/+EWnJO9k1bo742XuMRsEAAAA0OsD8lge9g==",
+                                "bytes_compressed_present": true,
+                                "hash": {
+                                    "sha256": "0b28b598ef70fd2377613fd88a50d52047ae31c16f2c688f3aa4e0b98d63730c"
+                                },
+                                "memory_pe_detected": false,
+                                "region_base": 1649160290304,
+                                "region_protection": "R--",
+                                "region_size": 4096,
+                                "region_state": "COMMIT",
+                                "strings": [
+                                    "shellcode",
+                                    "seed=AAAA"
+                                ]
+                            },
+                            "token": {
+                                "integrity_level_name": "high"
+                            }
+                        },
+                        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI1NzMyLTE2OTkwMDE3NDAuOTU4NTY4MDAw",
+                        "executable": "C:\\Temp\\1_StayRunningWin32_x64.exe",
+                        "name": "1_StayRunningWin32_x64.exe",
+                        "pid": 25732
+                    }
+                },
+                "dll": {
+                    "Ext": {
+                        "code_signature": [
+                            {
+                                "exists": true,
+                                "status": "trusted",
+                                "subject_name": "Microsoft Windows",
+                                "trusted": true
+                            }
+                        ]
+                    },
+                    "hash": {
+                        "sha256": "8b9731a4b83e801cda7b918f8194608e91f86b3a86ffb6bb24230b1cc28e1a54"
+                    },
+                    "path": "c:\\windows\\system32\\drivers\\pktmon.sys"
+                },
+                "destination": {
+                    "ip": "2001:4860:4860::8844",
+                    "port": 139
+                },
+                "event": {
+                    "category": [
+                        "api",
+                        "intrusion_detection"
+                    ],
+                    "created": "2023-01-09T19:38:51.5141503Z",
+                    "dataset": "endpoint.events.api",
+                    "id": "MvlgiHxIZtj1+Abi++++++ul",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "outcome": "success",
+                    "provider": "Microsoft-Windows-Threat-Intelligence",
+                    "sequence": 3802,
+                    "type": [
+                        "credential_access"
+                    ]
+                },
+                "host": {
+                    "architecture": "x86_64",
+                    "hostname": "DESKTOP-OCG8CR6",
+                    "id": "dabadaba-0000-0000-0000-000000000000",
+                    "ip": [
+                        "169.254.104.226",
+                        "fe80::6037:d589:2ee9:772f",
+                        "172.22.6.230",
+                        "fe80::80ea:8e8d:e1f2:6622",
+                        "169.254.74.35",
+                        "fe80::900c:a9d3:fd8:9345",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "mac": [
+                        "00-15-5D-00-09-18",
+                        "00-15-5D-00-09-19",
+                        "00-15-5D-00-09-17"
+                    ],
+                    "name": "DESKTOP-OCG8CR6",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows 11 Enterprise N"
+                        },
+                        "family": "windows",
+                        "full": "Windows 11 Enterprise N 22H2 (10.0.22621.963)",
+                        "kernel": "22H2 (10.0.22621.963)",
+                        "name": "Windows",
+                        "platform": "windows",
+                        "type": "windows",
+                        "version": "22H2 (10.0.22621.963)"
+                    }
+                },
+                "message": "Endpoint API event - hand-crafted with a superset of fields",
+                "network": {
+                    "transport": "tcp",
+                    "type": "ipv6"
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTgxMi0xNjczMjkxNTMzLjcxNjczMTgwMA==",
+                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ5NjAtMTY3Mjk2NTgzMC4yODc0OTYxMDA=",
+                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTY2MjgtMTY3Mjk2NTc3Mi41MTg4MDA1MDA=",
+                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ2MDAtMTY3Mjk2NTcxMy40NzY1NDUyMDA="
+                        ],
+                        "api": {
+                            "behaviors": [
+                                "cross-process",
+                                "rapid_background_polling",
+                                "multiple_polling_processes",
+                                "pid_spoofing"
+                            ],
+                            "metadata": {
+                                "target_address_name": "Unbacked",
+                                "target_address_path": "c:\\windows\\system32\\ntdll.dll",
+                                "return_value": 1,
+                                "windows_count": 2,
+                                "visible_windows_count": 0,
+                                "thread_info_flags": 16,
+                                "start_address_module": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe",
+                                "start_address_allocation_protection": "RCX",
+                                "procedure_symbol": "taskbar.dll",
+                                "ms_since_last_keyevent": 94,
+                                "background_callcount": 6021,
+                                "security_descriptor": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)",
+                                "client_machine": "DESKTOP-EXAMPLE",
+                                "client_machine_fqdn": "DESKTOP-EXAMPLE",
+                                "client_process_id": 3600,
+                                "client_is_local": true,
+                                "amsi_filenames": [
+                                    "C:\\script.ps1"
+                                ],
+                                "amsi_logs": {
+                                    "entries": [
+                                        "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
+                                    ],
+                                    "type": "PowerShell"
+                                }
+                            },
+                            "name": "OpenProcess",
+                            "parameters": {
+                                "desired_access": [
+                                    "PROCESS_QUERY_LIMITED_INFORMATION",
+                                    "PROCESS_VM_READ"
+                                ],
+                                "desired_access_numeric": 4112,
+                                "handle_type": "process",
+                                "address": 2904525045760,
+                                "allocation_type": "COMMIT|RESERVE",
+                                "protection": "R-X",
+                                "protection_old": "R-X",
+                                "size": 16,
+                                "context_flags": 1048607,
+                                "r8": 8,
+                                "r9": 9,
+                                "rax": 10,
+                                "rbp": 3,
+                                "rbx": 11,
+                                "rcx": 2883351609344,
+                                "rdi": 5,
+                                "rdx": 13,
+                                "rip": 140706538588528,
+                                "rsi": 4,
+                                "rsp": 2,
+                                "eax": 10,
+                                "ebp": 3,
+                                "ebx": 11,
+                                "ecx": 12,
+                                "edi": 5,
+                                "edx": 0,
+                                "eip": 1,
+                                "esi": 4,
+                                "esp": 2,
+                                "argument1": 2583984274656,
+                                "argument2": 4105953215,
+                                "argument3": 31058890,
+                                "procedure": 140705553857280,
+                                "usage_page": "GENERIC",
+                                "usage": "KEYBOARD",
+                                "flags": "INPUTSINK",
+                                "hook_type": "WH_KEYBOARD_LL",
+                                "hook_module": "c:\\windows\\system32\\taskbar.dll",
+                                "device": "\\Device\\PktMonDev",
+                                "io_control_code": 27365,
+                                "event_filter_name": "ExampleFilter",
+                                "event_filter_details": "__EventFilter{EventNamespace = \"root\\CimV2\"; Name = \"ExampleFilter\";};",
+                                "consumer_name": "ExampleConsumer",
+                                "consumer_type": "CommandLineEventConsumer",
+                                "consumer_details": "CommandLineEventConsumer{Name = \"ExampleConsumer\";};",
+                                "namespace": "root\\Microsoft\\Windows\\DeviceGuard",
+                                "operation": "Win32_Process::Create",
+                                "app_name": "PowerShell",
+                                "content_name": "C:\\script.ps1",
+                                "buffer": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
+                            },
+                            "summary": "VirtualAllocEx( charmap.exe, NULL, 0x10, COMMIT|RESERVE, R-X )"
+                        },
+                        "code_signature": [
+                            {
+                                "exists": true,
+                                "status": "errorBadDigest",
+                                "subject_name": "Microsoft Windows",
+                                "trusted": false
+                            }
+                        ],
+                        "memory_region": {
+                            "allocation_base": 140712018378752,
+                            "allocation_protection": "RCX",
+                            "allocation_size": 45056,
+                            "allocation_type": "IMAGE",
+                            "mapped_path": "C:\\Program Files\\Python39\\DLLs\\libffi-7.dll",
+                            "region_base": 140712018395136,
+                            "region_protection": "R-X",
+                            "region_size": 8192,
+                            "region_state": "COMMIT"
+                        },
+                        "token": {
+                            "integrity_level_name": "system"
+                        }
+                    },
+                    "code_signature": {
+                        "exists": true,
+                        "status": "errorBadDigest",
+                        "subject_name": "Microsoft Windows",
+                        "trusted": false
+                    },
+                    "command_line": "",
+                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTkxNi0xNjczMjkzMTMwLjk0NjAwMjAw",
+                    "executable": "c\\git\\endpoint-dev\\Tools\\Leia\\modules\\exe_malware\\mimikatz.exe",
+                    "name": "mimikatz.exe",
+                    "pid": 916,
+                    "thread": {
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "allocation_private_bytes": 4096,
+                                    "protection_provenance": "dabapi.dll",
+                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!ZwProtectVirtualMemory+0x14"
+                                },
+                                {
+                                    "symbol_info": "c:\\windows\\system32\\kernelbase.dll!VirtualProtect+0x36"
+                                },
+                                {
+                                    "allocation_private_bytes": 8192,
+                                    "callsite_leading_bytes": "c048895424204c8bc9488d0d801f0000418d500248ff15052a00000f1f4400004883c438c3cccccccccccccccccccccc4883ec2048b880bf1acaf87f0000ffd0",
+                                    "callsite_trailing_bytes": "4883c420c3ec48498363e800498d4320ba2500000049c743e004000000440fb7ca4c8d05d0320000ba2b000000498943d848ff15f82a00000f1f4400004883c4",
+                                    "protection": "RWX",
+                                    "protection_provenance": "eventstests.exe",
+                                    "symbol_info": "c:\\windows\\system32\\dabapi.dll!DabApiBufferFree+0x10"
+                                },
+                                {
+                                    "symbol_info": "Unknown"
+                                }
+                            ],
+                            "call_stack_final_user_module": {
+                                "allocation_private_bytes": 4096,
+                                "code_signature": [
+                                    {
+                                        "exists": true,
+                                        "status": "trusted",
+                                        "subject_name": "Microsoft Windows",
+                                        "trusted": true
+                                    }
+                                ],
+                                "hash": {
+                                    "sha256": "0386c57d59ee1292bb74d9878358da7a0ba00e5b56ed52fd6171b9e6d29d85aa"
+                                },
+                                "name": "dabapi.dll",
+                                "path": "c:\\windows\\system32\\dabapi.dll",
+                                "protection": "RWX",
+                                "protection_provenance": "eventstests.exe",
+                                "protection_provenance_path": "c:\\dev\\eventstests.exe",
+                                "reason": "ntdll.dll"
+                            },
+                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll"
+                        },
+                        "id": 11628
+                    }
+                },
+                "user": {
+                    "domain": "DESKTOP-OCG8CR6",
+                    "id": "S-1-5-21-3820246941-898183108-3095036578-1001",
+                    "name": "User"
+                }
+            }
+        },
+        {
+            "name": "network",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "address",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
+                        },
+                        {
+                            "name": "as.number",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
+                            "example": 15169
+                        },
+                        {
+                            "name": "as.organization.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Organization name.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Google LLC"
+                        },
+                        {
+                            "name": "bytes",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Bytes sent from the destination to the source.",
+                            "example": 184,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "domain",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.",
+                            "example": "foo.example.com"
+                        },
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the destination (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "packets",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Packets sent from the destination to the source.",
+                            "example": 12
+                        },
+                        {
+                            "name": "port",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Port of the destination.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "registered_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "top_level_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dns",
+                    "title": "DNS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.options",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DNS options field, uint64, representing as a keyword to avoid overflows in ES"
+                        },
+                        {
+                            "name": "Ext.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "DNS status field, uint32"
+                        },
+                        {
+                            "name": "question.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
+                            "example": "www.example.com"
+                        },
+                        {
+                            "name": "question.registered_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "question.subdomain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The subdomain is all of the labels under the registered_domain.\nIf the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
+                            "example": "www"
+                        },
+                        {
+                            "name": "question.top_level_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        },
+                        {
+                            "name": "question.type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of record being queried.",
+                            "example": "AAAA"
+                        },
+                        {
+                            "name": "resolved_ip",
+                            "level": "extended",
+                            "type": "ip",
+                            "description": "Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.",
+                            "example": "[\"10.10.10.10\", \"10.10.10.11\"]"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "http",
+                    "title": "HTTP",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to HTTP activity. Use the `url` field set to store the url of the request.",
+                    "fields": [
+                        {
+                            "name": "request.body.bytes",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Size in bytes of the request body.",
+                            "example": 887,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "request.body.content",
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "The full HTTP request body.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Hello world"
+                        },
+                        {
+                            "name": "request.bytes",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Total size in bytes of the request (body and headers).",
+                            "example": 1437,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "response.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "response.Ext.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "HTTP version"
+                        },
+                        {
+                            "name": "response.body.bytes",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Size in bytes of the response body.",
+                            "example": 887,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "response.body.content",
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "The full HTTP response body.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Hello world"
+                        },
+                        {
+                            "name": "response.bytes",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Total size in bytes of the response (body and headers).",
+                            "example": 1437,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "response.status_code",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "HTTP response status code.",
+                            "example": 404,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "network",
+                    "title": "Network",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.",
+                    "fields": [
+                        {
+                            "name": "bytes",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Total bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.",
+                            "example": 368,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "community_id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec.",
+                            "example": "1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0="
+                        },
+                        {
+                            "name": "direction",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Direction of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values \"ingress\" or \"egress\".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values \"inbound\", \"outbound\", \"internal\" or \"external\".\nNote that \"internal\" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that \"external\" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.",
+                            "example": "inbound"
+                        },
+                        {
+                            "name": "iana_number",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.",
+                            "example": 6
+                        },
+                        {
+                            "name": "packets",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Total packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum.",
+                            "example": 24
+                        },
+                        {
+                            "name": "protocol",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying.",
+                            "example": "http"
+                        },
+                        {
+                            "name": "transport",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
+                            "example": "tcp"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
+                            "example": "ipv4"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "address",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
+                        },
+                        {
+                            "name": "as.number",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
+                            "example": 15169
+                        },
+                        {
+                            "name": "as.organization.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Organization name.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Google LLC"
+                        },
+                        {
+                            "name": "bytes",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Bytes sent from the source to the destination.",
+                            "example": 184,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "domain",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.",
+                            "example": "foo.example.com"
+                        },
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the source (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "packets",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Packets sent from the source to the destination.",
+                            "example": 12
+                        },
+                        {
+                            "name": "port",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Port of the source.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "registered_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "top_level_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "id": "afd348c6-0ec9-4961-805e-8ed2fc4c043b",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTYxMi0xMzI5MzU0OTEwOS43MzU5NDk3MDA=",
+                            "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTQ3Ni0xMzI5MzU0OTEwOS4zODExMTM3MDA="
+                        ],
+                        "code_signature": [
+                            {
+                                "trusted": false,
+                                "subject_name": "Google LLC",
+                                "exists": true,
+                                "status": "errorExpired"
+                            }
+                        ]
+                    },
+                    "parent": {
+                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
+                        "group_leader": {
+                            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+                        }
+                    },
+                    "entry_leader": {
+                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
+                        "parent": {
+                            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+                        }
+                    },
+                    "session_leader": {
+                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+                    },
+                    "group_leader": {
+                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+                    },
+                    "code_signature": {
+                        "trusted": false,
+                        "subject_name": "Google LLC",
+                        "exists": true,
+                        "status": "errorExpired"
+                    },
+                    "name": "GCEWindowsAgent.exe",
+                    "pid": 580,
+                    "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
+                    "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
+                },
+                "destination": {
+                    "geo": {
+                        "continent_name": "North America",
+                        "country_iso_code": "US",
+                        "country_name": "United States",
+                        "location": {
+                            "lon": -97.822,
+                            "lat": 37.751
+                        }
+                    },
+                    "as": {
+                        "number": 15169,
+                        "organization": {
+                            "name": "GOOGLE"
+                        }
+                    },
+                    "address": "64.233.191.95",
+                    "port": 443,
+                    "bytes": 4923,
+                    "ip": "64.233.191.95"
+                },
+                "source": {
+                    "address": "10.201.0.32",
+                    "port": 54924,
+                    "bytes": 498,
+                    "ip": "10.201.0.32"
+                },
+                "dns": {
+                    "Ext": {
+                        "status": 123,
+                        "options": 9223372036854775808
+                    },
+                    "resolved_ip": [
+                        "10.10.10.10",
+                        "10.10.10.11"
+                    ],
+                    "question": {
+                        "name": "foo",
+                        "type": "A"
+                    }
+                },
+                "message": "Endpoint network event",
+                "network": {
+                    "transport": "tcp",
+                    "type": "ipv4",
+                    "direction": "egress"
+                },
+                "@timestamp": "2022-04-04T18:52:00.6007809Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.network"
+                },
+                "host": {
+                    "hostname": "mgmt-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.32",
+                        "fe80::f8e6:a511:69ea:27c4",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "mgmt-win-1",
+                    "id": "51b19c6c-27e3-4c80-ac2a-b72ed52c40c9",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 36090,
+                    "ingested": "2022-04-04T18:52:21Z",
+                    "created": "2022-04-04T18:52:00.6007809Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "disconnect_received",
+                    "id": "MYfZG5h8j1qej16H+++++CFe",
+                    "category": [
+                        "network"
+                    ],
+                    "type": [
+                        "end"
+                    ],
+                    "dataset": "endpoint.events.network"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                }
+            }
+        },
+        {
+            "name": "metrics",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Endpoint",
+                    "title": "Endpoint",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
+                    "fields": [
+                        {
+                            "name": "metrics",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Metrics fields hold the endpoint and system's performance metrics"
+                        },
+                        {
+                            "name": "metrics.cpu",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "CPU statistics"
+                        },
+                        {
+                            "name": "metrics.cpu.endpoint",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "CPU metrics for the endpoint"
+                        },
+                        {
+                            "name": "metrics.cpu.endpoint.histogram",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "histogram",
+                            "description": "This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket"
+                        },
+                        {
+                            "name": "metrics.cpu.endpoint.latest",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "half_float",
+                            "description": "Average CPU over the last sample interval"
+                        },
+                        {
+                            "name": "metrics.cpu.endpoint.mean",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "half_float",
+                            "description": "Average CPU load used by the endpoint"
+                        },
+                        {
+                            "name": "metrics.disks",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "An array of disk information for the host",
+                            "enabled": false
+                        },
+                        {
+                            "name": "metrics.disks.device",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device name"
+                        },
+                        {
+                            "name": "metrics.disks.endpoint_drive",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "This field will be present and set to true only for the drive that holds the installed endpoint"
+                        },
+                        {
+                            "name": "metrics.disks.free",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The number of bytes marked as free on the disk"
+                        },
+                        {
+                            "name": "metrics.disks.fstype",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file system type for the drive"
+                        },
+                        {
+                            "name": "metrics.disks.mount",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The disks mount location"
+                        },
+                        {
+                            "name": "metrics.disks.total",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The size of the disk in bytes"
+                        },
+                        {
+                            "name": "metrics.documents_volume",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Statistics about sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.alerts.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.alerts.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.alerts.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.alerts.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of API Event sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent API Event documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "An array of API Event document statistics per source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of API Event sent documents from source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent API Event documents from source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.source",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "API Event document source name"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed API Event documents from source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed API Event documents from source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed API Event documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed API Event documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.diagnostic_alerts.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.diagnostic_alerts.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.diagnostic_alerts.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.diagnostic_alerts.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.dns_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.dns_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.dns_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.dns_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.file_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.file_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.file_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.file_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.library_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.library_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.library_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.library_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.network_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.network_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.network_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.network_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.overall.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.overall.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.overall.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.overall.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.process_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.process_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.process_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.process_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.registry_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.registry_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.registry_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.registry_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.security_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.security_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.security_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.security_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.event_filter.active_global_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The number of active global event filters",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.event_filter.active_user_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The number of active user event filters",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.malicious_behavior_rules",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "An array of performance information about each malicious behavior rule",
+                            "enabled": false
+                        },
+                        {
+                            "name": "metrics.malicious_behavior_rules.endpoint_uptime_percent",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Perfect of Endpoint's update spent running the rule",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.malicious_behavior_rules.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The rule id",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.memory",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Memory statistics"
+                        },
+                        {
+                            "name": "metrics.memory.endpoint",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Endpoint memory utilization"
+                        },
+                        {
+                            "name": "metrics.memory.endpoint.private",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The memory private to the endpoint"
+                        },
+                        {
+                            "name": "metrics.memory.endpoint.private.latest",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The memory usage by the endpoint for the last sample interval"
+                        },
+                        {
+                            "name": "metrics.memory.endpoint.private.mean",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Average memory usage by the endpoint since its start"
+                        },
+                        {
+                            "name": "metrics.system_impact",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "An array of system impact information",
+                            "enabled": false,
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.authentication_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing authentication events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.authentication_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on authentication events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.dns_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing DNS events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.dns_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on DNS events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.file_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing file events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.file_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on file events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.library_load_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing library load events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.library_load_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on library load events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.malware.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing malware scanning due to the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.malware.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on malware scanning due to the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.network_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing network events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.network_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on network events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.overall.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing activity for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.overall.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent monitoring the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the process",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "description": "'The identifier used to sign the binary.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'",
+                            "example": "com.apple.xpc.proxy",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "description": "'The team identifier used to sign the binary.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'",
+                            "example": "EQHXZ8M8AV",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Path to the process executable for the impact entry",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing process events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on process events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.registry_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing registry events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.registry_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on registry events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.threat_intelligence_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.threat_intelligence_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.win32k_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.win32k_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.threads",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Statistics about the individual Endpoint threads (array)",
+                            "enabled": false
+                        },
+                        {
+                            "name": "metrics.threads.cpu.mean",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The thread's average CPU use",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.threads.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The thread name",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.uptime",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Number of seconds since boot"
+                        },
+                        {
+                            "name": "metrics.uptime.endpoint",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of seconds since the endpoint was started"
+                        },
+                        {
+                            "name": "metrics.uptime.system",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of seconds since the system was started"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "end",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "build": {
+                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+                    },
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "message": "Endpoint metrics",
+                "@timestamp": "2022-04-04T18:38:15.7178887Z",
+                "Endpoint": {
+                    "metrics": {
+                        "system_impact": [
+                            {
+                                "file_events": {
+                                    "week_ms": 418
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows Publisher",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\svchost.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 7483
+                                },
+                                "process_events": {
+                                    "week_ms": 78
+                                },
+                                "registry_events": {
+                                    "week_ms": 248
+                                },
+                                "dns_events": {
+                                    "week_ms": 16
+                                },
+                                "network_events": {
+                                    "week_ms": 8
+                                },
+                                "overall": {
+                                    "week_ms": 11744
+                                },
+                                "authentication_events": {
+                                    "week_ms": 155
+                                },
+                                "library_load_events": {
+                                    "week_ms": 3028
+                                },
+                                "cred_access_events": {
+                                    "week_ms": 10
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 250
+                                },
+                                "win32k_events": {
+                                    "week_ms": 50
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 46
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 2
+                                },
+                                "process_events": {
+                                    "week_ms": 19
+                                },
+                                "registry_events": {
+                                    "week_ms": 3
+                                },
+                                "overall": {
+                                    "week_ms": 8290
+                                },
+                                "library_load_events": {
+                                    "week_ms": 7890
+                                },
+                                "cred_access_events": {
+                                    "week_ms": 20
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 300
+                                },
+                                "win32k_events": {
+                                    "week_ms": 10
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 1641
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Elasticsearch, Inc.",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 2589
+                                },
+                                "process_events": {
+                                    "week_ms": 419
+                                },
+                                "registry_events": {
+                                    "week_ms": 1
+                                },
+                                "network_events": {
+                                    "week_ms": 32
+                                },
+                                "overall": {
+                                    "week_ms": 5046
+                                },
+                                "library_load_events": {
+                                    "week_ms": 4
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 360
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 2
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows Publisher",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\lsass.exe"
+                                },
+                                "process_events": {
+                                    "week_ms": 3
+                                },
+                                "registry_events": {
+                                    "week_ms": 83
+                                },
+                                "overall": {
+                                    "week_ms": 4761
+                                },
+                                "authentication_events": {
+                                    "week_ms": 3177
+                                },
+                                "library_load_events": {
+                                    "week_ms": 26
+                                },
+                                "cred_access_events": {
+                                    "week_ms": 1350
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 120
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\conhost.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 16
+                                },
+                                "process_events": {
+                                    "week_ms": 26
+                                },
+                                "registry_events": {
+                                    "week_ms": 3
+                                },
+                                "overall": {
+                                    "week_ms": 3261
+                                },
+                                "library_load_events": {
+                                    "week_ms": 2966
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 250
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 51
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false,
+                                            "status": "errorCode_endpoint: Initital state, no attempt to load signature was made"
+                                        }
+                                    ],
+                                    "executable": "System"
+                                },
+                                "malware": {
+                                    "week_ms": 1978
+                                },
+                                "overall": {
+                                    "week_ms": 2029
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\e266326169887aa7cb26b9e2aa421ee4\\System.Web.ni.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 1015
+                                },
+                                "overall": {
+                                    "week_ms": 1015
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 8
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Elasticsearch, Inc.",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\metricbeat-8.3.0-SNAPSHOT-windows-x86_64\\metricbeat.exe"
+                                },
+                                "process_events": {
+                                    "week_ms": 502
+                                },
+                                "dns_events": {
+                                    "week_ms": 84
+                                },
+                                "network_events": {
+                                    "week_ms": 1
+                                },
+                                "overall": {
+                                    "week_ms": 1162
+                                },
+                                "library_load_events": {
+                                    "week_ms": 417
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 150
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": false,
+                                            "subject_name": "Google LLC",
+                                            "exists": true,
+                                            "status": "errorExpired"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 627
+                                },
+                                "process_events": {
+                                    "week_ms": 89
+                                },
+                                "registry_events": {
+                                    "week_ms": 2
+                                },
+                                "dns_events": {
+                                    "week_ms": 7
+                                },
+                                "network_events": {
+                                    "week_ms": 8
+                                },
+                                "overall": {
+                                    "week_ms": 1068
+                                },
+                                "library_load_events": {
+                                    "week_ms": 85
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 250
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\39ce4aafe1a3bc56fb1435f6550dd7a3\\Microsoft.PowerShell.Commands.Utility.ni.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 760
+                                },
+                                "overall": {
+                                    "week_ms": 760
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 15
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\metricbeat-7.10.0-windows-x86_64\\metricbeat.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 29
+                                },
+                                "process_events": {
+                                    "week_ms": 634
+                                },
+                                "registry_events": {
+                                    "week_ms": 1
+                                },
+                                "dns_events": {
+                                    "week_ms": 8
+                                },
+                                "network_events": {
+                                    "week_ms": 4
+                                },
+                                "overall": {
+                                    "week_ms": 744
+                                },
+                                "library_load_events": {
+                                    "week_ms": 3
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 50
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\spoolsv.exe"
+                                },
+                                "process_events": {
+                                    "week_ms": 8
+                                },
+                                "registry_events": {
+                                    "week_ms": 40
+                                },
+                                "overall": {
+                                    "week_ms": 795
+                                },
+                                "library_load_events": {
+                                    "week_ms": 627
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 120
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Elasticsearch, Inc.",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Packetbeat\\packetbeat.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 74
+                                },
+                                "process_events": {
+                                    "week_ms": 432
+                                },
+                                "registry_events": {
+                                    "week_ms": 1
+                                },
+                                "network_events": {
+                                    "week_ms": 1
+                                },
+                                "overall": {
+                                    "week_ms": 599
+                                },
+                                "library_load_events": {
+                                    "week_ms": 61
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 30
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 20
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Corporation",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        },
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Corporation",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 350
+                                },
+                                "process_events": {
+                                    "week_ms": 19
+                                },
+                                "registry_events": {
+                                    "week_ms": 1
+                                },
+                                "overall": {
+                                    "week_ms": 480
+                                },
+                                "library_load_events": {
+                                    "week_ms": 70
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 20
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 6
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Elasticsearch, Inc.",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\filebeat-8.3.0-SNAPSHOT-windows-x86_64\\filebeat.exe"
+                                },
+                                "process_events": {
+                                    "week_ms": 395
+                                },
+                                "dns_events": {
+                                    "week_ms": 51
+                                },
+                                "network_events": {
+                                    "week_ms": 2
+                                },
+                                "overall": {
+                                    "week_ms": 494
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 40
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Google LLC",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Google\\Compute Engine\\vss\\GoogleVssProvider.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 439
+                                },
+                                "overall": {
+                                    "week_ms": 439
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\VSSVC.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 45
+                                },
+                                "process_events": {
+                                    "week_ms": 13
+                                },
+                                "registry_events": {
+                                    "week_ms": 124
+                                },
+                                "overall": {
+                                    "week_ms": 476
+                                },
+                                "authentication_events": {
+                                    "week_ms": 8
+                                },
+                                "library_load_events": {
+                                    "week_ms": 216
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 70
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\SYSTEM32\\mispace.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 353
+                                },
+                                "overall": {
+                                    "week_ms": 353
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\b1cbeb46534d9974961496306f2f1a28\\System.Web.Extensions.ni.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 305
+                                },
+                                "overall": {
+                                    "week_ms": 305
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 25
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\wbem\\WMIADAP.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 247
+                                },
+                                "process_events": {
+                                    "week_ms": 4
+                                },
+                                "registry_events": {
+                                    "week_ms": 5
+                                },
+                                "overall": {
+                                    "week_ms": 345
+                                },
+                                "library_load_events": {
+                                    "week_ms": 14
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 50
+                                }
+                            }
+                        ],
+                        "memory": {
+                            "endpoint": {
+                                "private": {
+                                    "mean": 288590259,
+                                    "latest": 493723648
+                                }
+                            }
+                        },
+                        "disks": [
+                            {
+                                "endpoint_drive": true,
+                                "total": 53564403712,
+                                "free": 25891106816,
+                                "device": "\\Device\\HarddiskVolume3",
+                                "mount": "C:\\",
+                                "fstype": "NTFS"
+                            },
+                            {
+                                "total": 100663296,
+                                "free": 73579520,
+                                "device": "\\Device\\HarddiskVolume2",
+                                "mount": "",
+                                "fstype": "FAT32"
+                            }
+                        ],
+                        "documents_volume": {
+                            "file_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 3485,
+                                "sent_bytes": 7302875
+                            },
+                            "security_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 259,
+                                "sent_bytes": 422247
+                            },
+                            "library_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 114,
+                                "sent_bytes": 287954
+                            },
+                            "process_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 201,
+                                "sent_bytes": 602914
+                            },
+                            "registry_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 605,
+                                "sent_bytes": 1288593
+                            },
+                            "dns_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 5250,
+                                "sent_bytes": 11364752
+                            },
+                            "network_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 1753,
+                                "sent_bytes": 3479631
+                            },
+                            "overall": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 11667,
+                                "sent_bytes": 24748966
+                            }
+                        },
+                        "cpu": {
+                            "endpoint": {
+                                "mean": 0.324235176435677,
+                                "latest": 62.6406111450215
+                            }
+                        },
+                        "threads": [
+                            {
+                                "name": "actionsAPIThread",
+                                "cpu": {
+                                    "mean": 0.00456829602558246
+                                }
+                            },
+                            {
+                                "name": "stateReportThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "checkinAPIThread",
+                                "cpu": {
+                                    "mean": 0.0365463682046597
+                                }
+                            },
+                            {
+                                "name": "KernelAsyncMessageQueueConsumerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "Cron",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "File Cache",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "FileLogThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "LoggingLimitThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "CredentialAccessEventDispatcherThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelPortConsumerThread",
+                                "cpu": {
+                                    "mean": 0.00456454263282819
+                                }
+                            },
+                            {
+                                "name": "KernelPortConsumerThread",
+                                "cpu": {
+                                    "mean": 0.00456454263282819
+                                }
+                            },
+                            {
+                                "name": "RulesEngineThread",
+                                "cpu": {
+                                    "mean": 0.0091324200913242
+                                }
+                            },
+                            {
+                                "name": "KernelPortConsumerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelAsyncMessageQueueConsumerThread",
+                                "cpu": {
+                                    "mean": 0.00456454263282819
+                                }
+                            },
+                            {
+                                "name": "KernelSyncQueueConsumerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "DocumentLoggingThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "DocumentLoggingMaintenance",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "BulkConsumerThread",
+                                "cpu": {
+                                    "mean": 0.00455871626549964
+                                }
+                            },
+                            {
+                                "name": "DocumentLoggingConsumerThread",
+                                "cpu": {
+                                    "mean": 0.113967906637491
+                                }
+                            },
+                            {
+                                "name": "DocumentLoggingLimitThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.022822713164141
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.022822713164141
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "ArtifactManifestDownload",
+                                "cpu": {
+                                    "mean": 0.12311901504788
+                                }
+                            },
+                            {
+                                "name": "PolicyReloadThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "CredentialAccessClassifierThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelPortConsumerThread",
+                                "cpu": {
+                                    "mean": 0.0136936278984846
+                                }
+                            },
+                            {
+                                "name": "PerformanceMonitorWorkerThread",
+                                "cpu": {
+                                    "mean": 0.00912200684150513
+                                }
+                            },
+                            {
+                                "name": "MetadataThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "EventsQueueThread",
+                                "cpu": {
+                                    "mean": 0.0729760547320411
+                                }
+                            },
+                            {
+                                "name": "DelayedAlertEnrichment",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "MaintainProcessMap",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "FileScoreThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "DiagnosticMalwareThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "QuarantineManagerWorkerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "EventProcessingThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "HostIsolationMonitorThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "serviceCommsThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "grpcConnectionManagerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "RansomwareGlobalUserThread"
+                            },
+                            {
+                                "name": "RansomwareProcessMonitorThread"
+                            },
+                            {
+                                "name": "RansomwareFileCacheCleanupThread"
+                            },
+                            {
+                                "name": "RansomwareParseUnverifiedThread"
+                            },
+                            {
+                                "name": "RansomwareLuaVerifiedThread"
+                            }
+                        ],
+                        "uptime": {
+                            "endpoint": 21930,
+                            "system": 21992
+                        }
+                    }
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "metrics",
+                    "dataset": "endpoint.metrics"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 35124,
+                    "ingested": "2022-04-04T18:38:16Z",
+                    "created": "2022-04-04T18:38:15.7178887Z",
+                    "kind": "metric",
+                    "module": "endpoint",
+                    "action": "endpoint_metrics",
+                    "id": "MYfZG00oEwD2/fqT+++++Byi",
+                    "category": [
+                        "host"
+                    ],
+                    "type": [
+                        "info"
+                    ],
+                    "dataset": "endpoint.metrics"
+                }
+            }
+        }
+    ]
+}
\ No newline at end of file
diff --git a/scripts/generate-docs/output/policy.md b/scripts/generate-docs/output/policy.md
new file mode 100644
index 000000000..0b15bbe4c
--- /dev/null
+++ b/scripts/generate-docs/output/policy.md
@@ -0,0 +1,104 @@
+# policy
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### Endpoint
+
+#### Description
+Fields describing the state of the Elastic Endpoint when an event occurs.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/process.md b/scripts/generate-docs/output/process.md
new file mode 100644
index 000000000..4b47ceb23
--- /dev/null
+++ b/scripts/generate-docs/output/process.md
@@ -0,0 +1,205 @@
+# process
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### cloud
+
+#### Description
+Fields related to the cloud or infrastructure the events are coming from.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### container
+
+#### Description
+Container fields are used for meta information about the specific container that is the source of information.
+These fields help correlate data based containers from any runtime.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### destination
+
+#### Description
+Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### group
+
+#### Description
+The group fields are meant to represent groups that are relevant to the event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### orchestrator
+
+#### Description
+Fields that describe the resources which container orchestrators manage or act upon.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### package
+
+#### Description
+These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### process
+
+#### Description
+These fields contain information about a process.
+These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### source
+
+#### Description
+Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/registry.md b/scripts/generate-docs/output/registry.md
new file mode 100644
index 000000000..5a662f748
--- /dev/null
+++ b/scripts/generate-docs/output/registry.md
@@ -0,0 +1,183 @@
+# registry
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### Effective_process
+
+#### Description
+These fields contain information about an effective process.
+The effective process is the process that requested the a specific action, without directly performing it.
+Processes can have effective parents that differ from their regular parents. For example, on Windows, "wmic process call create notepad" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.
+Events can have effective processes that differ from their regular processes. For example, on Windows, "reg add \\localhost\HKLM\Software\Foo /v Data /t REG_SZ /d 123"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### destination
+
+#### Description
+Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### group
+
+#### Description
+The group fields are meant to represent groups that are relevant to the event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### process
+
+#### Description
+These fields contain information about a process.
+These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### registry
+
+#### Description
+Fields related to Windows Registry operations.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### source
+
+#### Description
+Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/output/security.md b/scripts/generate-docs/output/security.md
new file mode 100644
index 000000000..a48247838
--- /dev/null
+++ b/scripts/generate-docs/output/security.md
@@ -0,0 +1,194 @@
+# security
+
+### @timestamp
+
+#### Description
+Date/time when the event originated.
+This is the date/time extracted from the event, typically representing when the event was generated by the source.
+If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
+Required field for all events.
+#### Example
+
+```json
+"2016-05-23T08:05:34.853Z"
+```
+<hr>
+
+### message
+
+#### Description
+For log events the message field contains the log message, optimized for viewing in a log viewer.
+For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
+If multiple messages exist, they can be combined into one message.
+#### Example
+
+```json
+"Hello World"
+```
+<hr>
+
+### Target
+
+#### Description
+These fields contain information about a target.
+These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### agent
+
+#### Description
+The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
+Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### data_stream
+
+#### Description
+Fields describing the new indexing strategy <type>-<dataset>-<namespace>
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### destination
+
+#### Description
+Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### ecs
+
+#### Description
+Meta-information specific to ECS.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### event
+
+#### Description
+The event fields are used for context information about the log or metric event itself.
+A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### file
+
+#### Description
+A file is defined as a set of information that has been created on, or has existed on a filesystem.
+File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### group
+
+#### Description
+The group fields are meant to represent groups that are relevant to the event.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### host
+
+#### Description
+A host is defined as a general computing instance.
+ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### process
+
+#### Description
+These fields contain information about a process.
+These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### source
+
+#### Description
+Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
+Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### user
+
+#### Description
+The user fields describe information about the user that is relevant to the event.
+Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
+### winlog
+
+#### Description
+These fields provide detailed information regarding events logged in the Windows Event Log. The Windows Event Log is a centralized system used by Windows to record events related to system, application, and security activities. Each event log entry is categorized by a specific event type, and contains relevant metadata that can include the event source, event ID, timestamp, user details, and other associated data.
+#### Example
+
+```json
+Needs example
+
+```
+<hr>
+
diff --git a/scripts/generate-docs/packages.json b/scripts/generate-docs/packages.json
new file mode 100644
index 000000000..c181fcdd3
--- /dev/null
+++ b/scripts/generate-docs/packages.json
@@ -0,0 +1,36484 @@
+{
+    "packages": [
+        {
+            "name": "alerts",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "Events",
+                    "level": "custom",
+                    "type": "object",
+                    "description": "events array"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Endpoint",
+                    "title": "Endpoint",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
+                    "fields": [
+                        {
+                            "name": "policy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The policy fields are used to hold information about applied policy."
+                        },
+                        {
+                            "name": "policy.applied",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about the policy that is applied"
+                        },
+                        {
+                            "name": "policy.applied.artifacts",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about global protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.channel",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "global artifacts rollout channel"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "the identifiers of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of global artifact applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the sha256 of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.snapshot",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the snapshot date of applied global artifacts or 'latest'"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.update_age",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "number of days since global artifacts were made up-to-date"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about user protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "the identifiers of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of user artifact applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the sha256 of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the id of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of this applied policy"
+                        },
+                        {
+                            "name": "policy.applied.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of this applied policy"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Memory_protection",
+                    "title": "Memory Protection",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information specific to Memory Protection alerts.",
+                    "fields": [
+                        {
+                            "name": "cross_session",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Is this process injecting across operating system sessions?"
+                        },
+                        {
+                            "name": "feature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory Protection feature which triggered the alert.",
+                            "example": "shellcode_thread"
+                        },
+                        {
+                            "name": "parent_to_child",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Is this process injecting into its child?"
+                        },
+                        {
+                            "name": "self_injection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Is this alert about a process injecting into itself?"
+                        },
+                        {
+                            "name": "thread_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The number of threads that this alert applies to. If several alerts occur in a short period of time, they can be combined into a single alert with thread_count > 1."
+                        },
+                        {
+                            "name": "unique_key_v1",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A unique key created by hashing several characteristics of this alert."
+                        },
+                        {
+                            "name": "unique_key_v2",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A unique key created by hashing several characteristics of this alert.",
+                            "example": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Ransomware",
+                    "title": "Ransomware",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information specific to ransomware alerts.",
+                    "fields": [
+                        {
+                            "name": "child_processes.executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "child_processes.feature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ransomware feature which triggered the alert."
+                        },
+                        {
+                            "name": "child_processes.files",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Information about each file event attributed to the ransomware. Expected to be an array."
+                        },
+                        {
+                            "name": "child_processes.files.data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File header or MBR bytes."
+                        },
+                        {
+                            "name": "child_processes.files.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy of file contents."
+                        },
+                        {
+                            "name": "child_processes.files.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot."
+                        },
+                        {
+                            "name": "child_processes.files.metrics",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Suspicious ransomware behaviours associated with the file event."
+                        },
+                        {
+                            "name": "child_processes.files.operation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operation applied to file."
+                        },
+                        {
+                            "name": "child_processes.files.original.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file extension prior to the file event."
+                        },
+                        {
+                            "name": "child_processes.files.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to the file event."
+                        },
+                        {
+                            "name": "child_processes.files.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name."
+                        },
+                        {
+                            "name": "child_processes.files.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Ransomware score for this particular file event."
+                        },
+                        {
+                            "name": "child_processes.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "child_processes.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Total ransomware score for aggregated file events."
+                        },
+                        {
+                            "name": "child_processes.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ransomware artifact version."
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "feature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ransomware feature which triggered the alert."
+                        },
+                        {
+                            "name": "files",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Information about each file event attributed to the ransomware. Expected to be an array."
+                        },
+                        {
+                            "name": "files.data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File header or MBR bytes."
+                        },
+                        {
+                            "name": "files.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy of file contents."
+                        },
+                        {
+                            "name": "files.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot."
+                        },
+                        {
+                            "name": "files.metrics",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Suspicious ransomware behaviours associated with the file event."
+                        },
+                        {
+                            "name": "files.operation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operation applied to file."
+                        },
+                        {
+                            "name": "files.original.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file extension prior to the file event."
+                        },
+                        {
+                            "name": "files.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to the file event."
+                        },
+                        {
+                            "name": "files.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name."
+                        },
+                        {
+                            "name": "files.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Ransomware score for this particular file event."
+                        },
+                        {
+                            "name": "pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Total ransomware score for aggregated file events."
+                        },
+                        {
+                            "name": "version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ransomware artifact version."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Responses",
+                    "title": "Responses",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "responses array contains rule response action results",
+                    "fields": [
+                        {
+                            "name": "@timestamp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp in which action was taken",
+                            "format": "string"
+                        },
+                        {
+                            "name": "action",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Dictionary representing requested response action"
+                        },
+                        {
+                            "name": "action.action",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Response action name"
+                        },
+                        {
+                            "name": "action.field",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Field in the triggering event to use as input for action"
+                        },
+                        {
+                            "name": "action.file.attributes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Destination file attributes"
+                        },
+                        {
+                            "name": "action.file.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Destination file path"
+                        },
+                        {
+                            "name": "action.file.reason",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Combined USN file modification reason"
+                        },
+                        {
+                            "name": "action.key.actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Actions taken by Registry Rollback for key"
+                        },
+                        {
+                            "name": "action.key.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT path of registry key recovered by Rollback"
+                        },
+                        {
+                            "name": "action.key.values",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Values modified"
+                        },
+                        {
+                            "name": "action.key.values.actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Actions taken by Registry Rollback for value"
+                        },
+                        {
+                            "name": "action.key.values.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Value name recovered by Rollback"
+                        },
+                        {
+                            "name": "action.process.message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Status message for Process Rollback"
+                        },
+                        {
+                            "name": "action.process.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path of process killed by Process Rollback"
+                        },
+                        {
+                            "name": "action.process.result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Result code for Process Rollback"
+                        },
+                        {
+                            "name": "action.source.attributes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source file attributes"
+                        },
+                        {
+                            "name": "action.source.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source file path"
+                        },
+                        {
+                            "name": "action.state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Index of event in events array to use for field lookup"
+                        },
+                        {
+                            "name": "action.tree",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Indicates whether or not an action was taken against an entire process tree"
+                        },
+                        {
+                            "name": "message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Result message"
+                        },
+                        {
+                            "name": "process",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Dictionary representing process information"
+                        },
+                        {
+                            "name": "process.entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Entity id of actionable process"
+                        },
+                        {
+                            "name": "process.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of actionable process"
+                        },
+                        {
+                            "name": "process.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "pid of actionable process"
+                        },
+                        {
+                            "name": "result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Response action result code"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Target",
+                    "title": "Target",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
+                    "fields": [
+                        {
+                            "name": "dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "dll.Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "process.Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "process.Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        },
+                        {
+                            "name": "process.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "process.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "process.Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "process.Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "process.Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory allocation containing the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Original memory size requested when the memory was allocated.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+                            "example": "PRIVATE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The address where bytes_compressed begins.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether bytes_compressed is present in this event.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A sequence of signature names matched.",
+                            "example": "Windows.EICAR.Not-a-virus"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature identifier"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The first matching details."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The first matching details.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of file matching signature."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of file matching signature."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the first yara rule matched."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the first yara rule matched."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature version"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
+                            "example": "C:\\Windows\\System32\\mshtml.dll"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the file at mapped_path is an executable.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether an executable file was found in memory.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of the memory region.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_start_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 64 bytes at the region base address.",
+                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+                            "example": "COMMIT"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.strings",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Array of strings found within the memory region.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "process.Ext.services",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Services running in this process."
+                        },
+                        {
+                            "name": "process.Ext.session",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Session information for the current process"
+                        },
+                        {
+                            "name": "process.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "process.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "process.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "process.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "process.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "process.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "process.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "process.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "process.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "process.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "process.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "process.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "process.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "process.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "process.Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "process.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "process.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "process.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "process.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "process.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "process.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "process.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "process.exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "process.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "process.parent.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.parent.Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.parent.Ext.dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.parent.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "process.parent.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
+                        },
+                        {
+                            "name": "process.parent.Ext.real.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "process.parent.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "process.parent.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "process.parent.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "process.parent.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "process.parent.Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "process.parent.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "process.parent.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "process.parent.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "process.parent.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.parent.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "process.parent.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.parent.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "process.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "process.parent.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "process.parent.exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "process.parent.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.parent.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.parent.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.parent.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.parent.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "process.parent.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.parent.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.parent.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.parent.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.parent.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.parent.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.parent.pgid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.parent.ppid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "process.parent.thread.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.parent.thread.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "process.parent.title",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ]
+                        },
+                        {
+                            "name": "process.parent.uptime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "process.parent.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "process.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.pgid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.ppid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "process.thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.instruction_pointer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The return address of this stack frame."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.memory_section.memory_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.memory_section.memory_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.memory_section.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.module_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The name of the DLL/module containing `instruction_pointer`.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.module_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path to the DLL/module containing `instruction_pointer`."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.rva",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The final non-win32 module in the call stack."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_user_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file name of the call_stack_final_user_module.",
+                            "example": "example.dll"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_final_user_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_user_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "process.thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "process.thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a trampoline was detected, this indicates the original content for the thread start address in memory.",
+                            "example": 4194304
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.",
+                            "example": "48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc"
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_bytes_disasm",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the disassembled code at the original thread start address.",
+                            "example": "mov rax, 0x4141414141414141\\njmp rax"
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_bytes_disasm_hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
+                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
+                        },
+                        {
+                            "name": "process.thread.Ext.original_start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.",
+                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
+                        },
+                        {
+                            "name": "process.thread.Ext.parameter",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a thread is created, this is the raw numerical value of its parameter."
+                        },
+                        {
+                            "name": "process.thread.Ext.parameter_bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.thread.Ext.parameter_bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether parameter_bytes_compressed is present in this event."
+                        },
+                        {
+                            "name": "process.thread.Ext.service",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Service associated with the thread.",
+                            "example": "VaultSvc"
+                        },
+                        {
+                            "name": "process.thread.Ext.start",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "The time the thread started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Memory address where the thread began execution.",
+                            "example": 4194304
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.",
+                            "example": "c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_bytes_disasm",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The bytes at the thread start address, disassembled into human-readable assembly code.",
+                            "example": "ret\\nint3"
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_bytes_disasm_hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
+                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
+                        },
+                        {
+                            "name": "process.thread.Ext.start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The dll/module where the thread began execution.",
+                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
+                        },
+                        {
+                            "name": "process.thread.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "process.thread.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "process.thread.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "process.thread.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "process.thread.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "process.thread.Ext.uptime",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Seconds since thread started."
+                        },
+                        {
+                            "name": "process.thread.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.thread.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "process.title",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ]
+                        },
+                        {
+                            "name": "process.uptime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "process.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "ephemeral_id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
+                            "example": "8a4f500f"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
+                            "example": "foo"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "cloud",
+                    "title": "Cloud",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to the cloud or infrastructure the events are coming from.",
+                    "fields": [
+                        {
+                            "name": "account.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
+                            "example": 666777888999
+                        },
+                        {
+                            "name": "instance.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Instance name of the host machine."
+                        },
+                        {
+                            "name": "project.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
+                            "example": "my-project"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
+                            "example": "aws"
+                        },
+                        {
+                            "name": "region",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region in which this host, resource, or service is located.",
+                            "example": "us-east-1"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information."
+                },
+                {
+                    "name": "container",
+                    "title": "Container",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique container id."
+                        },
+                        {
+                            "name": "image.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the image the container was built on."
+                        },
+                        {
+                            "name": "image.tag",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Container image tags."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Container name."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the destination (IPv4 or IPv6)."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dll",
+                    "title": "DLL",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dns",
+                    "title": "DNS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).",
+                    "fields": [
+                        {
+                            "name": "question.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
+                            "example": "www.example.com"
+                        },
+                        {
+                            "name": "question.type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of record being queried.",
+                            "example": "AAAA"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "elastic",
+                    "title": "Elastic",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Holds fields and properties of data points and concepts in the elastic domain or namespace.",
+                    "fields": [
+                        {
+                            "name": "agent",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
+                        },
+                        {
+                            "name": "agent.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this elastic agent (if one exists).",
+                            "example": "c2a9093e-e289-4c0a-aa44-8c32a414fa7a"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "risk_score",
+                            "level": "core",
+                            "type": "float",
+                            "description": "Risk score or priority of the event (e.g. security solutions). Use your system's original value here."
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "file",
+                    "title": "File",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.entry_modified",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
+                        },
+                        {
+                            "name": "Ext.macro.code_page",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Identifies the character encoding used for this macro.  https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers"
+                        },
+                        {
+                            "name": "Ext.macro.collection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object containing hashes for the macro collection."
+                        },
+                        {
+                            "name": "Ext.macro.collection.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.macro.collection.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.macro.collection.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.macro.collection.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.macro.errors",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Errors that occurred when parsing this document file."
+                        },
+                        {
+                            "name": "Ext.macro.errors.count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of times this error that occurred."
+                        },
+                        {
+                            "name": "Ext.macro.errors.error_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of parsing error that occurred."
+                        },
+                        {
+                            "name": "Ext.macro.file_extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The extension of the file containing this macro (e.g. .docm)"
+                        },
+                        {
+                            "name": "Ext.macro.project_file",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Metadata about the corresponding VBA project file"
+                        },
+                        {
+                            "name": "Ext.macro.project_file.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.macro.project_file.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.macro.project_file.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.macro.project_file.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Streams associated with the document."
+                        },
+                        {
+                            "name": "Ext.macro.stream.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.macro.stream.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the stream."
+                        },
+                        {
+                            "name": "Ext.macro.stream.raw_code",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 100KB of raw stream binary.  Can be useful to analyze false positives and malicious payloads."
+                        },
+                        {
+                            "name": "Ext.macro.stream.raw_code_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The original stream size.  Indicates whether stream.raw_code was truncated."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "Ext.original",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Original file information during a modification event."
+                        },
+                        {
+                            "name": "Ext.original.gid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "Ext.original.group",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "Ext.original.mode",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file mode prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file name prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.owner",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "Ext.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.uid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "Ext.quarantine_message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Message describing quarantine results."
+                        },
+                        {
+                            "name": "Ext.quarantine_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint the quarantined file was originally."
+                        },
+                        {
+                            "name": "Ext.quarantine_result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean representing whether or not file quarantine succeeded."
+                        },
+                        {
+                            "name": "Ext.temp_file_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
+                        },
+                        {
+                            "name": "Ext.windows",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Platform-specific Windows fields"
+                        },
+                        {
+                            "name": "Ext.windows.zone_identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Windows zone identifier for a file"
+                        },
+                        {
+                            "name": "accessed",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+                        },
+                        {
+                            "name": "attributes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
+                            "example": "[\"readonly\", \"system\"]"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "created",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "File creation time.\nNote that not all filesystems store the creation time."
+                        },
+                        {
+                            "name": "ctime",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+                        },
+                        {
+                            "name": "device",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device that is the source of the file.",
+                            "example": "sda"
+                        },
+                        {
+                            "name": "directory",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "drive_letter",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1,
+                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
+                            "example": "C"
+                        },
+                        {
+                            "name": "extension",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "gid",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "group",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "inode",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Inode representing the file in the filesystem.",
+                            "example": "256383"
+                        },
+                        {
+                            "name": "mime_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+                        },
+                        {
+                            "name": "mode",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode of the file in octal representation.",
+                            "example": "0640"
+                        },
+                        {
+                            "name": "mtime",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file content was modified."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "owner",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "size",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
+                            "example": 16384
+                        },
+                        {
+                            "name": "target_path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Target path for symlinks.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File type (file, dir, or symlink).",
+                            "example": "file"
+                        },
+                        {
+                            "name": "uid",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "boot.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
+                            "example": "88a1f0ed-5ae5-41ee-af6b-41921c311872"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "pid_ns_ino",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
+                            "example": 256383
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "user.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "user.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "user.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "user.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "user.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "user.email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "user.full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "user.group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "user.group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "user.group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "user.group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "user.group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "user.group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "user.group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "user.hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "user.id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "user.name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "orchestrator",
+                    "title": "Orchestrator",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields that describe the resources which container orchestrators manage or act upon.",
+                    "fields": [
+                        {
+                            "name": "cluster.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the cluster."
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Namespace in which the action is taking place.",
+                            "example": "kube-system"
+                        },
+                        {
+                            "name": "resource.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the resource being acted upon.",
+                            "example": "test-pod-cdcws"
+                        },
+                        {
+                            "name": "resource.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of resource being acted upon.",
+                            "example": "service"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.api.behaviors",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
+                            "example": "[ \"cross-process\", \"rapid_background_polling\", \"multiple_polling_processes\", \"native_api\", \"shellcode\" ]"
+                        },
+                        {
+                            "name": "Ext.api.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the API, usually the name of the function or system call.",
+                            "example": "VirtualAlloc"
+                        },
+                        {
+                            "name": "Ext.api.summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The summary of the API call and its parameters.",
+                            "example": "VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )"
+                        },
+                        {
+                            "name": "Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.created_suspended",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "Ext.dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.malware_classification.features",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Intermediate field included by adding option with subset",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory allocation containing the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Original memory size requested when the memory was allocated.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+                            "example": "PRIVATE"
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The address where bytes_compressed begins.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether bytes_compressed is present in this event.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A sequence of signature names matched.",
+                            "example": "Windows.EICAR.Not-a-virus"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature identifier"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The first matching details."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The first matching details.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of file matching signature."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of file matching signature."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the first yara rule matched."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the first yara rule matched."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature version"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
+                            "example": "C:\\Windows\\System32\\mshtml.dll"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the file at mapped_path is an executable.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether an executable file was found in memory.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.region_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.region_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "Ext.memory_region.region_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of the memory region.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.memory_region.region_start_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 64 bytes at the region base address.",
+                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
+                        },
+                        {
+                            "name": "Ext.memory_region.region_state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+                            "example": "COMMIT"
+                        },
+                        {
+                            "name": "Ext.memory_region.strings",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Array of strings found within the memory region.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "Ext.services",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Services running in this process."
+                        },
+                        {
+                            "name": "Ext.session",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Session information for the current process"
+                        },
+                        {
+                            "name": "Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "args",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "entry_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "entry_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "entry_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.entry_meta.source.ip",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the source (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "entry_leader.entry_meta.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
+                        },
+                        {
+                            "name": "entry_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "entry_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "entry_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "entry_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "entry_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "entry_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "entry_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "entry_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "env_vars",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"PATH=/usr/local/bin:/usr/bin\", \"USER=ubuntu\"]"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "group_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "group_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "group_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "group_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "group_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "group_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "group_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "group_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "group_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "group_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "group_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "group_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "group_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "parent.Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.compile_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp from when the module was compiled."
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "parent.Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.dll.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "parent.Ext.dll.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "parent.Ext.dll.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "parent.Ext.dll.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "parent.Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "parent.Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "parent.Ext.dll.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "parent.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "parent.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
+                        },
+                        {
+                            "name": "parent.Ext.real.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
+                        },
+                        {
+                            "name": "parent.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "parent.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "parent.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "parent.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "parent.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "parent.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "parent.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "parent.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "parent.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "parent.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "parent.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "parent.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "parent.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "parent.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "parent.Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "parent.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "parent.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "parent.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "parent.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "parent.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "parent.exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "parent.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.group_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.group_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "parent.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "parent.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "parent.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "parent.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "parent.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "parent.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "parent.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "parent.pgid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.ppid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "parent.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.thread.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.thread.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "parent.title",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ]
+                        },
+                        {
+                            "name": "parent.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "parent.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "parent.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "parent.uptime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "parent.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "pgid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "ppid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "previous.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "previous.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "previous.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "session_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "session_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "session_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "session_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "session_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "session_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "session_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "session_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "session_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.instruction_pointer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The return address of this stack frame."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.memory_section.memory_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.memory_section.memory_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.memory_section.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.module_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The name of the DLL/module containing `instruction_pointer`.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.module_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path to the DLL/module containing `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.rva",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The module that installed the final API hook in the call stack."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_hook_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_hook_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_hook_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_hook_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The final non-win32 module in the call stack."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_user_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file name of the call_stack_final_user_module.",
+                            "example": "example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_user_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a trampoline was detected, this indicates the original content for the thread start address in memory.",
+                            "example": 4194304
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.",
+                            "example": "48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc"
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_bytes_disasm",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the disassembled code at the original thread start address.",
+                            "example": "mov rax, 0x4141414141414141\\njmp rax"
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_bytes_disasm_hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
+                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
+                        },
+                        {
+                            "name": "thread.Ext.original_start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.",
+                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
+                        },
+                        {
+                            "name": "thread.Ext.parameter",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "When a thread is created, this is the raw numerical value of its parameter."
+                        },
+                        {
+                            "name": "thread.Ext.parameter_bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "thread.Ext.parameter_bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether parameter_bytes_compressed is present in this event."
+                        },
+                        {
+                            "name": "thread.Ext.service",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Service associated with the thread.",
+                            "example": "VaultSvc"
+                        },
+                        {
+                            "name": "thread.Ext.start",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "The time the thread started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "thread.Ext.start_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Memory address where the thread began execution.",
+                            "example": 4194304
+                        },
+                        {
+                            "name": "thread.Ext.start_address_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "thread.Ext.start_address_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.",
+                            "example": "c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
+                        },
+                        {
+                            "name": "thread.Ext.start_address_bytes_disasm",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The bytes at the thread start address, disassembled into human-readable assembly code.",
+                            "example": "ret\\nint3"
+                        },
+                        {
+                            "name": "thread.Ext.start_address_bytes_disasm_hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
+                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
+                        },
+                        {
+                            "name": "thread.Ext.start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The dll/module where the thread began execution.",
+                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
+                        },
+                        {
+                            "name": "thread.Ext.token.domain",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of token user."
+                        },
+                        {
+                            "name": "thread.Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "thread.Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "thread.Ext.token.impersonation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Impersonation level. Only valid for impersonation tokens."
+                        },
+                        {
+                            "name": "thread.Ext.token.integrity_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Numeric integrity level."
+                        },
+                        {
+                            "name": "thread.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "thread.Ext.token.is_appcontainer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not this is an appcontainer token."
+                        },
+                        {
+                            "name": "thread.Ext.token.privileges",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Array describing the privileges associated with the token."
+                        },
+                        {
+                            "name": "thread.Ext.token.privileges.description",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Description of the privilege."
+                        },
+                        {
+                            "name": "thread.Ext.token.privileges.enabled",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the privilege is enabled."
+                        },
+                        {
+                            "name": "thread.Ext.token.privileges.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the privilege."
+                        },
+                        {
+                            "name": "thread.Ext.token.sid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Token user's Security Identifier (SID)."
+                        },
+                        {
+                            "name": "thread.Ext.token.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the token, either primary or impersonation."
+                        },
+                        {
+                            "name": "thread.Ext.token.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of token owner."
+                        },
+                        {
+                            "name": "thread.Ext.uptime",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Seconds since thread started."
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "title",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "working_directory",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "registry",
+                    "title": "Registry",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to Windows Registry operations.",
+                    "fields": [
+                        {
+                            "name": "data.strings",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "wildcard",
+                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
+                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path, including hive, key and value",
+                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
+                        },
+                        {
+                            "name": "value",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the value written.",
+                            "example": "Debugger"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "rule",
+                    "title": "Rule",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.",
+                    "fields": [
+                        {
+                            "name": "author",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.",
+                            "example": "[\"Star-Lord\"]"
+                        },
+                        {
+                            "name": "category",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A categorization value keyword used by the entity using the rule for detection of this event.",
+                            "example": "Attempted Information Leak"
+                        },
+                        {
+                            "name": "description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The description of the rule generating the event.",
+                            "example": "Block requests to public DNS over HTTPS / TLS protocols"
+                        },
+                        {
+                            "name": "id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
+                            "example": 101
+                        },
+                        {
+                            "name": "license",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the license under which the rule used to generate this event is made available.",
+                            "example": "Apache 2.0"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the rule or signature generating the event.",
+                            "example": "BLOCK_DNS_over_TLS"
+                        },
+                        {
+                            "name": "reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Reference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.",
+                            "example": "https://en.wikipedia.org/wiki/DNS_over_TLS"
+                        },
+                        {
+                            "name": "ruleset",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.",
+                            "example": "Standard_Protocol_Filters"
+                        },
+                        {
+                            "name": "uuid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.",
+                            "example": 1100110011
+                        },
+                        {
+                            "name": "version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version / revision of the rule being used for analysis.",
+                            "example": 1.1
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the source (IPv4 or IPv6)."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "threat",
+                    "title": "Threat",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.\nThese fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. \"impact\"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. \"endpoint denial of service\").",
+                    "fields": [
+                        {
+                            "name": "enrichments",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "A list of associated indicators objects enriching the event, and the context of that association/enrichment."
+                        },
+                        {
+                            "name": "enrichments.indicator",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Object containing associated indicators enriching the event."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy calculation of file's header and footer used to check file integrity."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.entry_modified",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.header_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.header_data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of malware_signature fieldset."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "The concatenated names of all yara signatures"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Malware artifact identifier."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of bytes representing yara signature matches"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature sha256."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature id."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature name."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of malware signature matches"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature version."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.monotonic_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "File event monotonic ID."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Original file information during a modification event."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.gid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.group",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.mode",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file mode prior to a modification event"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file name prior to a modification event"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.owner",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to a modification event"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.original.uid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.quarantine_message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Message describing quarantine results."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.quarantine_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint the quarantined file was originally."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.quarantine_result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean representing whether or not file quarantine succeeded."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.temp_file_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.windows",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Platform-specific Windows fields"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.Ext.windows.zone_identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Windows zone identifier for a file"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.accessed",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.attributes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
+                            "example": "[\"readonly\", \"system\"]"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.created",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "File creation time.\nNote that not all filesystems store the creation time."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.ctime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.device",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device that is the source of the file.",
+                            "example": "sda"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.drive_letter",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1,
+                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
+                            "example": "C"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Machine architecture of the ELF file.",
+                            "example": "x86-64"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.byte_order",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Byte sequence of ELF file.",
+                            "example": "Little Endian"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.cpu_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU type of the ELF file.",
+                            "example": "Intel"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.creation_date",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.exports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of exported element names and types."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.abi_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the ELF Application Binary Interface (ABI)."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.class",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Header class of the ELF file."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.data",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Data table of the ELF header."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.entrypoint",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Header entrypoint of the ELF file.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.object_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "\"0x1\" for original ELF files."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.os_abi",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Application Binary Interface (ABI) of the Linux OS."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Header type of the ELF file."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.header.version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the ELF header."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.chi2",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Chi-square probability distribution of the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.flags",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List flags."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List name."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.physical_offset",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List offset."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List type."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.virtual_address",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List virtual address.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List virtual size.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.segments",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.segments.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF object segment sections."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.segments.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF object segment type."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.shared_libraries",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of shared libraries used by this ELF object."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.elf.telfhash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "telfhash symbol hash for ELF file."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.extension",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.gid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.group",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.inode",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Inode representing the file in the filesystem.",
+                            "example": "256383"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.mime_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.mode",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode of the file in octal representation.",
+                            "example": "0640"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.mtime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file content was modified."
+                        },
+                        {
+                            "name": "enrichments.indicator.file.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.owner",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
+                            "example": 16384
+                        },
+                        {
+                            "name": "enrichments.indicator.file.target_path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Target path for symlinks.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "enrichments.indicator.file.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File type (file, dir, or symlink).",
+                            "example": "file"
+                        },
+                        {
+                            "name": "enrichments.indicator.file.uid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "enrichments.indicator.first_seen",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source first reported sighting this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.city_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.continent_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.country_iso_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.country_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.location",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.region_iso_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.region_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "enrichments.indicator.geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "enrichments.indicator.ip",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "ip",
+                            "description": "Identifies a threat indicator as an IP address (irrespective of direction).",
+                            "example": "1.2.3.4"
+                        },
+                        {
+                            "name": "enrichments.indicator.last_seen",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source last reported sighting this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.marking.tlp",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Traffic Light Protocol sharing markings.",
+                            "example": "CLEAR"
+                        },
+                        {
+                            "name": "enrichments.indicator.modified_at",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source last modified information for this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.port",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Identifies a threat indicator as a port number (irrespective of direction).",
+                            "example": 443
+                        },
+                        {
+                            "name": "enrichments.indicator.provider",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the indicator's provider.",
+                            "example": "lrz_urlhaus"
+                        },
+                        {
+                            "name": "enrichments.indicator.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Reference URL linking to additional information about this indicator.",
+                            "example": "https://system.example.com/indicator/0001234"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.data.bytes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
+                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.data.strings",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "wildcard",
+                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
+                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.data.type",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Standard registry type for encoding contents",
+                            "example": "REG_SZ"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.hive",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Abbreviated name for the hive.",
+                            "example": "HKLM"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.key",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hive-relative path of keys.",
+                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.path",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path, including hive, key and value",
+                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
+                        },
+                        {
+                            "name": "enrichments.indicator.registry.value",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the value written.",
+                            "example": "Debugger"
+                        },
+                        {
+                            "name": "enrichments.indicator.scanner_stats",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Count of AV/EDR vendors that successfully detected malicious file or URL.",
+                            "example": 4
+                        },
+                        {
+                            "name": "enrichments.indicator.sightings",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Number of times this indicator was observed conducting threat activity.",
+                            "example": 20
+                        },
+                        {
+                            "name": "enrichments.indicator.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of indicator as represented by Cyber Observable in STIX 2.0.",
+                            "example": "ipv4-addr"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.",
+                            "example": "www.elastic.co"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.extension",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.fragment",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
+                        },
+                        {
+                            "name": "enrichments.indicator.url.full",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.original",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.password",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Password of the request."
+                        },
+                        {
+                            "name": "enrichments.indicator.url.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Path of the request, such as \"/search\"."
+                        },
+                        {
+                            "name": "enrichments.indicator.url.port",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Port of the request, such as 443.",
+                            "example": 443,
+                            "format": "string"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.query",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
+                        },
+                        {
+                            "name": "enrichments.indicator.url.registered_domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.scheme",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme.",
+                            "example": "https"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.subdomain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
+                            "example": "east"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.top_level_domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        },
+                        {
+                            "name": "enrichments.indicator.url.username",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of the request."
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.alternative_names",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.",
+                            "example": "*.elastic.co"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.common_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of common name (CN) of issuing certificate authority.",
+                            "example": "Example SHA2 High Assurance Server CA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.country",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of country \\(C) codes",
+                            "example": "US"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.distinguished_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguished name (DN) of issuing certificate authority.",
+                            "example": "C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.locality",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of locality names (L)",
+                            "example": "Mountain View"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.organization",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizations (O) of issuing certificate authority.",
+                            "example": "Example Inc"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.organizational_unit",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizational units (OU) of issuing certificate authority.",
+                            "example": "www.example.com"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.issuer.state_or_province",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of state or province names (ST, S, or P)",
+                            "example": "California"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.not_after",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Time at which the certificate is no longer considered valid.",
+                            "example": "2020-07-16T03:15:39Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.not_before",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Time at which the certificate is first considered valid.",
+                            "example": "2019-08-16T01:40:25Z"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.public_key_algorithm",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Algorithm used to generate the public key.",
+                            "example": "RSA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.public_key_curve",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The curve used by the elliptic curve public key algorithm. This is algorithm specific.",
+                            "example": "nistp521"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.public_key_exponent",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Exponent used to derive the public key. This is algorithm specific.",
+                            "example": 65537,
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.public_key_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The size of the public key space in bits.",
+                            "example": 2048
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.serial_number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.",
+                            "example": "55FBB9C7DEBF09809D12CCAA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.signature_algorithm",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.",
+                            "example": "SHA256-RSA"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.common_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of common names (CN) of subject.",
+                            "example": "shared.global.example.net"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.country",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of country \\(C) code",
+                            "example": "US"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.distinguished_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguished name (DN) of the certificate subject entity.",
+                            "example": "C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.locality",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of locality names (L)",
+                            "example": "San Francisco"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.organization",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizations (O) of subject.",
+                            "example": "Example, Inc."
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.organizational_unit",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizational units (OU) of subject."
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.subject.state_or_province",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of state or province names (ST, S, or P)",
+                            "example": "California"
+                        },
+                        {
+                            "name": "enrichments.indicator.x509.version_number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of x509 format.",
+                            "example": 3
+                        },
+                        {
+                            "name": "enrichments.matched.atomic",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the atomic indicator value that matched a local environment endpoint or network event.",
+                            "example": "bad-domain.com"
+                        },
+                        {
+                            "name": "enrichments.matched.field",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the field of the atomic indicator that matched a local environment endpoint or network event.",
+                            "example": "file.hash.sha256"
+                        },
+                        {
+                            "name": "enrichments.matched.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the _id of the indicator document enriching the event.",
+                            "example": "ff93aee5-86a1-4a61-b0e6-0cdc313d01b5"
+                        },
+                        {
+                            "name": "enrichments.matched.index",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the _index of the indicator document enriching the event.",
+                            "example": "filebeat-8.0.0-2021.05.23-000011"
+                        },
+                        {
+                            "name": "enrichments.matched.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the type of match that caused the event to be enriched with the given indicator",
+                            "example": "indicator_match_rule"
+                        },
+                        {
+                            "name": "framework",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.",
+                            "example": "MITRE ATT&CK"
+                        },
+                        {
+                            "name": "group.alias",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group alias(es).",
+                            "example": "[ \"Magecart Group 6\" ]"
+                        },
+                        {
+                            "name": "group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group id.",
+                            "example": "G0037"
+                        },
+                        {
+                            "name": "group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group name.",
+                            "example": "FIN6"
+                        },
+                        {
+                            "name": "group.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group reference URL.",
+                            "example": "https://attack.mitre.org/groups/G0037/"
+                        },
+                        {
+                            "name": "indicator.as.number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
+                            "example": 15169
+                        },
+                        {
+                            "name": "indicator.as.organization.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Organization name.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "Google LLC"
+                        },
+                        {
+                            "name": "indicator.confidence",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.",
+                            "example": "Medium"
+                        },
+                        {
+                            "name": "indicator.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Describes the type of action conducted by the threat.",
+                            "example": "IP x.x.x.x was observed delivering the Angler EK."
+                        },
+                        {
+                            "name": "indicator.email.address",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifies a threat indicator as an email address (irrespective of direction).",
+                            "example": "phish@example.com"
+                        },
+                        {
+                            "name": "indicator.file.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "indicator.file.Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "indicator.file.Ext.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy calculation of file's header and footer used to check file integrity."
+                        },
+                        {
+                            "name": "indicator.file.Ext.entry_modified",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
+                        },
+                        {
+                            "name": "indicator.file.Ext.header_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "indicator.file.Ext.header_data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.features.data.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.features.data.decompressed_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "integer",
+                            "description": "The decompressed size of buffer."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.features.data.encoding",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The encoding of buffer (e.g. zlib)."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The model's unique identifier."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.score",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score produced by the classification model."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.threshold",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.upx_packed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether UPX packing was detected."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_classification.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The version of the model used."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of malware_signature fieldset."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "The concatenated names of all yara signatures"
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Malware artifact identifier."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of bytes representing yara signature matches"
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature hash."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature sha256."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature id."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature name."
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of malware signature matches"
+                        },
+                        {
+                            "name": "indicator.file.Ext.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature version."
+                        },
+                        {
+                            "name": "indicator.file.Ext.monotonic_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "File event monotonic ID."
+                        },
+                        {
+                            "name": "indicator.file.Ext.original",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Original file information during a modification event."
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.gid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.group",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.mode",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file mode prior to a modification event"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file name prior to a modification event"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.owner",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to a modification event"
+                        },
+                        {
+                            "name": "indicator.file.Ext.original.uid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "indicator.file.Ext.quarantine_message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Message describing quarantine results."
+                        },
+                        {
+                            "name": "indicator.file.Ext.quarantine_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint the quarantined file was originally."
+                        },
+                        {
+                            "name": "indicator.file.Ext.quarantine_result",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean representing whether or not file quarantine succeeded."
+                        },
+                        {
+                            "name": "indicator.file.Ext.temp_file_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
+                        },
+                        {
+                            "name": "indicator.file.Ext.windows",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Platform-specific Windows fields"
+                        },
+                        {
+                            "name": "indicator.file.Ext.windows.zone_identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Windows zone identifier for a file"
+                        },
+                        {
+                            "name": "indicator.file.accessed",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+                        },
+                        {
+                            "name": "indicator.file.attributes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
+                            "example": "[\"readonly\", \"system\"]"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "indicator.file.created",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "File creation time.\nNote that not all filesystems store the creation time."
+                        },
+                        {
+                            "name": "indicator.file.ctime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+                        },
+                        {
+                            "name": "indicator.file.device",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device that is the source of the file.",
+                            "example": "sda"
+                        },
+                        {
+                            "name": "indicator.file.directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "indicator.file.drive_letter",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1,
+                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
+                            "example": "C"
+                        },
+                        {
+                            "name": "indicator.file.elf.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Machine architecture of the ELF file.",
+                            "example": "x86-64"
+                        },
+                        {
+                            "name": "indicator.file.elf.byte_order",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Byte sequence of ELF file.",
+                            "example": "Little Endian"
+                        },
+                        {
+                            "name": "indicator.file.elf.cpu_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU type of the ELF file.",
+                            "example": "Intel"
+                        },
+                        {
+                            "name": "indicator.file.elf.creation_date",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
+                        },
+                        {
+                            "name": "indicator.file.elf.exports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of exported element names and types."
+                        },
+                        {
+                            "name": "indicator.file.elf.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "indicator.file.elf.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "indicator.file.elf.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.abi_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the ELF Application Binary Interface (ABI)."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.class",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Header class of the ELF file."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.data",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Data table of the ELF header."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.entrypoint",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Header entrypoint of the ELF file.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "indicator.file.elf.header.object_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "\"0x1\" for original ELF files."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.os_abi",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Application Binary Interface (ABI) of the Linux OS."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Header type of the ELF file."
+                        },
+                        {
+                            "name": "indicator.file.elf.header.version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the ELF header."
+                        },
+                        {
+                            "name": "indicator.file.elf.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "indicator.file.elf.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "indicator.file.elf.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.chi2",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Chi-square probability distribution of the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.flags",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List flags."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List name."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.physical_offset",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List offset."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF Section List type."
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.virtual_address",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List virtual address.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "indicator.file.elf.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "ELF Section List virtual size.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "indicator.file.elf.segments",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
+                        },
+                        {
+                            "name": "indicator.file.elf.segments.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF object segment sections."
+                        },
+                        {
+                            "name": "indicator.file.elf.segments.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ELF object segment type."
+                        },
+                        {
+                            "name": "indicator.file.elf.shared_libraries",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of shared libraries used by this ELF object."
+                        },
+                        {
+                            "name": "indicator.file.elf.telfhash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "telfhash symbol hash for ELF file."
+                        },
+                        {
+                            "name": "indicator.file.extension",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "indicator.file.gid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "indicator.file.group",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "indicator.file.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "indicator.file.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "indicator.file.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "indicator.file.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "indicator.file.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "indicator.file.inode",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Inode representing the file in the filesystem.",
+                            "example": "256383"
+                        },
+                        {
+                            "name": "indicator.file.mime_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+                        },
+                        {
+                            "name": "indicator.file.mode",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode of the file in octal representation.",
+                            "example": "0640"
+                        },
+                        {
+                            "name": "indicator.file.mtime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file content was modified."
+                        },
+                        {
+                            "name": "indicator.file.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "indicator.file.owner",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "indicator.file.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "indicator.file.pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "indicator.file.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "indicator.file.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "indicator.file.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "indicator.file.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "indicator.file.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "indicator.file.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "indicator.file.size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
+                            "example": 16384
+                        },
+                        {
+                            "name": "indicator.file.target_path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Target path for symlinks.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "indicator.file.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File type (file, dir, or symlink).",
+                            "example": "file"
+                        },
+                        {
+                            "name": "indicator.file.uid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "indicator.first_seen",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source first reported sighting this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "indicator.geo.city_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "indicator.geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "indicator.geo.continent_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "indicator.geo.country_iso_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "indicator.geo.country_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "indicator.geo.location",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "indicator.geo.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "indicator.geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "indicator.geo.region_iso_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "indicator.geo.region_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "indicator.geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "indicator.ip",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "ip",
+                            "description": "Identifies a threat indicator as an IP address (irrespective of direction).",
+                            "example": "1.2.3.4"
+                        },
+                        {
+                            "name": "indicator.last_seen",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source last reported sighting this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "indicator.marking.tlp",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Traffic Light Protocol sharing markings.",
+                            "example": "CLEAR"
+                        },
+                        {
+                            "name": "indicator.modified_at",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The date and time when intelligence source last modified information for this indicator.",
+                            "example": "2020-11-05T17:25:47.000Z"
+                        },
+                        {
+                            "name": "indicator.port",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Identifies a threat indicator as a port number (irrespective of direction).",
+                            "example": 443
+                        },
+                        {
+                            "name": "indicator.provider",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the indicator's provider.",
+                            "example": "lrz_urlhaus"
+                        },
+                        {
+                            "name": "indicator.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Reference URL linking to additional information about this indicator.",
+                            "example": "https://system.example.com/indicator/0001234"
+                        },
+                        {
+                            "name": "indicator.registry.data.bytes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
+                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
+                        },
+                        {
+                            "name": "indicator.registry.data.strings",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "wildcard",
+                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
+                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
+                        },
+                        {
+                            "name": "indicator.registry.data.type",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Standard registry type for encoding contents",
+                            "example": "REG_SZ"
+                        },
+                        {
+                            "name": "indicator.registry.hive",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Abbreviated name for the hive.",
+                            "example": "HKLM"
+                        },
+                        {
+                            "name": "indicator.registry.key",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hive-relative path of keys.",
+                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
+                        },
+                        {
+                            "name": "indicator.registry.path",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path, including hive, key and value",
+                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
+                        },
+                        {
+                            "name": "indicator.registry.value",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the value written.",
+                            "example": "Debugger"
+                        },
+                        {
+                            "name": "indicator.scanner_stats",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Count of AV/EDR vendors that successfully detected malicious file or URL.",
+                            "example": 4
+                        },
+                        {
+                            "name": "indicator.sightings",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Number of times this indicator was observed conducting threat activity.",
+                            "example": 20
+                        },
+                        {
+                            "name": "indicator.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of indicator as represented by Cyber Observable in STIX 2.0.",
+                            "example": "ipv4-addr"
+                        },
+                        {
+                            "name": "indicator.url.domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.",
+                            "example": "www.elastic.co"
+                        },
+                        {
+                            "name": "indicator.url.extension",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "indicator.url.fragment",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
+                        },
+                        {
+                            "name": "indicator.url.full",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top"
+                        },
+                        {
+                            "name": "indicator.url.original",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch"
+                        },
+                        {
+                            "name": "indicator.url.password",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Password of the request."
+                        },
+                        {
+                            "name": "indicator.url.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Path of the request, such as \"/search\"."
+                        },
+                        {
+                            "name": "indicator.url.port",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Port of the request, such as 443.",
+                            "example": 443,
+                            "format": "string"
+                        },
+                        {
+                            "name": "indicator.url.query",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
+                        },
+                        {
+                            "name": "indicator.url.registered_domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "indicator.url.scheme",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme.",
+                            "example": "https"
+                        },
+                        {
+                            "name": "indicator.url.subdomain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
+                            "example": "east"
+                        },
+                        {
+                            "name": "indicator.url.top_level_domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        },
+                        {
+                            "name": "indicator.url.username",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Username of the request."
+                        },
+                        {
+                            "name": "indicator.x509.alternative_names",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.",
+                            "example": "*.elastic.co"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.common_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of common name (CN) of issuing certificate authority.",
+                            "example": "Example SHA2 High Assurance Server CA"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.country",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of country \\(C) codes",
+                            "example": "US"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.distinguished_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguished name (DN) of issuing certificate authority.",
+                            "example": "C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.locality",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of locality names (L)",
+                            "example": "Mountain View"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.organization",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizations (O) of issuing certificate authority.",
+                            "example": "Example Inc"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.organizational_unit",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizational units (OU) of issuing certificate authority.",
+                            "example": "www.example.com"
+                        },
+                        {
+                            "name": "indicator.x509.issuer.state_or_province",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of state or province names (ST, S, or P)",
+                            "example": "California"
+                        },
+                        {
+                            "name": "indicator.x509.not_after",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Time at which the certificate is no longer considered valid.",
+                            "example": "2020-07-16T03:15:39Z"
+                        },
+                        {
+                            "name": "indicator.x509.not_before",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Time at which the certificate is first considered valid.",
+                            "example": "2019-08-16T01:40:25Z"
+                        },
+                        {
+                            "name": "indicator.x509.public_key_algorithm",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Algorithm used to generate the public key.",
+                            "example": "RSA"
+                        },
+                        {
+                            "name": "indicator.x509.public_key_curve",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The curve used by the elliptic curve public key algorithm. This is algorithm specific.",
+                            "example": "nistp521"
+                        },
+                        {
+                            "name": "indicator.x509.public_key_exponent",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Exponent used to derive the public key. This is algorithm specific.",
+                            "example": 65537,
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "indicator.x509.public_key_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The size of the public key space in bits.",
+                            "example": 2048
+                        },
+                        {
+                            "name": "indicator.x509.serial_number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.",
+                            "example": "55FBB9C7DEBF09809D12CCAA"
+                        },
+                        {
+                            "name": "indicator.x509.signature_algorithm",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.",
+                            "example": "SHA256-RSA"
+                        },
+                        {
+                            "name": "indicator.x509.subject.common_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of common names (CN) of subject.",
+                            "example": "shared.global.example.net"
+                        },
+                        {
+                            "name": "indicator.x509.subject.country",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of country \\(C) code",
+                            "example": "US"
+                        },
+                        {
+                            "name": "indicator.x509.subject.distinguished_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguished name (DN) of the certificate subject entity.",
+                            "example": "C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net"
+                        },
+                        {
+                            "name": "indicator.x509.subject.locality",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of locality names (L)",
+                            "example": "San Francisco"
+                        },
+                        {
+                            "name": "indicator.x509.subject.organization",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizations (O) of subject.",
+                            "example": "Example, Inc."
+                        },
+                        {
+                            "name": "indicator.x509.subject.organizational_unit",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of organizational units (OU) of subject."
+                        },
+                        {
+                            "name": "indicator.x509.subject.state_or_province",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of state or province names (ST, S, or P)",
+                            "example": "California"
+                        },
+                        {
+                            "name": "indicator.x509.version_number",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of x509 format.",
+                            "example": 3
+                        },
+                        {
+                            "name": "software.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software id.",
+                            "example": "S0552"
+                        },
+                        {
+                            "name": "software.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software name.",
+                            "example": "AdFind"
+                        },
+                        {
+                            "name": "software.platforms",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use MITRE ATT&CK® software platform values.",
+                            "example": "[ \"Windows\" ]"
+                        },
+                        {
+                            "name": "software.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software reference URL.",
+                            "example": "https://attack.mitre.org/software/S0552/"
+                        },
+                        {
+                            "name": "software.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software type.",
+                            "example": "Tool"
+                        },
+                        {
+                            "name": "tactic.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )",
+                            "example": "TA0002"
+                        },
+                        {
+                            "name": "tactic.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)",
+                            "example": "Execution"
+                        },
+                        {
+                            "name": "tactic.reference",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )",
+                            "example": "https://attack.mitre.org/tactics/TA0002/"
+                        },
+                        {
+                            "name": "technique.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
+                            "example": "T1059"
+                        },
+                        {
+                            "name": "technique.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Command and Scripting Interpreter"
+                        },
+                        {
+                            "name": "technique.reference",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
+                            "example": "https://attack.mitre.org/techniques/T1059/"
+                        },
+                        {
+                            "name": "technique.subtechnique.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
+                            "example": "T1059.001"
+                        },
+                        {
+                            "name": "technique.subtechnique.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "PowerShell"
+                        },
+                        {
+                            "name": "technique.subtechnique.reference",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
+                            "example": "https://attack.mitre.org/techniques/T1059/001/"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "build": {
+                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+                    },
+                    "id": "2b1eb7f7-bd61-436a-98af-c2b182043476",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "container": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "image": {
+                        "name": "docker.io/library/nginx",
+                        "tag": "latest"
+                    },
+                    "name": "nginx"
+                },
+                "cloud": {
+                    "account": {
+                        "id": "1234"
+                    },
+                    "instance": {
+                        "name": "webserver-12"
+                    },
+                    "project": {
+                        "id": "1234"
+                    },
+                    "provider": "aws",
+                    "region": "us-east-1"
+                },
+                "orchestrator": {
+                    "cluster": {
+                        "name": "webservers"
+                    },
+                    "namespace": "webapp",
+                    "resource": {
+                        "name": "webservers",
+                        "type": "kubernetes"
+                    }
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw"
+                        ],
+                        "protection": "PsProtectedSignerWinSystem",
+                        "user": "SYSTEM",
+                        "architecture": "x86_64",
+                        "token": {
+                            "elevation": true,
+                            "integrity_level_name": "system",
+                            "domain": "NT AUTHORITY",
+                            "user": "SYSTEM",
+                            "elevation_type": "default",
+                            "sid": "S-1-5-18"
+                        },
+                        "memory_region": {
+                            "region_size": 4096,
+                            "region_protection": "RWX",
+                            "allocation_base": 2401471234048,
+                            "allocation_type": "PRIVATE",
+                            "bytes_allocation_offset": 0,
+                            "region_state": "COMMIT",
+                            "bytes_compressed_present": false,
+                            "region_start_bytes": "58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124",
+                            "allocation_protection": "RW-",
+                            "region_base": 2401471238144,
+                            "allocation_size": 8192,
+                            "bytes_address": 2401471234048
+                        }
+                    },
+                    "parent": {
+                        "Ext": {
+                            "protection": "",
+                            "user": "",
+                            "architecture": "unknown"
+                        },
+                        "name": "System Idle Process",
+                        "start": "2022-04-04T12:15:41.4606245Z",
+                        "pid": 0,
+                        "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
+                        "command_line": "",
+                        "executable": "",
+                        "ppid": 0,
+                        "uptime": 822
+                    },
+                    "pe": {},
+                    "name": "System",
+                    "start": "2022-04-04T12:15:41.4606245Z",
+                    "pid": 4,
+                    "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTQtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
+                    "command_line": "",
+                    "executable": "",
+                    "thread": {
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "instruction_pointer": 140705188471348,
+                                    "memory_section": {
+                                        "memory_address": 140705187827712,
+                                        "memory_size": 1163264,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "ntdll.dll",
+                                    "module_path": "c:\\windows\\system32\\ntdll.dll",
+                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!NtAlpcSendWaitReceivePort+0x14"
+                                },
+                                {
+                                    "instruction_pointer": 140705158956066,
+                                    "memory_section": {
+                                        "memory_address": 140705158664192,
+                                        "memory_size": 921600,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "rpcrt4.dll",
+                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879048422"
+                                },
+                                {
+                                    "instruction_pointer": 140705158944113,
+                                    "memory_section": {
+                                        "memory_address": 140705158664192,
+                                        "memory_size": 921600,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "rpcrt4.dll",
+                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879045571"
+                                },
+                                {
+                                    "instruction_pointer": 140705158854463,
+                                    "memory_section": {
+                                        "memory_address": 140705158664192,
+                                        "memory_size": 921600,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "rpcrt4.dll",
+                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF87902F73F"
+                                },
+                                {
+                                    "instruction_pointer": 140705155101013,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9B155"
+                                },
+                                {
+                                    "instruction_pointer": 140705155097096,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9A208"
+                                },
+                                {
+                                    "instruction_pointer": 140705155090820,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C98984"
+                                },
+                                {
+                                    "instruction_pointer": 140705155093243,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C992FB"
+                                },
+                                {
+                                    "instruction_pointer": 140705155073556,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C94614"
+                                },
+                                {
+                                    "instruction_pointer": 140705155277630,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC633E"
+                                },
+                                {
+                                    "instruction_pointer": 140705158666224,
+                                    "memory_section": {
+                                        "memory_address": 140705158664192,
+                                        "memory_size": 921600,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "rpcrt4.dll",
+                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF8790017F0"
+                                },
+                                {
+                                    "instruction_pointer": 140705155255496,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC0CC8"
+                                },
+                                {
+                                    "instruction_pointer": 140705155775858,
+                                    "memory_section": {
+                                        "memory_address": 140705154535424,
+                                        "memory_size": 2334720,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "combase.dll",
+                                    "module_path": "c:\\windows\\system32\\combase.dll",
+                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878D3FD72"
+                                },
+                                {
+                                    "instruction_pointer": 140704876148243,
+                                    "memory_section": {
+                                        "memory_address": 140704875483136,
+                                        "memory_size": 708608,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "fastprox.dll",
+                                    "module_path": "c:\\windows\\system32\\wbem\\fastprox.dll",
+                                    "symbol_info": "c:\\windows\\system32\\wbem\\fastprox.dll!0x7FF868293613"
+                                },
+                                {
+                                    "instruction_pointer": 140699640718787,
+                                    "memory_section": {
+                                        "memory_address": 140699634241536,
+                                        "memory_size": 9220096,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "alertstests.exe",
+                                    "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
+                                    "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301AE5C3"
+                                },
+                                {
+                                    "instruction_pointer": 140699640807495,
+                                    "memory_section": {
+                                        "memory_address": 140699634241536,
+                                        "memory_size": 9220096,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "alertstests.exe",
+                                    "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
+                                    "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301C4047"
+                                },
+                                {
+                                    "instruction_pointer": 140705160001044,
+                                    "memory_section": {
+                                        "memory_address": 140705159909376,
+                                        "memory_size": 520192,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "kernel32.dll",
+                                    "module_path": "c:\\windows\\system32\\kernel32.dll",
+                                    "symbol_info": "c:\\windows\\system32\\kernel32.dll!BaseThreadInitThunk+0x14"
+                                },
+                                {
+                                    "instruction_pointer": 140705188161185,
+                                    "memory_section": {
+                                        "memory_address": 140705187827712,
+                                        "memory_size": 1163264,
+                                        "protection": "R-X"
+                                    },
+                                    "module_name": "ntdll.dll",
+                                    "module_path": "c:\\windows\\system32\\ntdll.dll",
+                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                }
+                            ],
+                            "call_stack_final_hook_module": {
+                                "code_signature": [
+                                    {
+                                        "exists": true,
+                                        "status": "trusted",
+                                        "subject_name": "Microsoft Corporation",
+                                        "trusted": true
+                                    }
+                                ],
+                                "hash": {
+                                    "sha256": "e5bfc1a2967fa513177a0327770927d9a2efa5a4f33ac18f716bae7c3f857994"
+                                },
+                                "path": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\131.0.2903.112\\msedge_elf.dll"
+                            },
+                            "call_stack_final_user_module": {
+                                "code_signature": [
+                                    {
+                                        "exists": true,
+                                        "status": "trusted",
+                                        "subject_name": "Microsoft Windows",
+                                        "trusted": true
+                                    }
+                                ],
+                                "hash": {
+                                    "sha256": "8c9740e7fe9c97d5782b8d3db102c7880c40f0b27f20d3ec9f334fe0161b7e55"
+                                },
+                                "name": "rpcrt4.dll",
+                                "path": "c:\\windows\\system32\\rpcrt4.dll"
+                            },
+                            "call_stack_summary": "ntdll.dll, rpcrt4.dll, combase.dll, rpcrt4.dll, combase.dll, fastprox.dll, alertstests.exe, kernel32.dll, ntdll.dll",
+                            "hardware_breakpoint_set": true,
+                            "start_address": 140699640807104,
+                            "start_address_module": "C:\\Users\\vagrant\\endpoint-dev\\Build\\_WS-vs2019-x64-dbg\\AlertsTests\\Debug\\AlertsTests.exe"
+                        },
+                        "id": 5752
+                    },
+                    "uptime": 822
+                },
+                "rule": {
+                    "ruleset": "production"
+                },
+                "message": "Malware Prevention Alert",
+                "@timestamp": "2022-04-04T12:15:41.5944062Z",
+                "file": {
+                    "Ext": {
+                        "temp_file_path": "C:\\Windows\\TEMP\\90edbe42-fe6c-4965-8a6b-222aa2b15cf2",
+                        "code_signature": [
+                            {
+                                "exists": false
+                            }
+                        ],
+                        "quarantine_path": "C:\\.equarantine\\20a65f043449c96f10e538a860a415b55ff46c93",
+                        "quarantine_message": "Success",
+                        "quarantine_result": true,
+                        "malware_classification": {
+                            "identifier": "endpointpe-v4-model",
+                            "score": 0.692318737506866,
+                            "threshold": 0.58,
+                            "version": "4.0.19000"
+                        }
+                    },
+                    "owner": "Administrators",
+                    "extension": "dll",
+                    "drive_letter": "C",
+                    "created": "2022-04-04T12:15:41.4606245Z",
+                    "accessed": "2022-04-04T12:15:41.4606245Z",
+                    "mtime": "2022-04-04T12:15:41.4606245Z",
+                    "directory": "C:\\sysmon",
+                    "path": "C:\\sysmon\\9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
+                    "code_signature": {
+                        "exists": false
+                    },
+                    "size": 4608,
+                    "pe": {
+                        "file_version": "0.0.0.0",
+                        "description": " ",
+                        "original_file_name": "5t5mpwxc.dll",
+                        "Ext": {
+                            "dotnet": true,
+                            "streams": [
+                                {
+                                    "name": "#~",
+                                    "hash": {
+                                        "md5": "debf08c09d49337fbe7acde4d3749242",
+                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
+                                    }
+                                },
+                                {
+                                    "name": "#Blob",
+                                    "hash": {
+                                        "md5": "debf08c09d49337fbe7acde4d3749242",
+                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
+                                    }
+                                }
+                            ],
+                            "sections": [
+                                {
+                                    "name": ".reloc",
+                                    "hash": {
+                                        "md5": "debf08c09d49337fbe7acde4d3749242",
+                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
+                                    }
+                                }
+                            ]
+                        }
+                    },
+                    "name": "9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
+                    "hash": {
+                        "sha1": "9c0e42a47d34240a9a4101cc5d3bc5787dc5ad73",
+                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53",
+                        "md5": "debf08c09d49337fbe7acde4d3749242"
+                    }
+                },
+                "Endpoint": {
+                    "policy": {
+                        "applied": {
+                            "artifacts": {
+                                "global": {
+                                    "identifiers": [
+                                        {
+                                            "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
+                                            "name": "diagnostic-configuration-v1"
+                                        },
+                                        {
+                                            "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
+                                            "name": "diagnostic-endpointpe-v4-blocklist"
+                                        },
+                                        {
+                                            "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
+                                            "name": "diagnostic-endpointpe-v4-exceptionlist"
+                                        },
+                                        {
+                                            "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
+                                            "name": "diagnostic-endpointpe-v4-model"
+                                        },
+                                        {
+                                            "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
+                                            "name": "diagnostic-malware-signature-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
+                                            "name": "diagnostic-ransomware-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
+                                            "name": "diagnostic-rules-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
+                                            "name": "endpointpe-v4-blocklist"
+                                        },
+                                        {
+                                            "sha256": "d784c2aa70a2216dd5bfeecfdd67a83ff5b656e9321bd70cf345a8667a63fb2e",
+                                            "name": "endpointpe-v4-exceptionlist"
+                                        },
+                                        {
+                                            "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
+                                            "name": "endpointpe-v4-model"
+                                        },
+                                        {
+                                            "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
+                                            "name": "global-configuration-v1"
+                                        },
+                                        {
+                                            "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
+                                            "name": "global-exceptionlist-windows"
+                                        },
+                                        {
+                                            "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
+                                            "name": "global-trustlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
+                                            "name": "production-malware-signature-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
+                                            "name": "production-ransomware-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
+                                            "name": "production-rules-windows-v1"
+                                        }
+                                    ],
+                                    "update_age": 0,
+                                    "snapshot": "2023-09-26",
+                                    "version": "1.0.260"
+                                },
+                                "user": {
+                                    "identifiers": [
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-blocklist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-eventfilterlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-exceptionlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-hostisolationexceptionlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-trustlist-windows-v1"
+                                        }
+                                    ],
+                                    "version": "1.0.0"
+                                }
+                            }
+                        }
+                    }
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.alerts"
+                },
+                "elastic": {
+                    "agent": {
+                        "id": "2b1eb7f7-bd61-436a-98af-c2b182043476"
+                    }
+                },
+                "host": {
+                    "hostname": "security-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.34",
+                        "fe80::4850:4f4f:4b53:8103",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "security-win-1",
+                    "id": "bbea673e-eae6-4b03-8724-2183f79da331",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "severity": 73,
+                    "code": "malicious_file",
+                    "risk_score": 73,
+                    "created": "2022-04-04T12:15:41.5944062Z",
+                    "kind": "alert",
+                    "module": "endpoint",
+                    "type": [
+                        "info",
+                        "change",
+                        "denied"
+                    ],
+                    "agent_id_status": "verified",
+                    "sequence": 29414,
+                    "ingested": "2022-04-04T12:19:33Z",
+                    "action": "rename",
+                    "id": "MYfSjQEEEFe1o09b+++++D5Q",
+                    "category": [
+                        "malware",
+                        "intrusion_detection",
+                        "file"
+                    ],
+                    "dataset": "endpoint.alerts",
+                    "outcome": "success"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM"
+                },
+                "Memory_protection": {
+                    "cross_session": false,
+                    "feature": "shellcode_thread",
+                    "parent_to_child": false,
+                    "self_injection": false,
+                    "unique_key_v2": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
+                },
+                "Responses": [
+                    {
+                        "@timestamp": "2023-04-13T16:15:16.0Z",
+                        "action": {
+                            "action": "file_rollback",
+                            "file": {
+                                "attributes": [
+                                    "invalid"
+                                ],
+                                "path": "",
+                                "reason": 2147484160
+                            },
+                            "source": {
+                                "attributes": [
+                                    "archive"
+                                ],
+                                "path": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy55\\git\\endpoint-dev\\Python\\runtime\\failed_test_logs\\20230413_181248\\EndpointRollbackTestCase\\test_rollback_trigger_malware_1_prevent\\tmp\\TRA14KA5Z2\\ExceptionlistTester-Windows.1d1phoq97d"
+                            }
+                        },
+                        "message": "Successful production rollback",
+                        "result": 0
+                    },
+                    {
+                        "@timestamp": "2023-04-13T16:15:16.0Z",
+                        "action": {
+                            "action": "registry_rollback",
+                            "key": {
+                                "actions": [
+                                    "Deleted"
+                                ],
+                                "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback\\1"
+                            }
+                        },
+                        "message": "Successful production registry rollback",
+                        "result": 0
+                    },
+                    {
+                        "@timestamp": "2023-04-13T16:15:16.0Z",
+                        "action": {
+                            "action": "registry_rollback",
+                            "key": {
+                                "actions": [
+                                    "Modified"
+                                ],
+                                "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback.valuetest",
+                                "values": [
+                                    {
+                                        "actions": [
+                                            "Deleted"
+                                        ],
+                                        "name": "SomeValue"
+                                    }
+                                ]
+                            }
+                        }
+                    },
+                    {
+                        "@timestamp": "2023-07-19T14:21:05.0Z",
+                        "action": {
+                            "action": "process_rollback",
+                            "process": {
+                                "path": "C:\\Users\\Pawel Mirski\\AppData\\Local\\Programs\\Python\\Python38-32\\python.exe"
+                            }
+                        },
+                        "message": "Successful production process rollback",
+                        "result": 0
+                    }
+                ]
+            }
+        },
+        {
+            "name": "policy",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Endpoint",
+                    "title": "Endpoint",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
+                    "fields": [
+                        {
+                            "name": "configuration",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
+                        },
+                        {
+                            "name": "configuration.isolation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Configuration setting for Host Isolation from the network"
+                        },
+                        {
+                            "name": "policy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The policy fields are used to hold information about applied policy."
+                        },
+                        {
+                            "name": "policy.applied",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about the policy that is applied"
+                        },
+                        {
+                            "name": "policy.applied.actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "actions applied during the application of the policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.actions.message",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "message about the application of the action to further qualify the status of the action"
+                        },
+                        {
+                            "name": "policy.applied.actions.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "name of the action that was applied"
+                        },
+                        {
+                            "name": "policy.applied.actions.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the status of the action"
+                        },
+                        {
+                            "name": "policy.applied.artifacts",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about global protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.channel",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "global artifacts rollout channel"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "the identifiers of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of global artifact applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.identifiers.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the sha256 of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.snapshot",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the snapshot date of applied global artifacts or 'latest'"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.update_age",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "number of days since global artifacts were made up-to-date"
+                        },
+                        {
+                            "name": "policy.applied.artifacts.global.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of global artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about user protection artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "the identifiers of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of user artifact applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.identifiers.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the sha256 of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.artifacts.user.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of user artifacts applied."
+                        },
+                        {
+                            "name": "policy.applied.endpoint_policy_version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of this applied policy"
+                        },
+                        {
+                            "name": "policy.applied.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the id of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of this applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "the response of actions that failed in the applied policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.response.configurations",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "the configurations of the applied policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.antivirus_registration",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall antivirus registration configuration and status of the applied policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.antivirus_registration.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for antivirus registration"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.antivirus_registration.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.attack_surface_reduction.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for attack surface reduction"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.attack_surface_reduction.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.behavior_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for behavior_protection"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.behavior_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.events",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall event collection configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.events.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for event collection"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.events.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.host_isolation.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for host isolation"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.host_isolation.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.logging",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall logging configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.logging.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for logging"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.logging.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.malware",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall malware configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.malware.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for malware"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.malware.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.memory_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall memory_protection configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.memory_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for memory_protection"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.memory_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.ransomware.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for ransomware"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.ransomware.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.streaming",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "overall data streaming configuration and status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.streaming.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for data streaming"
+                        },
+                        {
+                            "name": "policy.applied.response.configurations.streaming.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "the diagnostic configurations of the applied policy",
+                            "enabled": false
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.behavior_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of behavior protection"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.behavior_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.credential_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of credential protection"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.credential_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of credential protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.malware.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of malware"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.malware.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.memory_protection.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of memory protection"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.memory_protection.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.memory_scan.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of memory scan"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.memory_scan.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of memory scan, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.ransomware.concerned_actions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "all actions that were taken for the diagnostic configuration of ransomware"
+                        },
+                        {
+                            "name": "policy.applied.response.diagnostic.ransomware.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+                        },
+                        {
+                            "name": "policy.applied.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the status of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the version of this applied policy"
+                        },
+                        {
+                            "name": "state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
+                        },
+                        {
+                            "name": "state.isolation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Current network isolation state of the host"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "build.original",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Extended build information for the agent.\nThis field is intended to contain any build information that a data source may provide, no specific formatting is required.",
+                            "example": "metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "build": {
+                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+                    },
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "message": "Endpoint policy change",
+                "@timestamp": "2022-04-04T18:38:15.7178887Z",
+                "Endpoint": {
+                    "configuration": {
+                        "isolation": false
+                    },
+                    "state": {
+                        "isolation": false
+                    },
+                    "policy": {
+                        "applied": {
+                            "response": {
+                                "configurations": {
+                                    "behavior_protection": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "configure_file_events",
+                                            "configure_network_events",
+                                            "configure_process_events",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "configure_imageload_events",
+                                            "configure_dns_events",
+                                            "configure_security_events",
+                                            "configure_registry_events",
+                                            "configure_malicious_behavior"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "streaming": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "configure_output",
+                                            "workflow"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "malware": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "configure_malware",
+                                            "configure_kernel",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "connect_kernel",
+                                            "configure_user_notification",
+                                            "configure_alerts",
+                                            "detect_file_open_events",
+                                            "detect_sync_image_load_events"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "logging": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "configure_logging",
+                                            "workflow"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "antivirus_registration": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "configure_antivirus_registration",
+                                            "workflow"
+                                        ],
+                                        "status": "unsupported"
+                                    },
+                                    "host_isolation": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "configure_host_isolation",
+                                            "load_config",
+                                            "workflow",
+                                            "connect_kernel",
+                                            "configure_user_notification"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "events": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "detect_network_events",
+                                            "configure_file_events",
+                                            "configure_network_events",
+                                            "configure_process_events",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "detect_file_open_events",
+                                            "detect_file_access_events",
+                                            "detect_async_image_load_events",
+                                            "detect_registry_events",
+                                            "detect_registry_access_events",
+                                            "configure_imageload_events",
+                                            "configure_dns_events",
+                                            "configure_security_events",
+                                            "configure_registry_events"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "ransomware": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "configure_process_events",
+                                            "configure_file_events",
+                                            "configure_ransomware",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "configure_user_notification"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "memory_protection": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "configure_memory_threat",
+                                            "configure_process_events",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "workflow",
+                                            "load_config",
+                                            "detect_process_events",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "detect_thread_events"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "attack_surface_reduction": {
+                                        "concerned_actions": [
+                                            "agent_connectivity",
+                                            "configure_credential_hardening",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "workflow",
+                                            "load_config",
+                                            "configure_kernel",
+                                            "connect_kernel"
+                                        ],
+                                        "status": "success"
+                                    }
+                                },
+                                "diagnostic": {
+                                    "behavior_protection": {
+                                        "concerned_actions": [
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "configure_file_events",
+                                            "configure_network_events",
+                                            "configure_process_events",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "configure_imageload_events",
+                                            "configure_dns_events",
+                                            "configure_security_events",
+                                            "configure_registry_events",
+                                            "configure_diagnostic_rollback",
+                                            "detect_process_handle_events",
+                                            "configure_diagnostic_malicious_behavior"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "malware": {
+                                        "concerned_actions": [
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "configure_diagnostic_malware",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "connect_kernel",
+                                            "configure_kernel",
+                                            "detect_file_open_events",
+                                            "detect_sync_image_load_events",
+                                            "configure_diagnostic_rollback"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "ransomware": {
+                                        "concerned_actions": [
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "detect_process_events",
+                                            "detect_file_write_events",
+                                            "configure_process_events",
+                                            "configure_file_events",
+                                            "configure_diagnostic_ransomware",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "configure_diagnostic_rollback"
+                                        ],
+                                        "status": "success"
+                                    },
+                                    "memory_protection": {
+                                        "concerned_actions": [
+                                            "load_config",
+                                            "workflow",
+                                            "download_global_artifacts",
+                                            "download_user_artifacts",
+                                            "detect_process_events",
+                                            "configure_process_events",
+                                            "configure_diagnostic_memory_threat",
+                                            "configure_kernel",
+                                            "connect_kernel",
+                                            "detect_thread_events",
+                                            "configure_diagnostic_rollback"
+                                        ],
+                                        "status": "success"
+                                    }
+                                }
+                            },
+                            "name": "endpoint-1",
+                            "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
+                            "actions": [
+                                {
+                                    "name": "configure_antivirus_registration",
+                                    "message": "Antivirus registration is not possible on servers",
+                                    "status": "unsupported"
+                                },
+                                {
+                                    "name": "configure_ransomware",
+                                    "message": "Successfully enabled ransomware prevention with mbr enabled and canaries enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_memory_threat",
+                                    "message": "Successfully enabled memory threat prevention with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_memory_threat",
+                                    "message": "Successfully enabled memory threat detection with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_host_isolation",
+                                    "message": "Host is not isolated",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_malicious_behavior",
+                                    "message": "Enabled 152 out of 152 malicious behavior rules",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_malicious_behavior",
+                                    "message": "Enabled 196 out of 196 diagnostic malicious behavior rules",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_user_notification",
+                                    "message": "Successfully configured user notification",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_malware",
+                                    "message": "Successfully enabled malware prevention",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_malware",
+                                    "message": "Successfully enabled malware detection",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_rollback",
+                                    "message": "Diagnostic system rollback is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_kernel",
+                                    "message": "Successfully configured kernel",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_output",
+                                    "message": "Successfully configured output connection",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_alerts",
+                                    "message": "Successfully configured alerts",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_logging",
+                                    "message": "Successfully configured logging",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "load_config",
+                                    "message": "Successfully parsed configuration",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "download_user_artifacts",
+                                    "message": "Successfully downloaded user artifacts",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "download_global_artifacts",
+                                    "message": "Global artifacts are available for use",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "connect_kernel",
+                                    "message": "Successfully connected to kernel",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_process_events",
+                                    "message": "Successfully started process event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_sync_image_load_events",
+                                    "message": "Successfully started sync image load event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_async_image_load_events",
+                                    "message": "Successfully started async image load event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_file_write_events",
+                                    "message": "Successfully started file write event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_file_open_events",
+                                    "message": "Successfully stopped file open event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_network_events",
+                                    "message": "Successfully started network event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_registry_events",
+                                    "message": "Successfully started registry event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_thread_events",
+                                    "message": "Successfully configured thread events",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_file_access_events",
+                                    "message": "Successfully configured file access event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_registry_access_events",
+                                    "message": "Successfully configured registry access event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "detect_process_handle_events",
+                                    "message": "Successfully started process handle event reporting",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_file_events",
+                                    "message": "Success enabling file events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_network_events",
+                                    "message": "Success enabling network events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_process_events",
+                                    "message": "Success enabling process events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_imageload_events",
+                                    "message": "Success enabling image load events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_dns_events",
+                                    "message": "Success enabling dns events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_registry_events",
+                                    "message": "Success enabling registry events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_security_events",
+                                    "message": "Success enabling security events; current state is enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_diagnostic_ransomware",
+                                    "message": "Successfully enabled ransomware detection with mbr enabled and canaries enabled",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "agent_connectivity",
+                                    "message": "Successfully connected to Agent",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "workflow",
+                                    "message": "Successfully executed all workflows",
+                                    "status": "success"
+                                },
+                                {
+                                    "name": "configure_credential_hardening",
+                                    "message": "Successfully configured credential hardening",
+                                    "status": "success"
+                                }
+                            ],
+                            "endpoint_policy_version": "1",
+                            "version": "2",
+                            "artifacts": {
+                                "global": {
+                                    "channel": "stable",
+                                    "identifiers": [
+                                        {
+                                            "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
+                                            "name": "diagnostic-configuration-v1"
+                                        },
+                                        {
+                                            "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
+                                            "name": "diagnostic-endpointpe-v4-blocklist"
+                                        },
+                                        {
+                                            "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
+                                            "name": "diagnostic-endpointpe-v4-exceptionlist"
+                                        },
+                                        {
+                                            "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
+                                            "name": "diagnostic-endpointpe-v4-model"
+                                        },
+                                        {
+                                            "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
+                                            "name": "diagnostic-malware-signature-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
+                                            "name": "diagnostic-ransomware-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
+                                            "name": "diagnostic-rules-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
+                                            "name": "endpointpe-v4-blocklist"
+                                        },
+                                        {
+                                            "sha256": "b49fdcd8bf63af07ab1e74352137eb20f1e3710640dfcb1bfff3f7273ee14a7f",
+                                            "name": "endpointpe-v4-exceptionlist"
+                                        },
+                                        {
+                                            "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
+                                            "name": "endpointpe-v4-model"
+                                        },
+                                        {
+                                            "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
+                                            "name": "global-configuration-v1"
+                                        },
+                                        {
+                                            "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
+                                            "name": "global-exceptionlist-windows"
+                                        },
+                                        {
+                                            "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
+                                            "name": "global-trustlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
+                                            "name": "production-malware-signature-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
+                                            "name": "production-ransomware-v1-windows"
+                                        },
+                                        {
+                                            "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
+                                            "name": "production-rules-windows-v1"
+                                        }
+                                    ],
+                                    "update_age": 0,
+                                    "snapshot": "2023-09-26",
+                                    "version": "1.0.261"
+                                },
+                                "user": {
+                                    "identifiers": [
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-blocklist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-eventfilterlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-exceptionlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-hostisolationexceptionlist-windows-v1"
+                                        },
+                                        {
+                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                            "name": "endpoint-trustlist-windows-v1"
+                                        }
+                                    ],
+                                    "version": "1.0.0"
+                                }
+                            },
+                            "status": "success"
+                        }
+                    }
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "metrics",
+                    "dataset": "endpoint.policy"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 35122,
+                    "ingested": "2022-04-04T18:38:16Z",
+                    "created": "2022-04-04T18:38:15.7178887Z",
+                    "kind": "state",
+                    "module": "endpoint",
+                    "action": "endpoint_policy_response",
+                    "id": "MYfZG00oEwD2/fqT+++++Bye",
+                    "category": [
+                        "host"
+                    ],
+                    "type": [
+                        "change"
+                    ],
+                    "dataset": "endpoint.policy"
+                }
+            }
+        },
+        {
+            "name": "registry",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Effective_process",
+                    "title": "Effective_process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
+                    "fields": [
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the effective process.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Executable name for the effective process.",
+                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name for the effective process.",
+                            "example": "WMIC.exe"
+                        },
+                        {
+                            "name": "pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process ID.",
+                            "example": 4242
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": true
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "registry",
+                    "title": "Registry",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to Windows Registry operations.",
+                    "fields": [
+                        {
+                            "name": "data.bytes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
+                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
+                        },
+                        {
+                            "name": "data.strings",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "wildcard",
+                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
+                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
+                        },
+                        {
+                            "name": "data.type",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Standard registry type for encoding contents",
+                            "example": "REG_SZ"
+                        },
+                        {
+                            "name": "hive",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Abbreviated name for the hive.",
+                            "example": "HKLM"
+                        },
+                        {
+                            "name": "key",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hive-relative path of keys.",
+                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path, including hive, key and value",
+                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
+                        },
+                        {
+                            "name": "value",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the value written.",
+                            "example": "Debugger"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "registry": {
+                    "hive": "HKLM",
+                    "path": "HKLM\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
+                    "data": {
+                        "strings": [],
+                        "type": "REG_NONE"
+                    },
+                    "value": "Enabled",
+                    "key": "SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
+                },
+                "agent": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "Effective_process": {
+                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
+                    "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
+                    "name": "WMIC.exe",
+                    "pid": 2732
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+                        ],
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows Publisher",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ]
+                    },
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows Publisher",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "name": "svchost.exe",
+                    "pid": 2772,
+                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
+                    "executable": "C:\\Windows\\System32\\svchost.exe",
+                    "thread": {
+                        "id": 340,
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "allocation_private_bytes": 16384,
+                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "protection": "RWX",
+                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                }
+                            ],
+                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                            "hardware_breakpoint_set": true
+                        }
+                    }
+                },
+                "message": "Endpoint registry event",
+                "@timestamp": "2022-04-04T18:53:09.1283846Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.registry"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 36271,
+                    "ingested": "2022-04-04T18:53:18Z",
+                    "created": "2022-04-04T18:53:09.1283846Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "query",
+                    "id": "MYfZG00oEwD2/fqT+++++CMy",
+                    "category": [
+                        "registry"
+                    ],
+                    "type": [
+                        "access"
+                    ],
+                    "dataset": "endpoint.events.registry"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                }
+            }
+        },
+        {
+            "name": "process",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "ephemeral_id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
+                            "example": "8a4f500f"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
+                            "example": "foo"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "cloud",
+                    "title": "Cloud",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to the cloud or infrastructure the events are coming from.",
+                    "fields": [
+                        {
+                            "name": "account.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
+                            "example": 666777888999
+                        },
+                        {
+                            "name": "instance.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Instance name of the host machine."
+                        },
+                        {
+                            "name": "project.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
+                            "example": "my-project"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
+                            "example": "aws"
+                        },
+                        {
+                            "name": "region",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region in which this host, resource, or service is located.",
+                            "example": "us-east-1"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information."
+                },
+                {
+                    "name": "container",
+                    "title": "Container",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique container id."
+                        },
+                        {
+                            "name": "image.hash.all",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.",
+                            "example": "[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]"
+                        },
+                        {
+                            "name": "image.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the image the container was built on."
+                        },
+                        {
+                            "name": "image.tag",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Container image tags."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Container name."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "boot.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
+                            "example": "88a1f0ed-5ae5-41ee-af6b-41921c311872"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "pid_ns_ino",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
+                            "example": 256383
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "orchestrator",
+                    "title": "Orchestrator",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields that describe the resources which container orchestrators manage or act upon.",
+                    "fields": [
+                        {
+                            "name": "cluster.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID of the cluster."
+                        },
+                        {
+                            "name": "cluster.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the cluster."
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Namespace in which the action is taking place.",
+                            "example": "kube-system"
+                        },
+                        {
+                            "name": "resource.ip",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "ip",
+                            "description": "IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running)."
+                        },
+                        {
+                            "name": "resource.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the resource being acted upon.",
+                            "example": "test-pod-cdcws"
+                        },
+                        {
+                            "name": "resource.parent.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).",
+                            "example": "DaemonSet"
+                        },
+                        {
+                            "name": "resource.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of resource being acted upon.",
+                            "example": "service"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "package",
+                    "title": "Package",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.",
+                    "fields": [
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Package name",
+                            "example": "go"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.created_suspended",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.defense_evasions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping."
+                        },
+                        {
+                            "name": "Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "Ext.dll.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.mapped_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The base address where this module is loaded."
+                        },
+                        {
+                            "name": "Ext.dll.Ext.mapped_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size of this module's memory mapping, in bytes."
+                        },
+                        {
+                            "name": "Ext.dll.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "Ext.dll.path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "Ext.effective_parent.entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the effective process.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "Ext.effective_parent.executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Executable name for the effective process.",
+                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
+                        },
+                        {
+                            "name": "Ext.effective_parent.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name for the effective process.",
+                            "example": "WMIC.exe"
+                        },
+                        {
+                            "name": "Ext.effective_parent.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process ID.",
+                            "example": 4242
+                        },
+                        {
+                            "name": "Ext.memfd",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for memfd events."
+                        },
+                        {
+                            "name": "Ext.memfd.flag_allow_seal",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Allow sealing operations on this file.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flag_cloexec",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Sets the the close-on-exec flag on the new file descriptor.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flag_exec",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Exec flag is set for file.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flag_hugetlb",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "The anonymous file will be created in the hugetlbfs filesystem using huge pages.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flag_noexec_seal",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Sets both NOEXEC and MFD_ALLOW_SEALING.",
+                            "example": "false"
+                        },
+                        {
+                            "name": "Ext.memfd.flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Flags passed to the memfd operation.",
+                            "example": "2"
+                        },
+                        {
+                            "name": "Ext.memfd.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Filename for the created file. Appears in /proc/self/fd.",
+                            "example": "anon.txt"
+                        },
+                        {
+                            "name": "Ext.mitigation_policies",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled"
+                        },
+                        {
+                            "name": "Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "Ext.ptrace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for ptrace events."
+                        },
+                        {
+                            "name": "Ext.ptrace.child_pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "PID of the ptrace target."
+                        },
+                        {
+                            "name": "Ext.ptrace.request",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "ptrace request."
+                        },
+                        {
+                            "name": "Ext.relative_file_creation_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future."
+                        },
+                        {
+                            "name": "Ext.relative_file_name_modify_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
+                        },
+                        {
+                            "name": "Ext.session",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Session information for the current process"
+                        },
+                        {
+                            "name": "Ext.session_info.authentication_package",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP"
+                        },
+                        {
+                            "name": "Ext.session_info.client_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Client's IPv4 or IPv6 address as a string, if available."
+                        },
+                        {
+                            "name": "Ext.session_info.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Session ID"
+                        },
+                        {
+                            "name": "Ext.session_info.logon_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Session logon type.  Examples include Interactive, Network, and Service."
+                        },
+                        {
+                            "name": "Ext.session_info.relative_logon_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Process creation time, relative to logon time, in seconds."
+                        },
+                        {
+                            "name": "Ext.session_info.relative_password_age",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Process creation time, relative to the last time the password was changed, in seconds."
+                        },
+                        {
+                            "name": "Ext.session_info.user_flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON."
+                        },
+                        {
+                            "name": "Ext.shmget",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for shmget events."
+                        },
+                        {
+                            "name": "Ext.shmget.flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "flags passed to shmget."
+                        },
+                        {
+                            "name": "Ext.shmget.key",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Key passed to the shmget request."
+                        },
+                        {
+                            "name": "Ext.shmget.size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Requested size."
+                        },
+                        {
+                            "name": "Ext.token.elevation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the token is elevated or not"
+                        },
+                        {
+                            "name": "Ext.token.elevation_level",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "Ext.token.elevation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "What level of elevation the token has",
+                            "example": "one of \"default\", \"full\", \"limited\""
+                        },
+                        {
+                            "name": "Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "Ext.token.security_attributes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.",
+                            "example": "TSA://ProcUnique, LUA://DecHdAutoAp"
+                        },
+                        {
+                            "name": "Ext.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the process is a trusted application"
+                        },
+                        {
+                            "name": "Ext.trusted_descendant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether or not the process is a descendent of a trusted application"
+                        },
+                        {
+                            "name": "args",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "end",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process ended.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "entry_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "entry_leader.attested_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.attested_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.attested_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "entry_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.entry_meta.source.ip",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the source (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "entry_leader.entry_meta.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
+                        },
+                        {
+                            "name": "entry_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "entry_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "entry_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "entry_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.parent.session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "entry_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "entry_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "entry_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "entry_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "entry_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "entry_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "entry_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "entry_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "entry_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "entry_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "env_vars",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"PATH=/usr/local/bin:/usr/bin\", \"USER=ubuntu\"]"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "group_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "group_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "group_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "group_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "group_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "group_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "group_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "group_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "group_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "group_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "group_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "group_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "group_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "group_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "io",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "A chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input."
+                        },
+                        {
+                            "name": "io.max_bytes_per_process_exceeded",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting."
+                        },
+                        {
+                            "name": "io.text",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "A chunk of output or input sanitized to UTF-8.\nBest efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word."
+                        },
+                        {
+                            "name": "io.total_bytes_captured",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The total number of bytes captured in this event."
+                        },
+                        {
+                            "name": "io.total_bytes_skipped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "parent.Ext.architecture",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process architecture.  It can differ from host architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "parent.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
+                        },
+                        {
+                            "name": "parent.Ext.real.pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
+                        },
+                        {
+                            "name": "parent.Ext.user",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User associated with the running process."
+                        },
+                        {
+                            "name": "parent.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "parent.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "parent.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "parent.code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "parent.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "parent.code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "parent.exit_code",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+                            "example": 137
+                        },
+                        {
+                            "name": "parent.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.group_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.group_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "parent.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "parent.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "parent.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "parent.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "parent.pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "parent.pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "parent.pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "parent.pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "parent.pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "parent.pgid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.ppid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "parent.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "parent.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "parent.thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": true
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack_contains_unbacked",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
+                        },
+                        {
+                            "name": "parent.thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "parent.thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "parent.thread.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "parent.thread.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "parent.title",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ]
+                        },
+                        {
+                            "name": "parent.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "parent.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "parent.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "parent.uptime",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "parent.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "parent.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "parent.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "pgid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "ppid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "previous.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "previous.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "previous.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.args",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
+                        },
+                        {
+                            "name": "session_leader.args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "session_leader.command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "session_leader.group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.interactive",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+                            "example": true
+                        },
+                        {
+                            "name": "session_leader.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "session_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.parent.session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.parent.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.real_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.real_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.real_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.real_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.same_as_process",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+                            "example": true
+                        },
+                        {
+                            "name": "session_leader.saved_group.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.saved_group.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.saved_user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.saved_user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.start",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "session_leader.supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "session_leader.supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "session_leader.tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "session_leader.tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "session_leader.tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "session_leader.user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "session_leader.user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "session_leader.working_directory",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "The time the process started.",
+                            "example": "2016-05-23T08:05:34.853Z"
+                        },
+                        {
+                            "name": "supplemental_groups.id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "supplemental_groups.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "thread.capabilities.effective",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is the set of capabilities used by the kernel to perform permission checks for the thread.",
+                            "example": "[\"CAP_BPF\", \"CAP_SYS_ADMIN\"]",
+                            "pattern": "^(CAP_[A-Z_]+|\\d+)$"
+                        },
+                        {
+                            "name": "thread.capabilities.permitted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is a limiting superset for the effective capabilities that the thread may assume.",
+                            "example": "[\"CAP_BPF\", \"CAP_SYS_ADMIN\"]",
+                            "pattern": "^(CAP_[A-Z_]+|\\d+)$"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Thread name.",
+                            "example": "thread-0"
+                        },
+                        {
+                            "name": "title",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "tty",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "object",
+                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+                        },
+                        {
+                            "name": "tty.char_device.major",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+                            "example": 4
+                        },
+                        {
+                            "name": "tty.char_device.minor",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+                            "example": 1
+                        },
+                        {
+                            "name": "tty.columns",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The number of character columns per line. e.g terminal width\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'",
+                            "example": 80
+                        },
+                        {
+                            "name": "tty.rows",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "The number of character rows in the terminal. e.g terminal height\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'",
+                            "example": 24
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the process has been up.",
+                            "example": 1325
+                        },
+                        {
+                            "name": "user.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "user.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "working_directory",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The working directory of the process.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "container": {
+                    "id": "8d38b2f18290e973c5ea8f9ee207e970a8aa9191fa89bf3d4ea2a126f2f010a6",
+                    "image": {
+                        "name": "gke.gcr.io/csi-node-driver-registrar:v2.5.0-gke.1",
+                        "tag": [
+                            "v2.5.0-gke.1"
+                        ],
+                        "hash": {
+                            "all": [
+                                "sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d"
+                            ]
+                        }
+                    },
+                    "name": "csi-driver-registrar"
+                },
+                "cloud": {
+                    "account": {
+                        "id": "1234"
+                    },
+                    "instance": {
+                        "name": "webserver-12"
+                    },
+                    "project": {
+                        "id": "1234"
+                    },
+                    "provider": "aws",
+                    "region": "us-east-1"
+                },
+                "orchestrator": {
+                    "cluster": {
+                        "id": "f0cd61d5-327b-43e0-bc94-d9ea922fb4b5",
+                        "name": "webservers"
+                    },
+                    "namespace": "webapp",
+                    "resource": {
+                        "ip": [
+                            "10.1.237.155"
+                        ],
+                        "name": "pdcsi-node-6zh4j",
+                        "type": "pod",
+                        "parent": {
+                            "type": "DaemonSet"
+                        }
+                    }
+                },
+                "process": {
+                    "entry_leader": {
+                        "attested_user": {
+                            "id": "123",
+                            "name": "userA"
+                        },
+                        "attested_groups": {
+                            "name": "groupA"
+                        }
+                    },
+                    "Ext": {
+                        "ancestry": [
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+                        ],
+                        "memfd": {
+                            "flag_hugetlb": false,
+                            "flag_allow_seal": true,
+                            "flags": 2,
+                            "name": "test_memfd",
+                            "flag_exec": false,
+                            "flag_cloexec": false,
+                            "flag_noexec_seal": false
+                        },
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows Publisher",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "created_suspended": true,
+                        "mitigation_policies": [
+                            "Microsoft only, Opt-in to restrict to Microsoft, Windows Store and WHQL",
+                            "CET dynamic APIs can only be called out of proc",
+                            "CF Guard"
+                        ],
+                        "protection": "PsProtectedSignerAntimalware-Light",
+                        "device": {
+                            "volume_device_type": "Disk File System"
+                        },
+                        "authentication_id": "0x3e7",
+                        "token": {
+                            "integrity_level_name": "system",
+                            "security_attributes": [
+                                "TSA://ProcUnique"
+                            ],
+                            "elevation_level": "default"
+                        },
+                        "effective_parent": {
+                            "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
+                            "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
+                            "name": "WMIC.exe",
+                            "pid": 2732
+                        },
+                        "relative_file_creation_time": 48628704.4029488,
+                        "relative_file_name_modify_time": 48628704.4029488,
+                        "session_info": {
+                            "logon_type": "Interactive",
+                            "client_address": "127.0.0.1",
+                            "id": 1,
+                            "authentication_package": "NTLM",
+                            "relative_logon_time": 0.1,
+                            "relative_password_age": 2592000.123,
+                            "user_flags": [
+                                "LOGON_EXTRA_SIDS",
+                                "LOGON_NTLMV2_ENABLED",
+                                "LOGON_WINLOGON"
+                            ]
+                        }
+                    },
+                    "parent": {
+                        "args": [],
+                        "name": "services.exe",
+                        "pid": 600,
+                        "args_count": 0,
+                        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                        "command_line": "",
+                        "executable": "C:\\Windows\\System32\\services.exe",
+                        "thread": {
+                            "Ext": {
+                                "call_stack": [
+                                    {
+                                        "allocation_private_bytes": 16384,
+                                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                        "protection": "RWX",
+                                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                    }
+                                ],
+                                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                                "call_stack_contains_unbacked": true,
+                                "hardware_breakpoint_set": true
+                            }
+                        }
+                    },
+                    "pid": 2772,
+                    "working_directory": "C:\\Windows\\system32\\",
+                    "end": "2022-07-18T21:05:19.9419692Z",
+                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
+                    "executable": "C:\\Windows\\System32\\svchost.exe",
+                    "args": [
+                        "C:\\Windows\\System32\\svchost.exe",
+                        "-k",
+                        "WerSvcGroup"
+                    ],
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows Publisher",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "pe": {
+                        "original_file_name": "svchost.exe"
+                    },
+                    "name": "svchost.exe",
+                    "args_count": 3,
+                    "command_line": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
+                    "hash": {
+                        "sha1": "4fbfc6004084d97032837c21d3f426892d868eac",
+                        "sha256": "cb19fd67b1d028e01f54c426a0924528c4a8d8ed8996cfe0ee0c6e45285436a1",
+                        "md5": "1b280ad032268a636ecfe6f9165431b7"
+                    },
+                    "tty": {
+                        "char_device": {
+                            "major": 4,
+                            "minor": 1
+                        },
+                        "rows": 24,
+                        "columns": 80
+                    },
+                    "io": {
+                        "text": "helloworld",
+                        "total_bytes_captured": 10,
+                        "total_bytes_skipped": 0,
+                        "max_bytes_per_process_exceeded": false
+                    },
+                    "env_vars": [
+                        "NICK=test",
+                        "OTHER=why"
+                    ]
+                },
+                "message": "Endpoint process event",
+                "@timestamp": "2022-04-04T18:53:08.6578986Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.process"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 36236,
+                    "ingested": "2022-04-04T18:53:18Z",
+                    "created": "2022-04-04T18:53:08.6578986Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "start",
+                    "id": "MYfZG00oEwD2/fqT+++++CLz",
+                    "category": [
+                        "process"
+                    ],
+                    "type": [
+                        "start"
+                    ],
+                    "dataset": "endpoint.events.process"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                }
+            }
+        },
+        {
+            "name": "security",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Target",
+                    "title": "Target",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
+                    "fields": [
+                        {
+                            "name": "process.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "file",
+                    "title": "File",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
+                    "fields": [
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.authentication_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process authentication ID"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "effective.domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "effective.email",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "effective.full_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "effective.hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "effective.id",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "effective.name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text"
+                                }
+                            ],
+                            "example": "a.einstein"
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "winlog",
+                    "title": "Winlog",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields provide detailed information regarding events logged in the Windows Event Log. The Windows Event Log is a centralized system used by Windows to record events related to system, application, and security activities. Each event log entry is categorized by a specific event type, and contains relevant metadata that can include the event source, event ID, timestamp, user details, and other associated data.",
+                    "fields": [
+                        {
+                            "name": "event_data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The event-specific data. This is a non-exhaustive list of parameters that are used in Windows events."
+                        },
+                        {
+                            "name": "event_data.PrivilegeList",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of sensitive privileges, assigned to the new logon.",
+                            "example": "SeTcbPrivilege, SeSecurityPrivilege"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "Target": {
+                    "process": {
+                        "Ext": {
+                            "authentication_id": "0x3e7"
+                        }
+                    }
+                },
+                "agent": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "file": {
+                    "path": "/User/admin/Downloads/application",
+                    "code_signature": {
+                        "signing_id": "com.developer.identifier",
+                        "team_id": "XYZABC"
+                    }
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+                        ],
+                        "authentication_id": "0x3e7",
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows Publisher",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ]
+                    },
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows Publisher",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "name": "C:\\Windows\\System32\\services.exe",
+                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                    "executable": "C:\\Windows\\System32\\services.exe"
+                },
+                "message": "Endpoint security event",
+                "@timestamp": "2022-04-04T18:53:08.6510289Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.security"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 36385,
+                    "ingested": "2022-04-04T18:53:18Z",
+                    "created": "2022-04-04T18:53:08.6510289Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "log_on",
+                    "id": "MYfZG00oEwD2/fqT+++++CQ/",
+                    "category": [
+                        "authentication",
+                        "session"
+                    ],
+                    "type": [
+                        "start"
+                    ],
+                    "dataset": "endpoint.events.security",
+                    "outcome": "success"
+                },
+                "user": {
+                    "domain": "DESKTOP-1TK590J",
+                    "effective": {
+                        "domain": "DESKTOP-1TK590J",
+                        "name": "EafTestLogon80589",
+                        "id": "S-1-5-18",
+                        "email": "EafTestLogon80589@DESKTOP-1TK590J.local",
+                        "full_name": "EafTestLogon80589",
+                        "hash": "f1297b0233914ec6ebf8fc01195e8712dfd8322f5e8d9d8bbe0083a0fc1860fd"
+                    },
+                    "id": "S-1-5-21-1749029863-1064264096-968553628-1001",
+                    "name": "Default"
+                },
+                "winlog": {
+                    "event_data": {
+                        "PrivilegeList": [
+                            "SeSecurityPrivilege",
+                            "SeTakeOwnershipPrivilege",
+                            "SeLoadDriverPrivilege",
+                            "SeBackupPrivilege",
+                            "SeRestorePrivilege",
+                            "SeDebugPrivilege",
+                            "SeSystemEnvironmentPrivilege",
+                            "SeImpersonatePrivilege",
+                            "SeDelegateSessionUserImpersonatePrivilege"
+                        ]
+                    }
+                }
+            }
+        },
+        {
+            "name": "metadata",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "Endpoint",
+                    "title": "Endpoint",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
+                    "fields": [
+                        {
+                            "name": "capabilities",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 128,
+                            "description": "Enabled capabilities",
+                            "doc_values": false
+                        },
+                        {
+                            "name": "configuration",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
+                        },
+                        {
+                            "name": "configuration.isolation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Configuration setting for Host Isolation from the network"
+                        },
+                        {
+                            "name": "policy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The policy fields are used to hold information about applied policy."
+                        },
+                        {
+                            "name": "policy.applied",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "information about the policy that is applied"
+                        },
+                        {
+                            "name": "policy.applied.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the id of the applied policy"
+                        },
+                        {
+                            "name": "policy.applied.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the name of this applied policy"
+                        },
+                        {
+                            "name": "policy.applied.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "the status of the applied policy"
+                        },
+                        {
+                            "name": "state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
+                        },
+                        {
+                            "name": "state.isolation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Current network isolation state of the host"
+                        },
+                        {
+                            "name": "status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The current status of the endpoint e.g. enrolled, unenrolled."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
+                            "example": "foo"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "elastic",
+                    "title": "Elastic",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Holds fields and properties of data points and concepts in the elastic domain or namespace.",
+                    "fields": [
+                        {
+                            "name": "agent",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
+                        },
+                        {
+                            "name": "agent.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this elastic agent (if one exists).",
+                            "example": "c2a9093e-e289-4c0a-aa44-8c32a414fa7a"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "build": {
+                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+                    },
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "@timestamp": "2022-04-04T12:33:36.6664577Z",
+                "Endpoint": {
+                    "capabilities": [
+                        "isolation"
+                    ],
+                    "configuration": {
+                        "isolation": false
+                    },
+                    "state": {
+                        "isolation": false
+                    },
+                    "policy": {
+                        "applied": {
+                            "name": "endpoint-1",
+                            "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
+                            "status": "success"
+                        }
+                    },
+                    "status": "enrolled"
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "metrics",
+                    "dataset": "endpoint.metadata"
+                },
+                "elastic": {
+                    "agent": {
+                        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21"
+                    }
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 5054,
+                    "ingested": "2022-04-04T12:33:37Z",
+                    "created": "2022-04-04T12:33:36.6664577Z",
+                    "kind": "metric",
+                    "module": "endpoint",
+                    "action": "endpoint_metadata",
+                    "id": "MYfZG00oEwD2/fqT+++++/SC",
+                    "category": [
+                        "host"
+                    ],
+                    "type": [
+                        "info"
+                    ],
+                    "dataset": "endpoint.metadata"
+                }
+            }
+        },
+        {
+            "name": "action_responses",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "action_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The action id",
+                    "path": "EndpointActions.action_id"
+                },
+                {
+                    "name": "agent_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Alias field that maps to {agent: {id}}",
+                    "path": "agent.id"
+                },
+                {
+                    "name": "completed_at",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Request completion timestamp when the response is done executing. Usually matches with @timestamp.",
+                    "path": "EndpointActions.completed_at"
+                },
+                {
+                    "name": "data.alert_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "List of alert ids that triggered the action",
+                    "path": "EndpointActions.data.alert_id"
+                },
+                {
+                    "name": "data.command",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The action that is requested",
+                    "path": "EndpointActions.data.command"
+                },
+                {
+                    "name": "data.comment",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "A comment that describes the action that is requested",
+                    "path": "EndpointActions.data.comment"
+                },
+                {
+                    "name": "started_at",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Timestamp of start of request",
+                    "path": "EndpointActions.started_at"
+                },
+                {
+                    "name": "status",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The status of the request that distinguishes if the request is queued, running or completed.",
+                    "path": "EndpointActions.status"
+                },
+                {
+                    "name": "EndpointActions",
+                    "title": "Endpoint Actions",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields to describe the endpoint  action requests and responses.",
+                    "fields": [
+                        {
+                            "name": "action_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action id"
+                        },
+                        {
+                            "name": "completed_at",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Request completion timestamp when the response is done executing. Usually matches with @timestamp."
+                        },
+                        {
+                            "name": "data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The action request information"
+                        },
+                        {
+                            "name": "data.alert_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of alert ids that triggered the action"
+                        },
+                        {
+                            "name": "data.command",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action that is requested",
+                            "example": "isolate"
+                        },
+                        {
+                            "name": "data.comment",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "A comment that describes the action that is requested"
+                        },
+                        {
+                            "name": "started_at",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Timestamp of start of request"
+                        },
+                        {
+                            "name": "status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The status of the request that distinguishes if the request is queued, running or completed."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "error",
+                    "title": "Error",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.",
+                    "fields": [
+                        {
+                            "name": "code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Error code describing the error."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the error."
+                        },
+                        {
+                            "name": "message",
+                            "level": "core",
+                            "type": "match_only_text",
+                            "description": "Error message."
+                        },
+                        {
+                            "name": "stack_trace",
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "The stack trace of this error in plain text.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of the error, for example the class name of the exception.",
+                            "example": "java.lang.NullPointerException"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "end",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "EndpointActions": {
+                    "completed_at": "2022-04-04T20:44:14.0Z",
+                    "data": {
+                        "comment": "Action completed successfully",
+                        "command": "isolate"
+                    },
+                    "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
+                    "started_at": "2022-04-04T20:44:08.0Z"
+                },
+                "agent": {
+                    "id": "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
+                },
+                "@timestamp": "2022-04-04T20:44:14.0Z",
+                "data_stream": {
+                    "namespace": "default",
+                    "type": ".logs",
+                    "dataset": "endpoint.action.responses"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "ingested": "2022-04-04T20:44:45Z"
+                }
+            }
+        },
+        {
+            "name": "collection",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                }
+            ]
+        },
+        {
+            "name": "library",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Effective_process",
+                    "title": "Effective_process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
+                    "fields": [
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the effective process.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Executable name for the effective process.",
+                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name for the effective process.",
+                            "example": "WMIC.exe"
+                        },
+                        {
+                            "name": "pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process ID.",
+                            "example": 4242
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dll",
+                    "title": "DLL",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.defense_evasions",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump."
+                        },
+                        {
+                            "name": "Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "Ext.load_index",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.\nThe first load index is 1."
+                        },
+                        {
+                            "name": "Ext.relative_file_creation_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future."
+                        },
+                        {
+                            "name": "Ext.relative_file_name_modify_time",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
+                        },
+                        {
+                            "name": "Ext.size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of DLL"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
+                            "example": "kernel32.dll"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "file",
+                    "title": "File",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": true
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+                        ],
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "protection": "PsProtectedSignerAntimalware-Light"
+                    },
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "name": "VSSVC.exe",
+                    "pid": 4528,
+                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ1MjgtMTMyOTM1NzEwODYuNjI4MzM0NzAw",
+                    "executable": "C:\\Windows\\System32\\VSSVC.exe",
+                    "thread": {
+                        "id": 340,
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "allocation_private_bytes": 16384,
+                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "protection": "RWX",
+                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                }
+                            ],
+                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                            "hardware_breakpoint_set": true
+                        }
+                    }
+                },
+                "dll": {
+                    "Ext": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "device": {
+                            "volume_device_type": "Disk File System"
+                        },
+                        "load_index": 1,
+                        "relative_file_creation_time": 48628704.4029488,
+                        "relative_file_name_modify_time": 48628704.4029488,
+                        "size": 65536
+                    },
+                    "path": "C:\\Windows\\System32\\msxml3.dll",
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Microsoft Windows",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "pe": {
+                        "file_version": "8.110.17763.1911",
+                        "imphash": "2e1d1e35c17be5497d2de33f06dc41b4",
+                        "original_file_name": "MSXML3.dll"
+                    },
+                    "name": "msxml3.dll",
+                    "hash": {
+                        "sha1": "02488fb2dbf679a3282338178b451da635b79b54",
+                        "sha256": "a9698adcf789d9e30f37dd5e6c9be0441bc37662ba7402e85071ccec2135d36c",
+                        "md5": "65e4fd0564411bb60c600fae12cde2f9"
+                    }
+                },
+                "message": "Endpoint DLL load event",
+                "@timestamp": "2022-04-04T18:38:08.3185831Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.library"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 34339,
+                    "ingested": "2022-04-04T18:38:16Z",
+                    "created": "2022-04-04T18:38:08.3185831Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "load",
+                    "id": "MYfZG00oEwD2/fqT+++++BRi",
+                    "category": [
+                        "library"
+                    ],
+                    "type": [
+                        "start"
+                    ],
+                    "dataset": "endpoint.events.library"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                },
+                "Effective_process": {
+                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTU2NS0xNjk1MTkyOTQ3",
+                    "executable": "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
+                    "name": "Terminal",
+                    "pid": 565
+                }
+            }
+        },
+        {
+            "name": "heartbeat",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "billable",
+                    "level": "custom",
+                    "type": "boolean",
+                    "description": "Whether document should be included in billing calculations"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "@timestamp": "2023-07-18T20:40:09.279939Z",
+                "agent": {
+                    "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+                },
+                "data_stream": {
+                    "dataset": "endpoint.heartbeat",
+                    "namespace": "default",
+                    "type": ".logs"
+                },
+                "message": "Endpoint heartbeat",
+                "event": {
+                    "ingested": "2023-07-18T20:40:09.279939Z"
+                },
+                "billable": true
+            }
+        },
+        {
+            "name": "actions",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "action_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The action id",
+                    "path": "EndpointActions.action_id"
+                },
+                {
+                    "name": "agents",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Alias field that maps to {agent: {id}}",
+                    "path": "agent.id"
+                },
+                {
+                    "name": "data.alert_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "List of alert ids that triggered the action",
+                    "path": "EndpointActions.data.alert_id"
+                },
+                {
+                    "name": "data.command",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The action that is requested",
+                    "path": "EndpointActions.data.command"
+                },
+                {
+                    "name": "data.comment",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "A comment that describes the action that is requested",
+                    "path": "EndpointActions.data.comment"
+                },
+                {
+                    "name": "expiration",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Request expiration timestamp",
+                    "path": "EndpointActions.expiration"
+                },
+                {
+                    "name": "input_type",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The input type of the action, distinguishes endpoint actions as `endpoint`",
+                    "path": "EndpointActions.input_type"
+                },
+                {
+                    "name": "type",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "Distinguishes the type of input. Usually set to `INPUT_ACTION`",
+                    "path": "EndpointActions.type"
+                },
+                {
+                    "name": "user_id",
+                    "level": "custom",
+                    "type": "alias",
+                    "description": "The user id",
+                    "path": "user.id"
+                },
+                {
+                    "name": "EndpointActions",
+                    "title": "Endpoint Actions",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields to describe the endpoint  action requests and responses.",
+                    "fields": [
+                        {
+                            "name": "action_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action id"
+                        },
+                        {
+                            "name": "data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The action request information"
+                        },
+                        {
+                            "name": "data.alert_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "List of alert ids that triggered the action"
+                        },
+                        {
+                            "name": "data.command",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action that is requested",
+                            "example": "isolate"
+                        },
+                        {
+                            "name": "data.comment",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "A comment that describes the action that is requested"
+                        },
+                        {
+                            "name": "expiration",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "date",
+                            "description": "Request expiration timestamp"
+                        },
+                        {
+                            "name": "input_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The input type of the action, distinguishes endpoint actions as `endpoint`"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Distinguishes the type of input. Usually set to `INPUT_ACTION`"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "error",
+                    "title": "Error",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.",
+                    "fields": [
+                        {
+                            "name": "code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Error code describing the error."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the error."
+                        },
+                        {
+                            "name": "message",
+                            "level": "core",
+                            "type": "match_only_text",
+                            "description": "Error message."
+                        },
+                        {
+                            "name": "stack_trace",
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "The stack trace of this error in plain text.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of the error, for example the class name of the exception.",
+                            "example": "java.lang.NullPointerException"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "end",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "rule",
+                    "title": "Rule",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
+                            "example": 101
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the rule or signature generating the event.",
+                            "example": "BLOCK_DNS_over_TLS"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "EndpointActions": {
+                    "data": {
+                        "comment": "testing isolation",
+                        "command": "isolate"
+                    },
+                    "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
+                    "input_type": "endpoint",
+                    "expiration": "2022-04-18T20:44:07.805Z",
+                    "type": "INPUT_ACTION"
+                },
+                "agent": {
+                    "id": [
+                        "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
+                    ]
+                },
+                "@timestamp": "2022-04-04T20:44:07.805Z",
+                "event": {
+                    "agent_id_status": "auth_metadata_missing",
+                    "ingested": "2022-04-04T20:44:07Z"
+                },
+                "user": {
+                    "id": "user@elastic.co"
+                }
+            }
+        },
+        {
+            "name": "file",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Effective_process",
+                    "title": "Effective_process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
+                    "fields": [
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the effective process.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Executable name for the effective process.",
+                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name for the effective process.",
+                            "example": "WMIC.exe"
+                        },
+                        {
+                            "name": "pid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Process ID.",
+                            "example": 4242
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "Persistence",
+                    "title": "Persistence",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a Persistence event.",
+                    "fields": [
+                        {
+                            "name": "args",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Arguments used to execute the persistence item"
+                        },
+                        {
+                            "name": "executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The persistence item's executable"
+                        },
+                        {
+                            "name": "keepalive",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Keep alive option boolean"
+                        },
+                        {
+                            "name": "name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The persistence item's name"
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file's path"
+                        },
+                        {
+                            "name": "runatload",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Run at load option boolean"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.correlation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Information about event this should be correlated with."
+                        },
+                        {
+                            "name": "Ext.correlation.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event"
+                        },
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "file",
+                    "title": "File",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.device.bus_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+                        },
+                        {
+                            "name": "Ext.device.dos_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+                        },
+                        {
+                            "name": "Ext.device.file_system_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+                        },
+                        {
+                            "name": "Ext.device.nt_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+                        },
+                        {
+                            "name": "Ext.device.product_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.serial_number",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
+                        },
+                        {
+                            "name": "Ext.device.vendor_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "VendorID of the device. It is provided by the vendor of the device."
+                        },
+                        {
+                            "name": "Ext.device.volume_device_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+                        },
+                        {
+                            "name": "Ext.entropy",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Entropy calculation of file's header and footer used to check file integrity."
+                        },
+                        {
+                            "name": "Ext.header_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "Ext.header_data",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "First 16 bytes of file used to check file integrity."
+                        },
+                        {
+                            "name": "Ext.malware_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of malware_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "The concatenated names of all yara signatures"
+                        },
+                        {
+                            "name": "Ext.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "text",
+                            "description": "Malware artifact identifier."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of bytes representing yara signature matches"
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature match."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Primary malware signature hash."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature sha256."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature id."
+                        },
+                        {
+                            "name": "Ext.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature name."
+                        },
+                        {
+                            "name": "Ext.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "An array of malware signature matches"
+                        },
+                        {
+                            "name": "Ext.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary malware signature version."
+                        },
+                        {
+                            "name": "Ext.monotonic_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "File event monotonic ID."
+                        },
+                        {
+                            "name": "Ext.original",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Original file information during a modification event."
+                        },
+                        {
+                            "name": "Ext.original.extension",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file extension prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.gid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "Ext.original.group",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "Ext.original.mode",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file mode prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file name prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.owner",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "Ext.original.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original file path prior to a modification event"
+                        },
+                        {
+                            "name": "Ext.original.uid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "Ext.windows",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Platform-specific Windows fields"
+                        },
+                        {
+                            "name": "Ext.windows.zone_identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Windows zone identifier for a file"
+                        },
+                        {
+                            "name": "accessed",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+                        },
+                        {
+                            "name": "attributes",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
+                            "example": "[\"readonly\", \"system\"]"
+                        },
+                        {
+                            "name": "created",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "File creation time.\nNote that not all filesystems store the creation time."
+                        },
+                        {
+                            "name": "ctime",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+                        },
+                        {
+                            "name": "device",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device that is the source of the file.",
+                            "example": "sda"
+                        },
+                        {
+                            "name": "directory",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
+                            "example": "/home/alice"
+                        },
+                        {
+                            "name": "drive_letter",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1,
+                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
+                            "example": "C"
+                        },
+                        {
+                            "name": "extension",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+                            "example": "png"
+                        },
+                        {
+                            "name": "gid",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group ID (GID) of the file.",
+                            "example": "1001"
+                        },
+                        {
+                            "name": "group",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Primary group name of the file.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "hash.md5",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "hash.sha1",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "hash.sha512",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "inode",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Inode representing the file in the filesystem.",
+                            "example": "256383"
+                        },
+                        {
+                            "name": "mime_type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+                        },
+                        {
+                            "name": "mode",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode of the file in octal representation.",
+                            "example": "0640"
+                        },
+                        {
+                            "name": "mtime",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "Last time the file content was modified."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the file including the extension, without the directory.",
+                            "example": "example.png"
+                        },
+                        {
+                            "name": "origin_referrer_url",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 8192,
+                            "description": "The url of the webpage that linked to the file."
+                        },
+                        {
+                            "name": "origin_url",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 8192,
+                            "description": "The url where the file is hosted."
+                        },
+                        {
+                            "name": "owner",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File owner's username.",
+                            "example": "alice"
+                        },
+                        {
+                            "name": "path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/home/alice/example.png"
+                        },
+                        {
+                            "name": "pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "size",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
+                            "example": 16384
+                        },
+                        {
+                            "name": "target_path",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Target path for symlinks.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ]
+                        },
+                        {
+                            "name": "type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "File type (file, dir, or symlink).",
+                            "example": "file"
+                        },
+                        {
+                            "name": "uid",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
+                            "example": "1001"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "args_count",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+                            "example": 4
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "ppid",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Parent process' pid.",
+                            "example": 4241,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": true
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.Ext.hardware_breakpoint_set",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "id": "ccb7b1a1-303e-416f-b975-311737e8e125",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "Effective_process": {
+                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
+                    "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
+                    "name": "WMIC.exe",
+                    "pid": 2732
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTYwNC0xMzI5MzU0OTEwOS4zNTg1OTc3MDA=",
+                            "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ3Mi0xMzI5MzU0OTEwOS43NjU4MjcwMA=="
+                        ],
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Elasticsearch, Inc.",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ]
+                    },
+                    "args_count": 1,
+                    "parent": {
+                        "pid": 604,
+                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
+                        "group_leader": {
+                            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+                        }
+                    },
+                    "entry_leader": {
+                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
+                        "parent": {
+                            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+                        }
+                    },
+                    "session_leader": {
+                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+                    },
+                    "group_leader": {
+                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+                    },
+                    "code_signature": {
+                        "trusted": true,
+                        "subject_name": "Elasticsearch, Inc.",
+                        "exists": true,
+                        "status": "trusted"
+                    },
+                    "name": "winlogbeat.exe",
+                    "pid": 4512,
+                    "thread": {
+                        "id": 340,
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "allocation_private_bytes": 16384,
+                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                                    "protection": "RWX",
+                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                                }
+                            ],
+                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                            "hardware_breakpoint_set": true
+                        }
+                    },
+                    "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
+                    "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
+                },
+                "message": "Endpoint file event",
+                "@timestamp": "2022-04-04T18:37:01.5775771Z",
+                "file": {
+                    "Ext": {
+                        "header_data": [],
+                        "entropy": 5.28353871945538,
+                        "device": {
+                            "volume_device_type": "Disk File System"
+                        },
+                        "header_bytes": "7570646174655f74696d653a20323032",
+                        "windows": {
+                            "zone_identifier": -1
+                        },
+                        "monotonic_id": 3526
+                    },
+                    "path": "C:\\ProgramData\\winlogbeat\\.winlogbeat.yml.new",
+                    "extension": "new",
+                    "size": 1406,
+                    "name": ".winlogbeat.yml.new",
+                    "origin_referrer_url": "https://example.com",
+                    "origin_url": "https://example.com/file.zip"
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.file"
+                },
+                "host": {
+                    "hostname": "response-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.9",
+                        "fe80::4d1:ef01:c0ed:299a",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "response-win-1",
+                    "id": "bcbbe9cb-0278-43f9-aa1b-2dc9839bbf6f",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 32114,
+                    "ingested": "2022-04-04T18:37:29Z",
+                    "created": "2022-04-04T18:37:01.5775771Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "creation",
+                    "id": "MYfZFpbNKturKgFp+++++AlT",
+                    "category": [
+                        "file"
+                    ],
+                    "type": [
+                        "creation"
+                    ],
+                    "dataset": "endpoint.events.file"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                }
+            }
+        },
+        {
+            "name": "api",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Target",
+                    "title": "Target",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
+                    "fields": [
+                        {
+                            "name": "process.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "process.Ext.created_suspended",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory allocation containing the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Original memory size requested when the memory was allocated.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "process.Ext.memory_region.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+                            "example": "PRIVATE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The address where bytes_compressed begins.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether bytes_compressed is present in this event.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the memory region.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A sequence of signature names matched.",
+                            "example": "Windows.EICAR.Not-a-virus"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature identifier"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The first matching details."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The first matching details.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of file matching signature."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of file matching signature."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the first yara rule matched."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the first yara rule matched."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Additional matching details if available.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The second matching details.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of second file matching signature.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of second file matching signature.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the second yara rule matched.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the second yara rule matched.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature version"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
+                            "example": "C:\\Windows\\System32\\mshtml.dll"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.pehash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
+                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "PE Section List name."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.mapped_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the file at mapped_path is an executable.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.pehash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
+                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "PE Section List name."
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.memory_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether an executable file was found in memory.",
+                            "example": false
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of the memory region.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_start_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 64 bytes at the region base address.",
+                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.region_state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+                            "example": "COMMIT"
+                        },
+                        {
+                            "name": "process.Ext.memory_region.strings",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Array of strings found within the memory region.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "process.Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "process.Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "process.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "process.executable",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "process.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "process.pid",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the destination (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "port",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Port of the destination.",
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dll",
+                    "title": "DLL",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "path",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Full file path of the library.",
+                            "example": "C:\\Windows\\System32\\kernel32.dll"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "end",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "network",
+                    "title": "Network",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.",
+                    "fields": [
+                        {
+                            "name": "transport",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
+                            "example": "tcp"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
+                            "example": "ipv4"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.api.behaviors",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
+                            "example": "[ \"cross-process\", \"rapid_background_polling\", \"multiple_polling_processes\", \"native_api\", \"shellcode\" ]"
+                        },
+                        {
+                            "name": "Ext.api.metadata",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Information related to the API call."
+                        },
+                        {
+                            "name": "Ext.api.metadata.amsi_filenames",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A list of filenames previously scanned by AMSI.",
+                            "example": "[ \"C:\\script.ps1\" ]"
+                        },
+                        {
+                            "name": "Ext.api.metadata.amsi_logs",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Information related to previous AMSI scans."
+                        },
+                        {
+                            "name": "Ext.api.metadata.amsi_logs.entries",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A subset of the AMSI content buffers scanned prior to this event.",
+                            "example": "[ \"[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport(\"kernel32.dll\")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}\" ]"
+                        },
+                        {
+                            "name": "Ext.api.metadata.amsi_logs.type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The AMSI content type scanned prior to this event.",
+                            "example": "PowerShell"
+                        },
+                        {
+                            "name": "Ext.api.metadata.background_callcount",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.",
+                            "example": 6021
+                        },
+                        {
+                            "name": "Ext.api.metadata.client_is_local",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.api.metadata.client_machine",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Client process's machine name (provided by the client and potentially untrustworthy).",
+                            "example": "DESKTOP-EXAMPLE"
+                        },
+                        {
+                            "name": "Ext.api.metadata.client_machine_fqdn",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Client process's machine name FQDN (provided by the client and potentially untrustworthy).",
+                            "example": "DESKTOP-EXAMPLE.elastic.co"
+                        },
+                        {
+                            "name": "Ext.api.metadata.client_process_id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Client process id",
+                            "example": 3600
+                        },
+                        {
+                            "name": "Ext.api.metadata.ms_since_last_keyevent",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.",
+                            "example": 94
+                        },
+                        {
+                            "name": "Ext.api.metadata.procedure_symbol",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Summary of the hook procedure.",
+                            "example": "taskbar.dll"
+                        },
+                        {
+                            "name": "Ext.api.metadata.return_value",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Return value of RegisterRawInputDevices API call.",
+                            "example": 1
+                        },
+                        {
+                            "name": "Ext.api.metadata.security_descriptor",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The security descriptor of the device.",
+                            "example": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)"
+                        },
+                        {
+                            "name": "Ext.api.metadata.start_address_allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection attributes associated with the starting address of a thread.",
+                            "example": "RCX"
+                        },
+                        {
+                            "name": "Ext.api.metadata.start_address_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module associated with the starting address of a thread.",
+                            "example": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe"
+                        },
+                        {
+                            "name": "Ext.api.metadata.target_address_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the memory region targeted by the API call.",
+                            "example": "Unbacked"
+                        },
+                        {
+                            "name": "Ext.api.metadata.target_address_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path of the memory region targeted by the API call.",
+                            "example": "C:\\programdata\\example.dll"
+                        },
+                        {
+                            "name": "Ext.api.metadata.thread_info_flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Thread info flags.",
+                            "example": 16
+                        },
+                        {
+                            "name": "Ext.api.metadata.visible_windows_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Number of visible windows owned by the caller thread.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.metadata.windows_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Number of windows owned by the caller thread.",
+                            "example": 2
+                        },
+                        {
+                            "name": "Ext.api.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the API, usually the name of the function or system call.",
+                            "example": "VirtualAlloc"
+                        },
+                        {
+                            "name": "Ext.api.parameters",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Parameter values passed to the API call."
+                        },
+                        {
+                            "name": "Ext.api.parameters.address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The target memory address.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.api.parameters.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`",
+                            "example": "COMMIT|RESERVE"
+                        },
+                        {
+                            "name": "Ext.api.parameters.app_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The application name requesting the AMSI scan.",
+                            "example": "PowerShell"
+                        },
+                        {
+                            "name": "Ext.api.parameters.argument1",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The first argument to the procedure.",
+                            "example": 1
+                        },
+                        {
+                            "name": "Ext.api.parameters.argument2",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The second argument to the procedure.",
+                            "example": 2
+                        },
+                        {
+                            "name": "Ext.api.parameters.argument3",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The third argument to the procedure.",
+                            "example": 3
+                        },
+                        {
+                            "name": "Ext.api.parameters.buffer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The content associated with an AMSI scan.",
+                            "example": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport(\"kernel32.dll\")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20);"
+                        },
+                        {
+                            "name": "Ext.api.parameters.consumer_details",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name."
+                        },
+                        {
+                            "name": "Ext.api.parameters.consumer_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.",
+                            "example": "ExampleConsumer"
+                        },
+                        {
+                            "name": "Ext.api.parameters.consumer_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An example list of consumer type.\n  \"ActiveScriptEventConsumer\" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.\n  \"CommandLineEventConsumer\" - Launches an arbitrary process in the local system context when an event is delivered to it.\n  \"LogFileEventConsumer\" - Writes customized strings to a text log file when events are delivered to it.\n  \"NTEventLogEventConsumer\" - Logs a specific message to the Windows event log when an event is delivered to it.\n  \"SMTPEventConsumer\" - Sends an email message using SMTP each time an event is delivered to it.",
+                            "example": "CommandLineEventConsumer"
+                        },
+                        {
+                            "name": "Ext.api.parameters.content_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The content name, typically a filename, associated with an AMSI scan.",
+                            "example": "C:\\script.ps1"
+                        },
+                        {
+                            "name": "Ext.api.parameters.context_flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`",
+                            "example": 1048607
+                        },
+                        {
+                            "name": "Ext.api.parameters.desired_access",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`."
+                        },
+                        {
+                            "name": "Ext.api.parameters.desired_access_numeric",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`."
+                        },
+                        {
+                            "name": "Ext.api.parameters.device",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the device object.",
+                            "example": "\\Device\\NPCAP"
+                        },
+                        {
+                            "name": "Ext.api.parameters.driver",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the driver object.",
+                            "example": "\\Driver\\npcap"
+                        },
+                        {
+                            "name": "Ext.api.parameters.eax",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.ebp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EBP frame pointer register.",
+                            "example": 15006644
+                        },
+                        {
+                            "name": "Ext.api.parameters.ebx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EBX general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.ecx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 ECX general purpose register. First argument in __fastcall and __thiscall.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.edi",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EDI general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.edx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EDX general purpose register. Second argument in a __fastcall.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.eip",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 EIP instruction pointer register.",
+                            "example": 1472790528
+                        },
+                        {
+                            "name": "Ext.api.parameters.esi",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 ESI general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.esp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x86 ESP stack pointer register.",
+                            "example": 15007744
+                        },
+                        {
+                            "name": "Ext.api.parameters.event_filter_details",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Provide an overview of the query that define when an event should be triggered."
+                        },
+                        {
+                            "name": "Ext.api.parameters.event_filter_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.",
+                            "example": "ExampleFilter"
+                        },
+                        {
+                            "name": "Ext.api.parameters.flags",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.",
+                            "example": "INPUTSINK"
+                        },
+                        {
+                            "name": "Ext.api.parameters.handle_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This parameter indicates whether the detected access was attempt against a process or a thread.",
+                            "example": "process"
+                        },
+                        {
+                            "name": "Ext.api.parameters.hook_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DLL containing the hook procedure.",
+                            "example": "c:\\windows\\system32\\taskbar.dll"
+                        },
+                        {
+                            "name": "Ext.api.parameters.hook_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of hook procedure to be installed.",
+                            "example": "WH_KEYBOARD_LL"
+                        },
+                        {
+                            "name": "Ext.api.parameters.io_control_code",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The I/O control code for the requested device operation.",
+                            "example": 27365
+                        },
+                        {
+                            "name": "Ext.api.parameters.namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "WMI namespace to which the connection is made.",
+                            "example": "root\\Microsoft\\Windows\\DeviceGuard"
+                        },
+                        {
+                            "name": "Ext.api.parameters.operation",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Specifies the connection or request to WMI",
+                            "example": "Win32_Process::Create"
+                        },
+                        {
+                            "name": "Ext.api.parameters.procedure",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The memory address of the procedure or function.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.api.parameters.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
+                            "example": "RWX|GUARD"
+                        },
+                        {
+                            "name": "Ext.api.parameters.protection_old",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
+                            "example": "RCX"
+                        },
+                        {
+                            "name": "Ext.api.parameters.r8",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 R8 general purpose register. Third argument in a __fastcall.",
+                            "example": 3
+                        },
+                        {
+                            "name": "Ext.api.parameters.r9",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 R9 general purpose register. Fourth argument in a __fastcall.",
+                            "example": 4
+                        },
+                        {
+                            "name": "Ext.api.parameters.rax",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RAX general purpose register. Return value in a __fastcall.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rbp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RBP general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rbx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The x64 RBX general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rcx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RCX general purpose register. First argument in a __fastcall.",
+                            "example": 1
+                        },
+                        {
+                            "name": "Ext.api.parameters.rdi",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RDI general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rdx",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RDX general purpose register. Second argument in a __fastcall.",
+                            "example": 2
+                        },
+                        {
+                            "name": "Ext.api.parameters.rip",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RIP instruction pointer register.",
+                            "example": 140706153693184
+                        },
+                        {
+                            "name": "Ext.api.parameters.rsi",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The x64 RSI general purpose register.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.api.parameters.rsp",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The x64 RSP stack pointer register.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.api.parameters.size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The size.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.api.parameters.usage",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.",
+                            "example": "KEYBOARD"
+                        },
+                        {
+                            "name": "Ext.api.parameters.usage_page",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.",
+                            "example": "GENERIC"
+                        },
+                        {
+                            "name": "Ext.api.summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The summary of the API call and its parameters.",
+                            "example": "VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.created_suspended",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory allocation containing the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Original memory size requested when the memory was allocated.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.memory_region.allocation_type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+                            "example": "PRIVATE"
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_address",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The address where bytes_compressed begins.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_allocation_offset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+                            "example": 0
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_compressed",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.memory_region.bytes_compressed_present",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether bytes_compressed is present in this event.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the memory region.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.all_names",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A sequence of signature names matched.",
+                            "example": "Windows.EICAR.Not-a-virus"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.identifier",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature identifier"
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The first matching details."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The first matching details.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of file matching signature."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of file matching signature."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the first yara rule matched."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.primary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the first yara rule matched."
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Additional matching details if available.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.matches",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The second matching details.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.signature.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "hash of second file matching signature.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.signature.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "sha256 hash of second file matching signature.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.signature.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The id of the second yara rule matched.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.secondary.signature.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the second yara rule matched.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "Ext.memory_region.malware_signature.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "malware signature version"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
+                            "example": "C:\\Windows\\System32\\mshtml.dll"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.pehash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
+                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "PE Section List name."
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "Ext.memory_region.mapped_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether the file at mapped_path is an executable.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.dotnet",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether this file is a .NET PE",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's relevant sections, if it is a PE"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.sections.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The section's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The file's streams, if it is a PE"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.md5",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "MD5 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha1",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA1 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha256",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA256 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha384",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA384 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha512",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SHA512 hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "SSDEEP hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.tlsh",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "TLSH hash."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.Ext.streams.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The stream's name",
+                            "example": ".reloc"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.architecture",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "CPU architecture target for the file.",
+                            "example": "x64"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.company",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal company name of the file, provided at compile-time.",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.description",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal description of the file, provided at compile-time.",
+                            "example": "Paint"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.file_version",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal version of the file, provided at compile-time.",
+                            "example": "6.3.9600.17415"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
+                            "example": "10bddcb4cee42080f76c88d9ff964491"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported Go language element names and types."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.go_stripped",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imphash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+                            "example": "0c6803c4e922103c4dca5963aad36ddf"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.import_hash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
+                            "example": "d41d8cd98f00b204e9800998ecf8427e"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imports",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "flattened",
+                            "description": "List of imported element names and types."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imports_names_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.imports_names_var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.original_file_name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal name of the file, provided at compile-time.",
+                            "example": "MSPAINT.EXE"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.pehash",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
+                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.product",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Internal product name of the file, provided at compile-time.",
+                            "example": "Microsoft® Windows® Operating System"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "nested",
+                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.name",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "PE Section List name."
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.physical_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List physical size.",
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.var_entropy",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Variance for Shannon entropy calculation from the section.",
+                            "format": "number"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe.sections.virtual_size",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "long",
+                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "Ext.memory_region.memory_pe_detected",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Whether an executable file was found in memory.",
+                            "example": false
+                        },
+                        {
+                            "name": "Ext.memory_region.region_base",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Base address of the memory region.",
+                            "example": 2431737462784
+                        },
+                        {
+                            "name": "Ext.memory_region.region_protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "Ext.memory_region.region_size",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Size of the memory region.",
+                            "example": 4096
+                        },
+                        {
+                            "name": "Ext.memory_region.region_start_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "First 64 bytes at the region base address.",
+                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
+                        },
+                        {
+                            "name": "Ext.memory_region.region_state",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+                            "example": "COMMIT"
+                        },
+                        {
+                            "name": "Ext.memory_region.strings",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Array of strings found within the memory region.",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "Ext.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+                        },
+                        {
+                            "name": "Ext.token.integrity_level_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Human readable integrity level.",
+                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "command_line",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh -l user 10.0.0.16"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "thread.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+                            "enabled": false
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes preceding the callsite"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hex opcode bytes after the callsite (where control will return to)"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.instruction_pointer",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The return address of this stack frame."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.module_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path to the DLL/module containing `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.protection_provenance",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the memory region that last modified the protection of this page.  \"Unbacked\" can indicate shellcode."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack.symbol_info",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The nearest symbol for `instruction_pointer`."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_contains_unbacked",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The module that installed the final API hook in the call stack."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_hook_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_hook_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_hook_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_hook_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_hook_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "The final non-win32 module in the call stack."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.allocation_private_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The number of bytes in this memory region that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.hash",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Hashes of the call_stack_final_user_module."
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.hash.sha256",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The sha256 of the call_stack_final_user_module.",
+                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file name of the call_stack_final_user_module.",
+                            "example": "example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file path of the call_stack_final_user_module.",
+                            "example": "C:\\Program Files\\Example\\example.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.protection",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The memory protection for the acting region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
+                            "example": "RWX"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.protection_provenance",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name of the memory region that caused the last modification of the protection of this page. \"Unbacked\" may indicate shellcode.",
+                            "example": "third_party_hook.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.protection_provenance_path",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The path of the module that caused the last modification the protection of this page.",
+                            "example": "C:\\Program Files\\Hook Inc\\third_party_hook.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_final_user_module.reason",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The unexpected call_stack_summary that led to an \"Undetermined\" protection_provenance.",
+                            "example": "ntdll.dll|kernelbase.dll"
+                        },
+                        {
+                            "name": "thread.Ext.call_stack_summary",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Concatentation of the non-repeated modules in the call stack.",
+                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "@timestamp": "2023-01-09T19:38:51.5141503Z",
+                "Target": {
+                    "process": {
+                        "Ext": {
+                            "created_suspended": true,
+                            "protection": "PsProtectedSignerWinTcb",
+                            "memory_region": {
+                                "allocation_base": 1649160290304,
+                                "allocation_protection": "RWX",
+                                "allocation_size": 4096,
+                                "allocation_type": "PRIVATE",
+                                "bytes_address": 1649160290304,
+                                "bytes_allocation_offset": 0,
+                                "bytes_compressed": "eJztwbEJACAMALA+5uAtWnAoOPg/+EWnJO9k1bo742XuMRsEAAAA0OsD8lge9g==",
+                                "bytes_compressed_present": true,
+                                "hash": {
+                                    "sha256": "0b28b598ef70fd2377613fd88a50d52047ae31c16f2c688f3aa4e0b98d63730c"
+                                },
+                                "memory_pe_detected": false,
+                                "region_base": 1649160290304,
+                                "region_protection": "R--",
+                                "region_size": 4096,
+                                "region_state": "COMMIT",
+                                "strings": [
+                                    "shellcode",
+                                    "seed=AAAA"
+                                ]
+                            },
+                            "token": {
+                                "integrity_level_name": "high"
+                            }
+                        },
+                        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI1NzMyLTE2OTkwMDE3NDAuOTU4NTY4MDAw",
+                        "executable": "C:\\Temp\\1_StayRunningWin32_x64.exe",
+                        "name": "1_StayRunningWin32_x64.exe",
+                        "pid": 25732
+                    }
+                },
+                "dll": {
+                    "Ext": {
+                        "code_signature": [
+                            {
+                                "exists": true,
+                                "status": "trusted",
+                                "subject_name": "Microsoft Windows",
+                                "trusted": true
+                            }
+                        ]
+                    },
+                    "hash": {
+                        "sha256": "8b9731a4b83e801cda7b918f8194608e91f86b3a86ffb6bb24230b1cc28e1a54"
+                    },
+                    "path": "c:\\windows\\system32\\drivers\\pktmon.sys"
+                },
+                "destination": {
+                    "ip": "2001:4860:4860::8844",
+                    "port": 139
+                },
+                "event": {
+                    "category": [
+                        "api",
+                        "intrusion_detection"
+                    ],
+                    "created": "2023-01-09T19:38:51.5141503Z",
+                    "dataset": "endpoint.events.api",
+                    "id": "MvlgiHxIZtj1+Abi++++++ul",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "outcome": "success",
+                    "provider": "Microsoft-Windows-Threat-Intelligence",
+                    "sequence": 3802,
+                    "type": [
+                        "credential_access"
+                    ]
+                },
+                "host": {
+                    "architecture": "x86_64",
+                    "hostname": "DESKTOP-OCG8CR6",
+                    "id": "dabadaba-0000-0000-0000-000000000000",
+                    "ip": [
+                        "169.254.104.226",
+                        "fe80::6037:d589:2ee9:772f",
+                        "172.22.6.230",
+                        "fe80::80ea:8e8d:e1f2:6622",
+                        "169.254.74.35",
+                        "fe80::900c:a9d3:fd8:9345",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "mac": [
+                        "00-15-5D-00-09-18",
+                        "00-15-5D-00-09-19",
+                        "00-15-5D-00-09-17"
+                    ],
+                    "name": "DESKTOP-OCG8CR6",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows 11 Enterprise N"
+                        },
+                        "family": "windows",
+                        "full": "Windows 11 Enterprise N 22H2 (10.0.22621.963)",
+                        "kernel": "22H2 (10.0.22621.963)",
+                        "name": "Windows",
+                        "platform": "windows",
+                        "type": "windows",
+                        "version": "22H2 (10.0.22621.963)"
+                    }
+                },
+                "message": "Endpoint API event - hand-crafted with a superset of fields",
+                "network": {
+                    "transport": "tcp",
+                    "type": "ipv6"
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTgxMi0xNjczMjkxNTMzLjcxNjczMTgwMA==",
+                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ5NjAtMTY3Mjk2NTgzMC4yODc0OTYxMDA=",
+                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTY2MjgtMTY3Mjk2NTc3Mi41MTg4MDA1MDA=",
+                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ2MDAtMTY3Mjk2NTcxMy40NzY1NDUyMDA="
+                        ],
+                        "api": {
+                            "behaviors": [
+                                "cross-process",
+                                "rapid_background_polling",
+                                "multiple_polling_processes",
+                                "pid_spoofing"
+                            ],
+                            "metadata": {
+                                "target_address_name": "Unbacked",
+                                "target_address_path": "c:\\windows\\system32\\ntdll.dll",
+                                "return_value": 1,
+                                "windows_count": 2,
+                                "visible_windows_count": 0,
+                                "thread_info_flags": 16,
+                                "start_address_module": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe",
+                                "start_address_allocation_protection": "RCX",
+                                "procedure_symbol": "taskbar.dll",
+                                "ms_since_last_keyevent": 94,
+                                "background_callcount": 6021,
+                                "security_descriptor": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)",
+                                "client_machine": "DESKTOP-EXAMPLE",
+                                "client_machine_fqdn": "DESKTOP-EXAMPLE",
+                                "client_process_id": 3600,
+                                "client_is_local": true,
+                                "amsi_filenames": [
+                                    "C:\\script.ps1"
+                                ],
+                                "amsi_logs": {
+                                    "entries": [
+                                        "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
+                                    ],
+                                    "type": "PowerShell"
+                                }
+                            },
+                            "name": "OpenProcess",
+                            "parameters": {
+                                "desired_access": [
+                                    "PROCESS_QUERY_LIMITED_INFORMATION",
+                                    "PROCESS_VM_READ"
+                                ],
+                                "desired_access_numeric": 4112,
+                                "handle_type": "process",
+                                "address": 2904525045760,
+                                "allocation_type": "COMMIT|RESERVE",
+                                "protection": "R-X",
+                                "protection_old": "R-X",
+                                "size": 16,
+                                "context_flags": 1048607,
+                                "r8": 8,
+                                "r9": 9,
+                                "rax": 10,
+                                "rbp": 3,
+                                "rbx": 11,
+                                "rcx": 2883351609344,
+                                "rdi": 5,
+                                "rdx": 13,
+                                "rip": 140706538588528,
+                                "rsi": 4,
+                                "rsp": 2,
+                                "eax": 10,
+                                "ebp": 3,
+                                "ebx": 11,
+                                "ecx": 12,
+                                "edi": 5,
+                                "edx": 0,
+                                "eip": 1,
+                                "esi": 4,
+                                "esp": 2,
+                                "argument1": 2583984274656,
+                                "argument2": 4105953215,
+                                "argument3": 31058890,
+                                "procedure": 140705553857280,
+                                "usage_page": "GENERIC",
+                                "usage": "KEYBOARD",
+                                "flags": "INPUTSINK",
+                                "hook_type": "WH_KEYBOARD_LL",
+                                "hook_module": "c:\\windows\\system32\\taskbar.dll",
+                                "device": "\\Device\\PktMonDev",
+                                "io_control_code": 27365,
+                                "event_filter_name": "ExampleFilter",
+                                "event_filter_details": "__EventFilter{EventNamespace = \"root\\CimV2\"; Name = \"ExampleFilter\";};",
+                                "consumer_name": "ExampleConsumer",
+                                "consumer_type": "CommandLineEventConsumer",
+                                "consumer_details": "CommandLineEventConsumer{Name = \"ExampleConsumer\";};",
+                                "namespace": "root\\Microsoft\\Windows\\DeviceGuard",
+                                "operation": "Win32_Process::Create",
+                                "app_name": "PowerShell",
+                                "content_name": "C:\\script.ps1",
+                                "buffer": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
+                            },
+                            "summary": "VirtualAllocEx( charmap.exe, NULL, 0x10, COMMIT|RESERVE, R-X )"
+                        },
+                        "code_signature": [
+                            {
+                                "exists": true,
+                                "status": "errorBadDigest",
+                                "subject_name": "Microsoft Windows",
+                                "trusted": false
+                            }
+                        ],
+                        "memory_region": {
+                            "allocation_base": 140712018378752,
+                            "allocation_protection": "RCX",
+                            "allocation_size": 45056,
+                            "allocation_type": "IMAGE",
+                            "mapped_path": "C:\\Program Files\\Python39\\DLLs\\libffi-7.dll",
+                            "region_base": 140712018395136,
+                            "region_protection": "R-X",
+                            "region_size": 8192,
+                            "region_state": "COMMIT"
+                        },
+                        "token": {
+                            "integrity_level_name": "system"
+                        }
+                    },
+                    "code_signature": {
+                        "exists": true,
+                        "status": "errorBadDigest",
+                        "subject_name": "Microsoft Windows",
+                        "trusted": false
+                    },
+                    "command_line": "",
+                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTkxNi0xNjczMjkzMTMwLjk0NjAwMjAw",
+                    "executable": "c\\git\\endpoint-dev\\Tools\\Leia\\modules\\exe_malware\\mimikatz.exe",
+                    "name": "mimikatz.exe",
+                    "pid": 916,
+                    "thread": {
+                        "Ext": {
+                            "call_stack": [
+                                {
+                                    "allocation_private_bytes": 4096,
+                                    "protection_provenance": "dabapi.dll",
+                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!ZwProtectVirtualMemory+0x14"
+                                },
+                                {
+                                    "symbol_info": "c:\\windows\\system32\\kernelbase.dll!VirtualProtect+0x36"
+                                },
+                                {
+                                    "allocation_private_bytes": 8192,
+                                    "callsite_leading_bytes": "c048895424204c8bc9488d0d801f0000418d500248ff15052a00000f1f4400004883c438c3cccccccccccccccccccccc4883ec2048b880bf1acaf87f0000ffd0",
+                                    "callsite_trailing_bytes": "4883c420c3ec48498363e800498d4320ba2500000049c743e004000000440fb7ca4c8d05d0320000ba2b000000498943d848ff15f82a00000f1f4400004883c4",
+                                    "protection": "RWX",
+                                    "protection_provenance": "eventstests.exe",
+                                    "symbol_info": "c:\\windows\\system32\\dabapi.dll!DabApiBufferFree+0x10"
+                                },
+                                {
+                                    "symbol_info": "Unknown"
+                                }
+                            ],
+                            "call_stack_final_user_module": {
+                                "allocation_private_bytes": 4096,
+                                "code_signature": [
+                                    {
+                                        "exists": true,
+                                        "status": "trusted",
+                                        "subject_name": "Microsoft Windows",
+                                        "trusted": true
+                                    }
+                                ],
+                                "hash": {
+                                    "sha256": "0386c57d59ee1292bb74d9878358da7a0ba00e5b56ed52fd6171b9e6d29d85aa"
+                                },
+                                "name": "dabapi.dll",
+                                "path": "c:\\windows\\system32\\dabapi.dll",
+                                "protection": "RWX",
+                                "protection_provenance": "eventstests.exe",
+                                "protection_provenance_path": "c:\\dev\\eventstests.exe",
+                                "reason": "ntdll.dll"
+                            },
+                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll"
+                        },
+                        "id": 11628
+                    }
+                },
+                "user": {
+                    "domain": "DESKTOP-OCG8CR6",
+                    "id": "S-1-5-21-3820246941-898183108-3095036578-1001",
+                    "name": "User"
+                }
+            }
+        },
+        {
+            "name": "network",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "destination",
+                    "title": "Destination",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "address",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
+                        },
+                        {
+                            "name": "as.number",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
+                            "example": 15169
+                        },
+                        {
+                            "name": "as.organization.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Organization name.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Google LLC"
+                        },
+                        {
+                            "name": "bytes",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Bytes sent from the destination to the source.",
+                            "example": 184,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "domain",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.",
+                            "example": "foo.example.com"
+                        },
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the destination (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "packets",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Packets sent from the destination to the source.",
+                            "example": 12
+                        },
+                        {
+                            "name": "port",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Port of the destination.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "registered_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "top_level_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "dns",
+                    "title": "DNS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.options",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "DNS options field, uint64, representing as a keyword to avoid overflows in ES"
+                        },
+                        {
+                            "name": "Ext.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "DNS status field, uint32"
+                        },
+                        {
+                            "name": "question.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
+                            "example": "www.example.com"
+                        },
+                        {
+                            "name": "question.registered_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "question.subdomain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The subdomain is all of the labels under the registered_domain.\nIf the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
+                            "example": "www"
+                        },
+                        {
+                            "name": "question.top_level_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        },
+                        {
+                            "name": "question.type",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The type of record being queried.",
+                            "example": "AAAA"
+                        },
+                        {
+                            "name": "resolved_ip",
+                            "level": "extended",
+                            "type": "ip",
+                            "description": "Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.",
+                            "example": "[\"10.10.10.10\", \"10.10.10.11\"]"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "group",
+                    "title": "Group",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The group fields are meant to represent groups that are relevant to the event.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "http",
+                    "title": "HTTP",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields related to HTTP activity. Use the `url` field set to store the url of the request.",
+                    "fields": [
+                        {
+                            "name": "request.body.bytes",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Size in bytes of the request body.",
+                            "example": 887,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "request.body.content",
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "The full HTTP request body.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Hello world"
+                        },
+                        {
+                            "name": "request.bytes",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Total size in bytes of the request (body and headers).",
+                            "example": 1437,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "response.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "response.Ext.version",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "HTTP version"
+                        },
+                        {
+                            "name": "response.body.bytes",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Size in bytes of the response body.",
+                            "example": 887,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "response.body.content",
+                            "level": "extended",
+                            "type": "wildcard",
+                            "description": "The full HTTP response body.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Hello world"
+                        },
+                        {
+                            "name": "response.bytes",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Total size in bytes of the response (body and headers).",
+                            "example": 1437,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "response.status_code",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "HTTP response status code.",
+                            "example": 404,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "network",
+                    "title": "Network",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.",
+                    "fields": [
+                        {
+                            "name": "bytes",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Total bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.",
+                            "example": 368,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "community_id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec.",
+                            "example": "1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0="
+                        },
+                        {
+                            "name": "direction",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Direction of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values \"ingress\" or \"egress\".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values \"inbound\", \"outbound\", \"internal\" or \"external\".\nNote that \"internal\" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that \"external\" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.",
+                            "example": "inbound"
+                        },
+                        {
+                            "name": "iana_number",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.",
+                            "example": 6
+                        },
+                        {
+                            "name": "packets",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Total packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum.",
+                            "example": 24
+                        },
+                        {
+                            "name": "protocol",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying.",
+                            "example": "http"
+                        },
+                        {
+                            "name": "transport",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
+                            "example": "tcp"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
+                            "example": "ipv4"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "process",
+                    "title": "Process",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.ancestry",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "An array of entity_ids indicating the ancestors for this event"
+                        },
+                        {
+                            "name": "Ext.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Nested version of ECS code_signature fieldset."
+                        },
+                        {
+                            "name": "Ext.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "Ext.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "Ext.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "Ext.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.exists",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+                            "example": "com.apple.xpc.proxy"
+                        },
+                        {
+                            "name": "code_signature.status",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT"
+                        },
+                        {
+                            "name": "code_signature.subject_name",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation"
+                        },
+                        {
+                            "name": "code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+                            "example": "EQHXZ8M8AV"
+                        },
+                        {
+                            "name": "code_signature.trusted",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "code_signature.valid",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true"
+                        },
+                        {
+                            "name": "entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "entry_leader.parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "executable",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Absolute path to the process executable.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "/usr/bin/ssh"
+                        },
+                        {
+                            "name": "group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Process name.\nSometimes called program name or similar.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "ssh"
+                        },
+                        {
+                            "name": "parent.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "parent.group_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "pid",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Process id.",
+                            "example": 4242,
+                            "format": "string"
+                        },
+                        {
+                            "name": "session_leader.entity_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+                            "example": "c2c455d9f99375d"
+                        },
+                        {
+                            "name": "thread.id",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Thread ID.",
+                            "example": 4242,
+                            "format": "string"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "source",
+                    "title": "Source",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
+                    "fields": [
+                        {
+                            "name": "address",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
+                        },
+                        {
+                            "name": "as.number",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
+                            "example": 15169
+                        },
+                        {
+                            "name": "as.organization.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Organization name.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Google LLC"
+                        },
+                        {
+                            "name": "bytes",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Bytes sent from the source to the destination.",
+                            "example": 184,
+                            "format": "bytes"
+                        },
+                        {
+                            "name": "domain",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.",
+                            "example": "foo.example.com"
+                        },
+                        {
+                            "name": "geo.city_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "City name.",
+                            "example": "Montreal"
+                        },
+                        {
+                            "name": "geo.continent_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Two-letter code representing continent's name.",
+                            "example": "NA"
+                        },
+                        {
+                            "name": "geo.continent_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the continent.",
+                            "example": "North America"
+                        },
+                        {
+                            "name": "geo.country_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country ISO code.",
+                            "example": "CA"
+                        },
+                        {
+                            "name": "geo.country_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Country name.",
+                            "example": "Canada"
+                        },
+                        {
+                            "name": "geo.location",
+                            "level": "core",
+                            "type": "geo_point",
+                            "description": "Longitude and latitude.",
+                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
+                        },
+                        {
+                            "name": "geo.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+                            "example": "boston-dc"
+                        },
+                        {
+                            "name": "geo.postal_code",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+                            "example": 94040
+                        },
+                        {
+                            "name": "geo.region_iso_code",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region ISO code.",
+                            "example": "CA-QC"
+                        },
+                        {
+                            "name": "geo.region_name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Region name.",
+                            "example": "Quebec"
+                        },
+                        {
+                            "name": "geo.timezone",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The time zone of the location, such as IANA time zone name.",
+                            "example": "America/Argentina/Buenos_Aires"
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "IP address of the source (IPv4 or IPv6)."
+                        },
+                        {
+                            "name": "packets",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Packets sent from the source to the destination.",
+                            "example": 12
+                        },
+                        {
+                            "name": "port",
+                            "level": "core",
+                            "type": "long",
+                            "description": "Port of the source.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "registered_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
+                            "example": "example.com"
+                        },
+                        {
+                            "name": "top_level_domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
+                            "example": "co.uk"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "user",
+                    "title": "User",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
+                    "fields": [
+                        {
+                            "name": "Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "User info prior to any setuid operations."
+                        },
+                        {
+                            "name": "Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "One or multiple unique identifiers of the user."
+                        },
+                        {
+                            "name": "Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user."
+                        },
+                        {
+                            "name": "domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "email",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User email address."
+                        },
+                        {
+                            "name": "full_name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "User's full name, if available.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Albert Einstein"
+                        },
+                        {
+                            "name": "group.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "group.Ext.real",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Group info prior to any setgid operations."
+                        },
+                        {
+                            "name": "group.Ext.real.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.Ext.real.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "group.domain",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+                        },
+                        {
+                            "name": "group.id",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier for the group on the system/platform."
+                        },
+                        {
+                            "name": "group.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the group."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of the user.",
+                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Short name or login of the user.",
+                            "multi_fields": [
+                                {
+                                    "name": "text",
+                                    "type": "match_only_text",
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "a.einstein"
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "id": "afd348c6-0ec9-4961-805e-8ed2fc4c043b",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "process": {
+                    "Ext": {
+                        "ancestry": [
+                            "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTYxMi0xMzI5MzU0OTEwOS43MzU5NDk3MDA=",
+                            "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTQ3Ni0xMzI5MzU0OTEwOS4zODExMTM3MDA="
+                        ],
+                        "code_signature": [
+                            {
+                                "trusted": false,
+                                "subject_name": "Google LLC",
+                                "exists": true,
+                                "status": "errorExpired"
+                            }
+                        ]
+                    },
+                    "parent": {
+                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
+                        "group_leader": {
+                            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+                        }
+                    },
+                    "entry_leader": {
+                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
+                        "parent": {
+                            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+                        }
+                    },
+                    "session_leader": {
+                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+                    },
+                    "group_leader": {
+                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+                    },
+                    "code_signature": {
+                        "trusted": false,
+                        "subject_name": "Google LLC",
+                        "exists": true,
+                        "status": "errorExpired"
+                    },
+                    "name": "GCEWindowsAgent.exe",
+                    "pid": 580,
+                    "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
+                    "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
+                },
+                "destination": {
+                    "geo": {
+                        "continent_name": "North America",
+                        "country_iso_code": "US",
+                        "country_name": "United States",
+                        "location": {
+                            "lon": -97.822,
+                            "lat": 37.751
+                        }
+                    },
+                    "as": {
+                        "number": 15169,
+                        "organization": {
+                            "name": "GOOGLE"
+                        }
+                    },
+                    "address": "64.233.191.95",
+                    "port": 443,
+                    "bytes": 4923,
+                    "ip": "64.233.191.95"
+                },
+                "source": {
+                    "address": "10.201.0.32",
+                    "port": 54924,
+                    "bytes": 498,
+                    "ip": "10.201.0.32"
+                },
+                "dns": {
+                    "Ext": {
+                        "status": 123,
+                        "options": 9223372036854775808
+                    },
+                    "resolved_ip": [
+                        "10.10.10.10",
+                        "10.10.10.11"
+                    ],
+                    "question": {
+                        "name": "foo",
+                        "type": "A"
+                    }
+                },
+                "message": "Endpoint network event",
+                "network": {
+                    "transport": "tcp",
+                    "type": "ipv4",
+                    "direction": "egress"
+                },
+                "@timestamp": "2022-04-04T18:52:00.6007809Z",
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "logs",
+                    "dataset": "endpoint.events.network"
+                },
+                "host": {
+                    "hostname": "mgmt-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.32",
+                        "fe80::f8e6:a511:69ea:27c4",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "mgmt-win-1",
+                    "id": "51b19c6c-27e3-4c80-ac2a-b72ed52c40c9",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 36090,
+                    "ingested": "2022-04-04T18:52:21Z",
+                    "created": "2022-04-04T18:52:00.6007809Z",
+                    "kind": "event",
+                    "module": "endpoint",
+                    "action": "disconnect_received",
+                    "id": "MYfZG5h8j1qej16H+++++CFe",
+                    "category": [
+                        "network"
+                    ],
+                    "type": [
+                        "end"
+                    ],
+                    "dataset": "endpoint.events.network"
+                },
+                "user": {
+                    "domain": "NT AUTHORITY",
+                    "name": "SYSTEM",
+                    "id": "S-1-5-18"
+                }
+            }
+        },
+        {
+            "name": "metrics",
+            "fields": [
+                {
+                    "name": "@timestamp",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "date",
+                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+                    "required": true,
+                    "example": "2016-05-23T08:05:34.853Z"
+                },
+                {
+                    "name": "message",
+                    "default_field": true,
+                    "level": "core",
+                    "type": "match_only_text",
+                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+                    "example": "Hello World"
+                },
+                {
+                    "name": "Endpoint",
+                    "title": "Endpoint",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
+                    "fields": [
+                        {
+                            "name": "metrics",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Metrics fields hold the endpoint and system's performance metrics"
+                        },
+                        {
+                            "name": "metrics.cpu",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "CPU statistics"
+                        },
+                        {
+                            "name": "metrics.cpu.endpoint",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "CPU metrics for the endpoint"
+                        },
+                        {
+                            "name": "metrics.cpu.endpoint.histogram",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "histogram",
+                            "description": "This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket"
+                        },
+                        {
+                            "name": "metrics.cpu.endpoint.latest",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "half_float",
+                            "description": "Average CPU over the last sample interval"
+                        },
+                        {
+                            "name": "metrics.cpu.endpoint.mean",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "half_float",
+                            "description": "Average CPU load used by the endpoint"
+                        },
+                        {
+                            "name": "metrics.disks",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "An array of disk information for the host",
+                            "enabled": false
+                        },
+                        {
+                            "name": "metrics.disks.device",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Device name"
+                        },
+                        {
+                            "name": "metrics.disks.endpoint_drive",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "This field will be present and set to true only for the drive that holds the installed endpoint"
+                        },
+                        {
+                            "name": "metrics.disks.free",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The number of bytes marked as free on the disk"
+                        },
+                        {
+                            "name": "metrics.disks.fstype",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The file system type for the drive"
+                        },
+                        {
+                            "name": "metrics.disks.mount",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The disks mount location"
+                        },
+                        {
+                            "name": "metrics.disks.total",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The size of the disk in bytes"
+                        },
+                        {
+                            "name": "metrics.documents_volume",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Statistics about sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.alerts.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.alerts.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.alerts.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.alerts.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of API Event sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent API Event documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "An array of API Event document statistics per source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of API Event sent documents from source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent API Event documents from source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.source",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "API Event document source name"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed API Event documents from source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.sources.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed API Event documents from source"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed API Event documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.api_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed API Event documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.diagnostic_alerts.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.diagnostic_alerts.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.diagnostic_alerts.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.diagnostic_alerts.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.dns_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.dns_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.dns_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.dns_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.file_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.file_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.file_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.file_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.library_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.library_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.library_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.library_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.network_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.network_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.network_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.network_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.overall.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.overall.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.overall.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.overall.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.process_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.process_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.process_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.process_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.registry_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.registry_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.registry_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.registry_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.security_events.sent_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.security_events.sent_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of sent documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.security_events.suppressed_bytes",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Total size of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.documents_volume.security_events.suppressed_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of suppressed documents"
+                        },
+                        {
+                            "name": "metrics.event_filter.active_global_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The number of active global event filters",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.event_filter.active_user_count",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The number of active user event filters",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.malicious_behavior_rules",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "An array of performance information about each malicious behavior rule",
+                            "enabled": false
+                        },
+                        {
+                            "name": "metrics.malicious_behavior_rules.endpoint_uptime_percent",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "Perfect of Endpoint's update spent running the rule",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.malicious_behavior_rules.id",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The rule id",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.memory",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Memory statistics"
+                        },
+                        {
+                            "name": "metrics.memory.endpoint",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Endpoint memory utilization"
+                        },
+                        {
+                            "name": "metrics.memory.endpoint.private",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "The memory private to the endpoint"
+                        },
+                        {
+                            "name": "metrics.memory.endpoint.private.latest",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "The memory usage by the endpoint for the last sample interval"
+                        },
+                        {
+                            "name": "metrics.memory.endpoint.private.mean",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Average memory usage by the endpoint since its start"
+                        },
+                        {
+                            "name": "metrics.system_impact",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "An array of system impact information",
+                            "enabled": false,
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.authentication_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing authentication events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.authentication_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on authentication events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.dns_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing DNS events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.dns_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on DNS events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.file_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing file events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.file_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on file events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.library_load_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing library load events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.library_load_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on library load events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.malware.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing malware scanning due to the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.malware.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on malware scanning due to the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.network_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing network events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.network_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on network events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.overall.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing activity for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.overall.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent monitoring the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "nested",
+                            "description": "Code signature of the process",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.exists",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if a signature is present.",
+                            "example": "true",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.signing_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "description": "'The identifier used to sign the binary.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'",
+                            "example": "com.apple.xpc.proxy",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.status",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+                            "example": "ERROR_UNTRUSTED_ROOT",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.subject_name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "Subject name of the code signer",
+                            "example": "Microsoft Corporation",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.team_id",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "description": "'The team identifier used to sign the binary.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'",
+                            "example": "EQHXZ8M8AV",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.trusted",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+                            "example": "true",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.code_signature.valid",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "boolean",
+                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+                            "example": "true",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process.executable",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "Path to the process executable for the impact entry",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing process events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.process_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on process events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.registry_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing registry events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.registry_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on registry events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.threat_intelligence_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.threat_intelligence_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.win32k_events.week_idle_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.system_impact.win32k_events.week_ms",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "unsigned_long",
+                            "description": "The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.threads",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Statistics about the individual Endpoint threads (array)",
+                            "enabled": false
+                        },
+                        {
+                            "name": "metrics.threads.cpu.mean",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "double",
+                            "description": "The thread's average CPU use",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.threads.name",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "description": "The thread name",
+                            "doc_values": false,
+                            "index": false
+                        },
+                        {
+                            "name": "metrics.uptime",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Number of seconds since boot"
+                        },
+                        {
+                            "name": "metrics.uptime.endpoint",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of seconds since the endpoint was started"
+                        },
+                        {
+                            "name": "metrics.uptime.system",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "long",
+                            "description": "Number of seconds since the system was started"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "agent",
+                    "title": "Agent",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
+                    "fields": [
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+                            "example": "filebeat"
+                        },
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Version of the agent.",
+                            "example": "6.0.0-rc2"
+                        }
+                    ],
+                    "group": 2,
+                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
+                },
+                {
+                    "name": "data_stream",
+                    "title": "data_stream",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
+                    "fields": [
+                        {
+                            "name": "dataset",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream dataset name.",
+                            "example": "nginx.access"
+                        },
+                        {
+                            "name": "namespace",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream namespace.",
+                            "example": "production"
+                        },
+                        {
+                            "name": "type",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "constant_keyword",
+                            "description": "Data stream type.",
+                            "example": "logs"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "ecs",
+                    "title": "ECS",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "Meta-information specific to ECS.",
+                    "fields": [
+                        {
+                            "name": "version",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+                            "required": true,
+                            "example": "1.0.0"
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "event",
+                    "title": "Event",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
+                    "fields": [
+                        {
+                            "name": "action",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+                            "example": "user-password-change"
+                        },
+                        {
+                            "name": "category",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+                            "example": "authentication"
+                        },
+                        {
+                            "name": "code",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+                            "example": 4648
+                        },
+                        {
+                            "name": "created",
+                            "level": "core",
+                            "type": "date",
+                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+                            "example": "2016-05-23T08:05:34.857Z"
+                        },
+                        {
+                            "name": "dataset",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+                            "example": "apache.access"
+                        },
+                        {
+                            "name": "end",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
+                        },
+                        {
+                            "name": "hash",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+                            "example": "123456789012345678901234567890ABCD"
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique ID to describe the event.",
+                            "example": "8a4f500d"
+                        },
+                        {
+                            "name": "ingested",
+                            "default_field": false,
+                            "level": "core",
+                            "type": "date",
+                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+                            "example": "2016-05-23T08:05:35.101Z"
+                        },
+                        {
+                            "name": "kind",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+                            "example": "alert"
+                        },
+                        {
+                            "name": "module",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+                            "example": "apache"
+                        },
+                        {
+                            "name": "outcome",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+                            "example": "success"
+                        },
+                        {
+                            "name": "provider",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+                            "example": "kernel"
+                        },
+                        {
+                            "name": "sequence",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+                            "format": "string"
+                        },
+                        {
+                            "name": "severity",
+                            "level": "core",
+                            "type": "long",
+                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+                            "example": 7,
+                            "format": "string"
+                        },
+                        {
+                            "name": "start",
+                            "level": "extended",
+                            "type": "date",
+                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+                        }
+                    ],
+                    "group": 2
+                },
+                {
+                    "name": "host",
+                    "title": "Host",
+                    "default_field": true,
+                    "type": "group",
+                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
+                    "fields": [
+                        {
+                            "name": "architecture",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system architecture.",
+                            "example": "x86_64"
+                        },
+                        {
+                            "name": "domain",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+                            "example": "CONTOSO"
+                        },
+                        {
+                            "name": "hostname",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+                        },
+                        {
+                            "name": "id",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+                        },
+                        {
+                            "name": "ip",
+                            "level": "core",
+                            "type": "ip",
+                            "description": "Host ip addresses."
+                        },
+                        {
+                            "name": "mac",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
+                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
+                        },
+                        {
+                            "name": "name",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+                        },
+                        {
+                            "name": "os.Ext",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "object",
+                            "description": "Object for all custom defined fields to live in."
+                        },
+                        {
+                            "name": "os.Ext.variant",
+                            "default_field": false,
+                            "level": "custom",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+                            "example": "Ubuntu"
+                        },
+                        {
+                            "name": "os.family",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "OS family (such as redhat, debian, freebsd, windows).",
+                            "example": "debian"
+                        },
+                        {
+                            "name": "os.full",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, including the version or code name.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS Mojave"
+                        },
+                        {
+                            "name": "os.kernel",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system kernel version as a raw string.",
+                            "example": "4.4.0-112-generic"
+                        },
+                        {
+                            "name": "os.name",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system name, without the version.",
+                            "multi_fields": [
+                                {
+                                    "name": "caseless",
+                                    "type": "keyword",
+                                    "normalizer": "lowercase",
+                                    "ignore_above": 1024,
+                                    "default_field": false
+                                },
+                                {
+                                    "name": "text",
+                                    "type": "text",
+                                    "norms": false,
+                                    "default_field": false
+                                }
+                            ],
+                            "example": "Mac OS X"
+                        },
+                        {
+                            "name": "os.platform",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system platform (such centos, ubuntu, windows).",
+                            "example": "darwin"
+                        },
+                        {
+                            "name": "os.type",
+                            "default_field": false,
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+                            "example": "macos"
+                        },
+                        {
+                            "name": "os.version",
+                            "level": "extended",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Operating system version as a raw string.",
+                            "example": "10.14.1"
+                        },
+                        {
+                            "name": "type",
+                            "level": "core",
+                            "type": "keyword",
+                            "ignore_above": 1024,
+                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+                        },
+                        {
+                            "name": "uptime",
+                            "level": "extended",
+                            "type": "long",
+                            "description": "Seconds the host has been up.",
+                            "example": 1325
+                        }
+                    ],
+                    "group": 2
+                }
+            ],
+            "sample_event": {
+                "agent": {
+                    "build": {
+                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+                    },
+                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+                    "type": "endpoint",
+                    "version": "8.3.0-SNAPSHOT"
+                },
+                "message": "Endpoint metrics",
+                "@timestamp": "2022-04-04T18:38:15.7178887Z",
+                "Endpoint": {
+                    "metrics": {
+                        "system_impact": [
+                            {
+                                "file_events": {
+                                    "week_ms": 418
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows Publisher",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\svchost.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 7483
+                                },
+                                "process_events": {
+                                    "week_ms": 78
+                                },
+                                "registry_events": {
+                                    "week_ms": 248
+                                },
+                                "dns_events": {
+                                    "week_ms": 16
+                                },
+                                "network_events": {
+                                    "week_ms": 8
+                                },
+                                "overall": {
+                                    "week_ms": 11744
+                                },
+                                "authentication_events": {
+                                    "week_ms": 155
+                                },
+                                "library_load_events": {
+                                    "week_ms": 3028
+                                },
+                                "cred_access_events": {
+                                    "week_ms": 10
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 250
+                                },
+                                "win32k_events": {
+                                    "week_ms": 50
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 46
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 2
+                                },
+                                "process_events": {
+                                    "week_ms": 19
+                                },
+                                "registry_events": {
+                                    "week_ms": 3
+                                },
+                                "overall": {
+                                    "week_ms": 8290
+                                },
+                                "library_load_events": {
+                                    "week_ms": 7890
+                                },
+                                "cred_access_events": {
+                                    "week_ms": 20
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 300
+                                },
+                                "win32k_events": {
+                                    "week_ms": 10
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 1641
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Elasticsearch, Inc.",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 2589
+                                },
+                                "process_events": {
+                                    "week_ms": 419
+                                },
+                                "registry_events": {
+                                    "week_ms": 1
+                                },
+                                "network_events": {
+                                    "week_ms": 32
+                                },
+                                "overall": {
+                                    "week_ms": 5046
+                                },
+                                "library_load_events": {
+                                    "week_ms": 4
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 360
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 2
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows Publisher",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\lsass.exe"
+                                },
+                                "process_events": {
+                                    "week_ms": 3
+                                },
+                                "registry_events": {
+                                    "week_ms": 83
+                                },
+                                "overall": {
+                                    "week_ms": 4761
+                                },
+                                "authentication_events": {
+                                    "week_ms": 3177
+                                },
+                                "library_load_events": {
+                                    "week_ms": 26
+                                },
+                                "cred_access_events": {
+                                    "week_ms": 1350
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 120
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\conhost.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 16
+                                },
+                                "process_events": {
+                                    "week_ms": 26
+                                },
+                                "registry_events": {
+                                    "week_ms": 3
+                                },
+                                "overall": {
+                                    "week_ms": 3261
+                                },
+                                "library_load_events": {
+                                    "week_ms": 2966
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 250
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 51
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false,
+                                            "status": "errorCode_endpoint: Initital state, no attempt to load signature was made"
+                                        }
+                                    ],
+                                    "executable": "System"
+                                },
+                                "malware": {
+                                    "week_ms": 1978
+                                },
+                                "overall": {
+                                    "week_ms": 2029
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\e266326169887aa7cb26b9e2aa421ee4\\System.Web.ni.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 1015
+                                },
+                                "overall": {
+                                    "week_ms": 1015
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 8
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Elasticsearch, Inc.",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\metricbeat-8.3.0-SNAPSHOT-windows-x86_64\\metricbeat.exe"
+                                },
+                                "process_events": {
+                                    "week_ms": 502
+                                },
+                                "dns_events": {
+                                    "week_ms": 84
+                                },
+                                "network_events": {
+                                    "week_ms": 1
+                                },
+                                "overall": {
+                                    "week_ms": 1162
+                                },
+                                "library_load_events": {
+                                    "week_ms": 417
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 150
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": false,
+                                            "subject_name": "Google LLC",
+                                            "exists": true,
+                                            "status": "errorExpired"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 627
+                                },
+                                "process_events": {
+                                    "week_ms": 89
+                                },
+                                "registry_events": {
+                                    "week_ms": 2
+                                },
+                                "dns_events": {
+                                    "week_ms": 7
+                                },
+                                "network_events": {
+                                    "week_ms": 8
+                                },
+                                "overall": {
+                                    "week_ms": 1068
+                                },
+                                "library_load_events": {
+                                    "week_ms": 85
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 250
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\39ce4aafe1a3bc56fb1435f6550dd7a3\\Microsoft.PowerShell.Commands.Utility.ni.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 760
+                                },
+                                "overall": {
+                                    "week_ms": 760
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 15
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\metricbeat-7.10.0-windows-x86_64\\metricbeat.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 29
+                                },
+                                "process_events": {
+                                    "week_ms": 634
+                                },
+                                "registry_events": {
+                                    "week_ms": 1
+                                },
+                                "dns_events": {
+                                    "week_ms": 8
+                                },
+                                "network_events": {
+                                    "week_ms": 4
+                                },
+                                "overall": {
+                                    "week_ms": 744
+                                },
+                                "library_load_events": {
+                                    "week_ms": 3
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 50
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\spoolsv.exe"
+                                },
+                                "process_events": {
+                                    "week_ms": 8
+                                },
+                                "registry_events": {
+                                    "week_ms": 40
+                                },
+                                "overall": {
+                                    "week_ms": 795
+                                },
+                                "library_load_events": {
+                                    "week_ms": 627
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 120
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Elasticsearch, Inc.",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Packetbeat\\packetbeat.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 74
+                                },
+                                "process_events": {
+                                    "week_ms": 432
+                                },
+                                "registry_events": {
+                                    "week_ms": 1
+                                },
+                                "network_events": {
+                                    "week_ms": 1
+                                },
+                                "overall": {
+                                    "week_ms": 599
+                                },
+                                "library_load_events": {
+                                    "week_ms": 61
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 30
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 20
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Corporation",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        },
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Corporation",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 350
+                                },
+                                "process_events": {
+                                    "week_ms": 19
+                                },
+                                "registry_events": {
+                                    "week_ms": 1
+                                },
+                                "overall": {
+                                    "week_ms": 480
+                                },
+                                "library_load_events": {
+                                    "week_ms": 70
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 20
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 6
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Elasticsearch, Inc.",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\filebeat-8.3.0-SNAPSHOT-windows-x86_64\\filebeat.exe"
+                                },
+                                "process_events": {
+                                    "week_ms": 395
+                                },
+                                "dns_events": {
+                                    "week_ms": 51
+                                },
+                                "network_events": {
+                                    "week_ms": 2
+                                },
+                                "overall": {
+                                    "week_ms": 494
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 40
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Google LLC",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Program Files\\Google\\Compute Engine\\vss\\GoogleVssProvider.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 439
+                                },
+                                "overall": {
+                                    "week_ms": 439
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\VSSVC.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 45
+                                },
+                                "process_events": {
+                                    "week_ms": 13
+                                },
+                                "registry_events": {
+                                    "week_ms": 124
+                                },
+                                "overall": {
+                                    "week_ms": 476
+                                },
+                                "authentication_events": {
+                                    "week_ms": 8
+                                },
+                                "library_load_events": {
+                                    "week_ms": 216
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 70
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\SYSTEM32\\mispace.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 353
+                                },
+                                "overall": {
+                                    "week_ms": 353
+                                }
+                            },
+                            {
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "exists": false
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\b1cbeb46534d9974961496306f2f1a28\\System.Web.Extensions.ni.dll"
+                                },
+                                "malware": {
+                                    "week_ms": 305
+                                },
+                                "overall": {
+                                    "week_ms": 305
+                                }
+                            },
+                            {
+                                "file_events": {
+                                    "week_ms": 25
+                                },
+                                "process": {
+                                    "code_signature": [
+                                        {
+                                            "trusted": true,
+                                            "subject_name": "Microsoft Windows",
+                                            "exists": true,
+                                            "status": "trusted"
+                                        }
+                                    ],
+                                    "executable": "C:\\Windows\\System32\\wbem\\WMIADAP.exe"
+                                },
+                                "malware": {
+                                    "week_ms": 247
+                                },
+                                "process_events": {
+                                    "week_ms": 4
+                                },
+                                "registry_events": {
+                                    "week_ms": 5
+                                },
+                                "overall": {
+                                    "week_ms": 345
+                                },
+                                "library_load_events": {
+                                    "week_ms": 14
+                                },
+                                "threat_intelligence_events": {
+                                    "week_ms": 50
+                                }
+                            }
+                        ],
+                        "memory": {
+                            "endpoint": {
+                                "private": {
+                                    "mean": 288590259,
+                                    "latest": 493723648
+                                }
+                            }
+                        },
+                        "disks": [
+                            {
+                                "endpoint_drive": true,
+                                "total": 53564403712,
+                                "free": 25891106816,
+                                "device": "\\Device\\HarddiskVolume3",
+                                "mount": "C:\\",
+                                "fstype": "NTFS"
+                            },
+                            {
+                                "total": 100663296,
+                                "free": 73579520,
+                                "device": "\\Device\\HarddiskVolume2",
+                                "mount": "",
+                                "fstype": "FAT32"
+                            }
+                        ],
+                        "documents_volume": {
+                            "file_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 3485,
+                                "sent_bytes": 7302875
+                            },
+                            "security_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 259,
+                                "sent_bytes": 422247
+                            },
+                            "library_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 114,
+                                "sent_bytes": 287954
+                            },
+                            "process_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 201,
+                                "sent_bytes": 602914
+                            },
+                            "registry_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 605,
+                                "sent_bytes": 1288593
+                            },
+                            "dns_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 5250,
+                                "sent_bytes": 11364752
+                            },
+                            "network_events": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 1753,
+                                "sent_bytes": 3479631
+                            },
+                            "overall": {
+                                "suppressed_count": 0,
+                                "suppressed_bytes": 0,
+                                "sent_count": 11667,
+                                "sent_bytes": 24748966
+                            }
+                        },
+                        "cpu": {
+                            "endpoint": {
+                                "mean": 0.324235176435677,
+                                "latest": 62.6406111450215
+                            }
+                        },
+                        "threads": [
+                            {
+                                "name": "actionsAPIThread",
+                                "cpu": {
+                                    "mean": 0.00456829602558246
+                                }
+                            },
+                            {
+                                "name": "stateReportThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "checkinAPIThread",
+                                "cpu": {
+                                    "mean": 0.0365463682046597
+                                }
+                            },
+                            {
+                                "name": "KernelAsyncMessageQueueConsumerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "Cron",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "File Cache",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "FileLogThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "LoggingLimitThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "CredentialAccessEventDispatcherThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelPortConsumerThread",
+                                "cpu": {
+                                    "mean": 0.00456454263282819
+                                }
+                            },
+                            {
+                                "name": "KernelPortConsumerThread",
+                                "cpu": {
+                                    "mean": 0.00456454263282819
+                                }
+                            },
+                            {
+                                "name": "RulesEngineThread",
+                                "cpu": {
+                                    "mean": 0.0091324200913242
+                                }
+                            },
+                            {
+                                "name": "KernelPortConsumerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelAsyncMessageQueueConsumerThread",
+                                "cpu": {
+                                    "mean": 0.00456454263282819
+                                }
+                            },
+                            {
+                                "name": "KernelSyncQueueConsumerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "DocumentLoggingThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "DocumentLoggingMaintenance",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "BulkConsumerThread",
+                                "cpu": {
+                                    "mean": 0.00455871626549964
+                                }
+                            },
+                            {
+                                "name": "DocumentLoggingConsumerThread",
+                                "cpu": {
+                                    "mean": 0.113967906637491
+                                }
+                            },
+                            {
+                                "name": "DocumentLoggingLimitThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.022822713164141
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.022822713164141
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelSyncMessageThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "ArtifactManifestDownload",
+                                "cpu": {
+                                    "mean": 0.12311901504788
+                                }
+                            },
+                            {
+                                "name": "PolicyReloadThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "CredentialAccessClassifierThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "KernelPortConsumerThread",
+                                "cpu": {
+                                    "mean": 0.0136936278984846
+                                }
+                            },
+                            {
+                                "name": "PerformanceMonitorWorkerThread",
+                                "cpu": {
+                                    "mean": 0.00912200684150513
+                                }
+                            },
+                            {
+                                "name": "MetadataThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "EventsQueueThread",
+                                "cpu": {
+                                    "mean": 0.0729760547320411
+                                }
+                            },
+                            {
+                                "name": "DelayedAlertEnrichment",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "MaintainProcessMap",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "FileScoreThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "DiagnosticMalwareThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "QuarantineManagerWorkerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "EventProcessingThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "HostIsolationMonitorThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "serviceCommsThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "grpcConnectionManagerThread",
+                                "cpu": {
+                                    "mean": 0.0
+                                }
+                            },
+                            {
+                                "name": "RansomwareGlobalUserThread"
+                            },
+                            {
+                                "name": "RansomwareProcessMonitorThread"
+                            },
+                            {
+                                "name": "RansomwareFileCacheCleanupThread"
+                            },
+                            {
+                                "name": "RansomwareParseUnverifiedThread"
+                            },
+                            {
+                                "name": "RansomwareLuaVerifiedThread"
+                            }
+                        ],
+                        "uptime": {
+                            "endpoint": 21930,
+                            "system": 21992
+                        }
+                    }
+                },
+                "ecs": {
+                    "version": "1.11.0"
+                },
+                "data_stream": {
+                    "namespace": "default",
+                    "type": "metrics",
+                    "dataset": "endpoint.metrics"
+                },
+                "host": {
+                    "hostname": "data-viz-win-1",
+                    "os": {
+                        "Ext": {
+                            "variant": "Windows Server 2019 Datacenter"
+                        },
+                        "kernel": "1809 (10.0.17763.2686)",
+                        "name": "Windows",
+                        "family": "windows",
+                        "type": "windows",
+                        "version": "1809 (10.0.17763.2686)",
+                        "platform": "windows",
+                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+                    },
+                    "ip": [
+                        "10.201.0.13",
+                        "fe80::f40a:aed0:618a:972d",
+                        "127.0.0.1",
+                        "::1"
+                    ],
+                    "name": "data-viz-win-1",
+                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+                    "mac": [
+                        "00-00-5E-00-53-23"
+                    ],
+                    "architecture": "x86_64"
+                },
+                "event": {
+                    "agent_id_status": "verified",
+                    "sequence": 35124,
+                    "ingested": "2022-04-04T18:38:16Z",
+                    "created": "2022-04-04T18:38:15.7178887Z",
+                    "kind": "metric",
+                    "module": "endpoint",
+                    "action": "endpoint_metrics",
+                    "id": "MYfZG00oEwD2/fqT+++++Byi",
+                    "category": [
+                        "host"
+                    ],
+                    "type": [
+                        "info"
+                    ],
+                    "dataset": "endpoint.metrics"
+                }
+            }
+        }
+    ]
+}
\ No newline at end of file
diff --git a/scripts/generate-docs/pydocgen/__init__.py b/scripts/generate-docs/pydocgen/__init__.py
new file mode 100644
index 000000000..e69de29bb
diff --git a/scripts/generate-docs/pydocgen/__main__.py b/scripts/generate-docs/pydocgen/__main__.py
new file mode 100644
index 000000000..34844f6ca
--- /dev/null
+++ b/scripts/generate-docs/pydocgen/__main__.py
@@ -0,0 +1,60 @@
+import argparse
+import pathlib
+import traceback
+import sys
+from .models import PackageList
+from .markdown import generate_package_list_markdown
+
+def resolve_packages_dir() -> pathlib.Path:
+    """
+    resolve_packages_dir returns the directory where the packages are stored relative to this file
+    """
+    this_file = pathlib.Path(__file__).resolve()
+    root_dir = this_file.parents[3]
+    return root_dir / "package" / "endpoint" / "data_stream"
+
+def main():
+    parser = argparse.ArgumentParser(description="Dump packages as JSON")
+    parser.add_argument(
+        "--packages-dir",
+        default=resolve_packages_dir(),
+        type=pathlib.Path,
+        help="directory holding the packages",
+    )
+    parser.add_argument(
+        "--output",
+        default=pathlib.Path().resolve() / "output",
+        type=pathlib.Path,
+        help="output directory",
+    )
+    args = parser.parse_args()
+
+    #
+    # Validate the output directory
+    #
+    if args.output.exists():
+        raise FileExistsError(
+            f"output directory {args.output} already exists, please remove it or specify a different directory"
+        )
+    args.output.mkdir(parents=True)
+
+    #
+    # Create the PackageList object and dump it to a file
+    #
+    package_list = PackageList.from_packages_dir(args.packages_dir)
+    json_path = args.output / "packages.json"
+    with json_path.open("w") as f:
+        # Dump to json with indentation and exclude None values
+        f.write(package_list.model_dump_json(indent=4, exclude_none=True))
+
+    #
+    # Generate markdown files
+    #
+    generate_package_list_markdown(package_list, args.output)
+
+if __name__ == "__main__":
+    try:
+        main()
+    except Exception as e:
+        traceback.print_exc()
+        sys.exit(1)
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
new file mode 100644
index 000000000..bcf5f59a6
--- /dev/null
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -0,0 +1,56 @@
+import pathlib
+from .models import Package, PackageList
+import json
+
+
+def generate_package_markdown(package: Package):
+    """
+    Generate markdown for a package
+
+    Args:
+        package: the package to generate markdown for
+
+    Returns:
+        markdown string
+    """
+    markdown = f"# {package.name}\n\n"
+    for field in package.fields:
+        markdown += f"### {field.name}\n\n"
+        markdown += f"#### Description\n"
+        markdown += f"{field.description}\n"
+        markdown += f"#### Example\n\n"
+        markdown += f"```json\n"
+        if not field.example:
+            markdown += "Needs example\n"
+        else:
+            markdown += json.dumps(field.example, indent=4)
+        markdown += "\n```\n<hr>\n\n"
+    return markdown
+
+
+def generate_package_list_markdown(package_list: PackageList, output_directory: pathlib.Path):
+    """
+    Generate markdown for a list of packages
+
+    Args:
+        package_list: the package list to generate markdown for
+
+    Returns:
+        markdown string
+    """
+    if not output_directory.exists():
+        output_directory.mkdir(parents=True)
+    if not output_directory.is_dir():
+        raise ValueError(f"output_directory {output_directory} is not a directory")
+
+    for package in package_list.packages:
+        path = output_directory / f"{package.name}.md"
+        with path.open("w") as f:
+            f.write(generate_package_markdown(package))
+
+    readme_path = output_directory / "README.md"
+    with readme_path.open("w") as f:
+        f.write("# Packages\n\n")
+        for package in package_list.packages:
+            f.write(f"- [{package.name}]({package.name}.md)\n")
+    return f"Generated {len(package_list.packages)} packages to {output_directory}"
diff --git a/scripts/generate-docs/generate_package_list.py b/scripts/generate-docs/pydocgen/models.py
similarity index 68%
rename from scripts/generate-docs/generate_package_list.py
rename to scripts/generate-docs/pydocgen/models.py
index 9ee5fa97d..79e201117 100644
--- a/scripts/generate-docs/generate_package_list.py
+++ b/scripts/generate-docs/pydocgen/models.py
@@ -1,14 +1,15 @@
-import argparse
 import json
 import pathlib
 import yaml
 from pydantic import BaseModel
 from typing import List, Optional, Any, Dict
 
+
 class MultiField(BaseModel):
     """
     fields can have a number of multi_fields
     """
+
     name: str
     type: str
     norms: Optional[bool] = None
@@ -18,8 +19,9 @@ class MultiField(BaseModel):
 
     class Config:
         """
-         this config setting ensures that the model will raise an error if any extra fields are present
+        this config setting ensures that the model will raise an error if any extra fields are present
         """
+
         extra = "forbid"
 
 
@@ -27,6 +29,7 @@ class Field(BaseModel):
     """
     Field field as defined in fields.yml
     """
+
     name: str
     title: Optional[str] = None
     default_field: Optional[bool] = None
@@ -49,8 +52,9 @@ class Field(BaseModel):
 
     class Config:
         """
-         this config setting ensures that the model will raise an error if any extra fields are present
+        this config setting ensures that the model will raise an error if any extra fields are present
         """
+
         extra = "forbid"
 
 
@@ -58,6 +62,7 @@ class Package(BaseModel):
     """
     A package consists of a name, a list of fields and an optional sample event
     """
+
     name: str
     fields: List[Field]
     sample_event: Optional[Dict[Any, Any]] = None
@@ -73,6 +78,11 @@ def from_package_dir(cls, package_dir: pathlib.Path):
         Args:
             package_dir: directory holding the package data
         """
+        if not package_dir.exists():
+            raise ValueError(f"package directory {package_dir} does not exist")
+        if not package_dir.is_dir():
+            raise ValueError(f"package directory {package_dir} is not a directory")
+
         #
         # read fields from fields.yml and create Field objects
         #
@@ -93,10 +103,12 @@ def from_package_dir(cls, package_dir: pathlib.Path):
         #
         return cls(name=package_dir.name, fields=fields, sample_event=sample_event)
 
+
 class PackageList(BaseModel):
     """
     PackageList is a list of packages
     """
+
     packages: List[Package] = []
 
     @classmethod
@@ -108,41 +120,7 @@ def from_packages_dir(cls, packages_dir: pathlib.Path):
             packages_dir: top level directory holding the packages
         """
         package_paths = list(packages_dir.glob("*"))
-        packages = [Package.from_package_dir(package_path) for package_path in package_paths]
+        packages = [
+            Package.from_package_dir(package_path) for package_path in package_paths
+        ]
         return cls(packages=packages)
-
-
-def resolve_packages_dir() -> pathlib.Path:
-    """
-    resolve_packages_dir returns the directory where the packages are stored relative to this file
-    """
-    this_file = pathlib.Path(__file__).resolve()
-    root_dir = this_file.parents[2]
-    return root_dir / "package" / "endpoint" / "data_stream"
-
-
-if __name__ == "__main__":
-    parser = argparse.ArgumentParser(description="Dump packages as JSON")
-    parser.add_argument(
-        "--packages-dir",
-        default=resolve_packages_dir(),
-        type=pathlib.Path,
-        help="directory holding the packages",
-    )
-    parser.add_argument(
-        "--output",
-        default=pathlib.Path("packages.json"),
-        type=pathlib.Path,
-        help="output file",
-    )
-    args = parser.parse_args()
-
-    #
-    # Create the PackageList object and dump it to a file
-    #
-    package_list = PackageList.from_packages_dir(args.packages_dir)
-    with open(args.output, "w") as f:
-        #
-        # Dump to json with indentation and exclude None values
-        #
-        f.write(package_list.model_dump_json(indent=4, exclude_none=True))

From c9f6d3da333270453f3146942be33bdec3e7fd04 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Mon, 10 Mar 2025 17:05:48 +0000
Subject: [PATCH 04/25] remove accidental markdown commit

---
 scripts/generate-docs/doc.md | 363 -----------------------------------
 1 file changed, 363 deletions(-)
 delete mode 100644 scripts/generate-docs/doc.md

diff --git a/scripts/generate-docs/doc.md b/scripts/generate-docs/doc.md
deleted file mode 100644
index 49ae0b5ac..000000000
--- a/scripts/generate-docs/doc.md
+++ /dev/null
@@ -1,363 +0,0 @@
-/git/endpoint-dev/ElasticCommonSchema/endpoint-package/package/endpoint/data_stream
-# alerts
-
-## Fields
-
-### @timestamp
-
-#### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-#### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-### Events
-
-#### Description
-events array
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### message
-
-#### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-#### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-### Endpoint
-
-#### Description
-Fields describing the state of the Elastic Endpoint when an event occurs.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### Memory_protection
-
-#### Description
-These fields contain information specific to Memory Protection alerts.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### Ransomware
-
-#### Description
-These fields contain information specific to ransomware alerts.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### Responses
-
-#### Description
-responses array contains rule response action results
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### Target
-
-#### Description
-These fields contain information about a target.
-These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### agent
-
-#### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### cloud
-
-#### Description
-Fields related to the cloud or infrastructure the events are coming from.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### container
-
-#### Description
-Container fields are used for meta information about the specific container that is the source of information.
-These fields help correlate data based containers from any runtime.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### data_stream
-
-#### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### destination
-
-#### Description
-Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### dll
-
-#### Description
-These fields contain information about code libraries dynamically loaded into processes.
-
-Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
-* Dynamic-link library (`.dll`) commonly used on Windows
-* Shared Object (`.so`) commonly used on Unix-like operating systems
-* Dynamic library (`.dylib`) commonly used on macOS
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### dns
-
-#### Description
-Fields describing DNS queries and answers.
-DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### ecs
-
-#### Description
-Meta-information specific to ECS.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### elastic
-
-#### Description
-Holds fields and properties of data points and concepts in the elastic domain or namespace.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### event
-
-#### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### file
-
-#### Description
-A file is defined as a set of information that has been created on, or has existed on a filesystem.
-File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### group
-
-#### Description
-The group fields are meant to represent groups that are relevant to the event.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### host
-
-#### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### orchestrator
-
-#### Description
-Fields that describe the resources which container orchestrators manage or act upon.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### process
-
-#### Description
-These fields contain information about a process.
-These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### registry
-
-#### Description
-Fields related to Windows Registry operations.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### rule
-
-#### Description
-Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
-Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### source
-
-#### Description
-Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### threat
-
-#### Description
-Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.
-These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service").
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-### user
-
-#### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-

From 5d683887ed6ee91aa87b40bdc6d2d88e630006cd Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Mon, 10 Mar 2025 17:21:30 +0000
Subject: [PATCH 05/25] update output format

---
 .../generate-docs/output/action_responses.md  | 32 +++++-----
 scripts/generate-docs/output/actions.md       | 38 ++++++------
 scripts/generate-docs/output/alerts.md        | 58 ++++++++++---------
 scripts/generate-docs/output/api.md           | 26 +++++----
 scripts/generate-docs/output/collection.md    | 10 ++--
 scripts/generate-docs/output/file.md          | 32 +++++-----
 scripts/generate-docs/output/heartbeat.md     | 14 +++--
 scripts/generate-docs/output/library.md       | 32 +++++-----
 scripts/generate-docs/output/metadata.md      | 18 +++---
 scripts/generate-docs/output/metrics.md       | 18 +++---
 scripts/generate-docs/output/network.md       | 32 +++++-----
 scripts/generate-docs/output/policy.md        | 18 +++---
 scripts/generate-docs/output/process.md       | 34 ++++++-----
 scripts/generate-docs/output/registry.md      | 30 +++++-----
 scripts/generate-docs/output/security.md      | 32 +++++-----
 scripts/generate-docs/pydocgen/markdown.py    |  5 +-
 16 files changed, 230 insertions(+), 199 deletions(-)

diff --git a/scripts/generate-docs/output/action_responses.md b/scripts/generate-docs/output/action_responses.md
index b75fabb1a..450b600ca 100644
--- a/scripts/generate-docs/output/action_responses.md
+++ b/scripts/generate-docs/output/action_responses.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # action_responses
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### action_id
+### `action_id`
 
 #### Description
 The action id
@@ -26,7 +28,7 @@ Needs example
 ```
 <hr>
 
-### agent_id
+### `agent_id`
 
 #### Description
 Alias field that maps to {agent: {id}}
@@ -38,7 +40,7 @@ Needs example
 ```
 <hr>
 
-### completed_at
+### `completed_at`
 
 #### Description
 Request completion timestamp when the response is done executing. Usually matches with @timestamp.
@@ -50,7 +52,7 @@ Needs example
 ```
 <hr>
 
-### data.alert_id
+### `data.alert_id`
 
 #### Description
 List of alert ids that triggered the action
@@ -62,7 +64,7 @@ Needs example
 ```
 <hr>
 
-### data.command
+### `data.command`
 
 #### Description
 The action that is requested
@@ -74,7 +76,7 @@ Needs example
 ```
 <hr>
 
-### data.comment
+### `data.comment`
 
 #### Description
 A comment that describes the action that is requested
@@ -86,7 +88,7 @@ Needs example
 ```
 <hr>
 
-### started_at
+### `started_at`
 
 #### Description
 Timestamp of start of request
@@ -98,7 +100,7 @@ Needs example
 ```
 <hr>
 
-### status
+### `status`
 
 #### Description
 The status of the request that distinguishes if the request is queued, running or completed.
@@ -110,7 +112,7 @@ Needs example
 ```
 <hr>
 
-### EndpointActions
+### `EndpointActions`
 
 #### Description
 Fields to describe the endpoint  action requests and responses.
@@ -122,7 +124,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -135,7 +137,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -147,7 +149,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -159,7 +161,7 @@ Needs example
 ```
 <hr>
 
-### error
+### `error`
 
 #### Description
 These fields can represent errors of any kind.
@@ -172,7 +174,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
diff --git a/scripts/generate-docs/output/actions.md b/scripts/generate-docs/output/actions.md
index 9b53af66e..008a4838e 100644
--- a/scripts/generate-docs/output/actions.md
+++ b/scripts/generate-docs/output/actions.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # actions
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### action_id
+### `action_id`
 
 #### Description
 The action id
@@ -26,7 +28,7 @@ Needs example
 ```
 <hr>
 
-### agents
+### `agents`
 
 #### Description
 Alias field that maps to {agent: {id}}
@@ -38,7 +40,7 @@ Needs example
 ```
 <hr>
 
-### data.alert_id
+### `data.alert_id`
 
 #### Description
 List of alert ids that triggered the action
@@ -50,7 +52,7 @@ Needs example
 ```
 <hr>
 
-### data.command
+### `data.command`
 
 #### Description
 The action that is requested
@@ -62,7 +64,7 @@ Needs example
 ```
 <hr>
 
-### data.comment
+### `data.comment`
 
 #### Description
 A comment that describes the action that is requested
@@ -74,7 +76,7 @@ Needs example
 ```
 <hr>
 
-### expiration
+### `expiration`
 
 #### Description
 Request expiration timestamp
@@ -86,7 +88,7 @@ Needs example
 ```
 <hr>
 
-### input_type
+### `input_type`
 
 #### Description
 The input type of the action, distinguishes endpoint actions as `endpoint`
@@ -98,7 +100,7 @@ Needs example
 ```
 <hr>
 
-### type
+### `type`
 
 #### Description
 Distinguishes the type of input. Usually set to `INPUT_ACTION`
@@ -110,7 +112,7 @@ Needs example
 ```
 <hr>
 
-### user_id
+### `user_id`
 
 #### Description
 The user id
@@ -122,7 +124,7 @@ Needs example
 ```
 <hr>
 
-### EndpointActions
+### `EndpointActions`
 
 #### Description
 Fields to describe the endpoint  action requests and responses.
@@ -134,7 +136,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -147,7 +149,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -159,7 +161,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -171,7 +173,7 @@ Needs example
 ```
 <hr>
 
-### error
+### `error`
 
 #### Description
 These fields can represent errors of any kind.
@@ -184,7 +186,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -197,7 +199,7 @@ Needs example
 ```
 <hr>
 
-### rule
+### `rule`
 
 #### Description
 Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
@@ -210,7 +212,7 @@ Needs example
 ```
 <hr>
 
-### user
+### `user`
 
 #### Description
 The user fields describe information about the user that is relevant to the event.
diff --git a/scripts/generate-docs/output/alerts.md b/scripts/generate-docs/output/alerts.md
index 4a83c10bd..bf7cba0bd 100644
--- a/scripts/generate-docs/output/alerts.md
+++ b/scripts/generate-docs/output/alerts.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # alerts
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### Events
+### `Events`
 
 #### Description
 events array
@@ -26,7 +28,7 @@ Needs example
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -39,7 +41,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### Endpoint
+### `Endpoint`
 
 #### Description
 Fields describing the state of the Elastic Endpoint when an event occurs.
@@ -51,7 +53,7 @@ Needs example
 ```
 <hr>
 
-### Memory_protection
+### `Memory_protection`
 
 #### Description
 These fields contain information specific to Memory Protection alerts.
@@ -63,7 +65,7 @@ Needs example
 ```
 <hr>
 
-### Ransomware
+### `Ransomware`
 
 #### Description
 These fields contain information specific to ransomware alerts.
@@ -75,7 +77,7 @@ Needs example
 ```
 <hr>
 
-### Responses
+### `Responses`
 
 #### Description
 responses array contains rule response action results
@@ -87,7 +89,7 @@ Needs example
 ```
 <hr>
 
-### Target
+### `Target`
 
 #### Description
 These fields contain information about a target.
@@ -100,7 +102,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -113,7 +115,7 @@ Needs example
 ```
 <hr>
 
-### cloud
+### `cloud`
 
 #### Description
 Fields related to the cloud or infrastructure the events are coming from.
@@ -125,7 +127,7 @@ Needs example
 ```
 <hr>
 
-### container
+### `container`
 
 #### Description
 Container fields are used for meta information about the specific container that is the source of information.
@@ -138,7 +140,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -150,7 +152,7 @@ Needs example
 ```
 <hr>
 
-### destination
+### `destination`
 
 #### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -163,7 +165,7 @@ Needs example
 ```
 <hr>
 
-### dll
+### `dll`
 
 #### Description
 These fields contain information about code libraries dynamically loaded into processes.
@@ -180,7 +182,7 @@ Needs example
 ```
 <hr>
 
-### dns
+### `dns`
 
 #### Description
 Fields describing DNS queries and answers.
@@ -193,7 +195,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -205,7 +207,7 @@ Needs example
 ```
 <hr>
 
-### elastic
+### `elastic`
 
 #### Description
 Holds fields and properties of data points and concepts in the elastic domain or namespace.
@@ -217,7 +219,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -230,7 +232,7 @@ Needs example
 ```
 <hr>
 
-### file
+### `file`
 
 #### Description
 A file is defined as a set of information that has been created on, or has existed on a filesystem.
@@ -243,7 +245,7 @@ Needs example
 ```
 <hr>
 
-### group
+### `group`
 
 #### Description
 The group fields are meant to represent groups that are relevant to the event.
@@ -255,7 +257,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
@@ -268,7 +270,7 @@ Needs example
 ```
 <hr>
 
-### orchestrator
+### `orchestrator`
 
 #### Description
 Fields that describe the resources which container orchestrators manage or act upon.
@@ -280,7 +282,7 @@ Needs example
 ```
 <hr>
 
-### process
+### `process`
 
 #### Description
 These fields contain information about a process.
@@ -293,7 +295,7 @@ Needs example
 ```
 <hr>
 
-### registry
+### `registry`
 
 #### Description
 Fields related to Windows Registry operations.
@@ -305,7 +307,7 @@ Needs example
 ```
 <hr>
 
-### rule
+### `rule`
 
 #### Description
 Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
@@ -318,7 +320,7 @@ Needs example
 ```
 <hr>
 
-### source
+### `source`
 
 #### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -331,7 +333,7 @@ Needs example
 ```
 <hr>
 
-### threat
+### `threat`
 
 #### Description
 Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.
@@ -344,7 +346,7 @@ Needs example
 ```
 <hr>
 
-### user
+### `user`
 
 #### Description
 The user fields describe information about the user that is relevant to the event.
diff --git a/scripts/generate-docs/output/api.md b/scripts/generate-docs/output/api.md
index edf7934f3..9ce6b7560 100644
--- a/scripts/generate-docs/output/api.md
+++ b/scripts/generate-docs/output/api.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # api
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -27,7 +29,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### Target
+### `Target`
 
 #### Description
 These fields contain information about a target.
@@ -40,7 +42,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -52,7 +54,7 @@ Needs example
 ```
 <hr>
 
-### destination
+### `destination`
 
 #### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -65,7 +67,7 @@ Needs example
 ```
 <hr>
 
-### dll
+### `dll`
 
 #### Description
 These fields contain information about code libraries dynamically loaded into processes.
@@ -82,7 +84,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -94,7 +96,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -107,7 +109,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
@@ -120,7 +122,7 @@ Needs example
 ```
 <hr>
 
-### network
+### `network`
 
 #### Description
 The network is defined as the communication path over which a host or network event happens.
@@ -133,7 +135,7 @@ Needs example
 ```
 <hr>
 
-### process
+### `process`
 
 #### Description
 These fields contain information about a process.
@@ -146,7 +148,7 @@ Needs example
 ```
 <hr>
 
-### user
+### `user`
 
 #### Description
 The user fields describe information about the user that is relevant to the event.
diff --git a/scripts/generate-docs/output/collection.md b/scripts/generate-docs/output/collection.md
index 351649b48..0a1e47c2d 100644
--- a/scripts/generate-docs/output/collection.md
+++ b/scripts/generate-docs/output/collection.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # collection
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -26,7 +28,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -38,7 +40,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
diff --git a/scripts/generate-docs/output/file.md b/scripts/generate-docs/output/file.md
index 06e677344..f2c501a24 100644
--- a/scripts/generate-docs/output/file.md
+++ b/scripts/generate-docs/output/file.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # file
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -27,7 +29,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### Effective_process
+### `Effective_process`
 
 #### Description
 These fields contain information about an effective process.
@@ -42,7 +44,7 @@ Needs example
 ```
 <hr>
 
-### Persistence
+### `Persistence`
 
 #### Description
 These fields contain information about a Persistence event.
@@ -54,7 +56,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -67,7 +69,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -79,7 +81,7 @@ Needs example
 ```
 <hr>
 
-### destination
+### `destination`
 
 #### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -92,7 +94,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -104,7 +106,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -117,7 +119,7 @@ Needs example
 ```
 <hr>
 
-### file
+### `file`
 
 #### Description
 A file is defined as a set of information that has been created on, or has existed on a filesystem.
@@ -130,7 +132,7 @@ Needs example
 ```
 <hr>
 
-### group
+### `group`
 
 #### Description
 The group fields are meant to represent groups that are relevant to the event.
@@ -142,7 +144,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
@@ -155,7 +157,7 @@ Needs example
 ```
 <hr>
 
-### process
+### `process`
 
 #### Description
 These fields contain information about a process.
@@ -168,7 +170,7 @@ Needs example
 ```
 <hr>
 
-### source
+### `source`
 
 #### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -181,7 +183,7 @@ Needs example
 ```
 <hr>
 
-### user
+### `user`
 
 #### Description
 The user fields describe information about the user that is relevant to the event.
diff --git a/scripts/generate-docs/output/heartbeat.md b/scripts/generate-docs/output/heartbeat.md
index e154f0d08..0ee42aaf0 100644
--- a/scripts/generate-docs/output/heartbeat.md
+++ b/scripts/generate-docs/output/heartbeat.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # heartbeat
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### billable
+### `billable`
 
 #### Description
 Whether document should be included in billing calculations
@@ -26,7 +28,7 @@ Needs example
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -39,7 +41,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -52,7 +54,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -64,7 +66,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
diff --git a/scripts/generate-docs/output/library.md b/scripts/generate-docs/output/library.md
index 6ad60c1f2..32d553e6c 100644
--- a/scripts/generate-docs/output/library.md
+++ b/scripts/generate-docs/output/library.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # library
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -27,7 +29,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### Effective_process
+### `Effective_process`
 
 #### Description
 These fields contain information about an effective process.
@@ -42,7 +44,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -55,7 +57,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -67,7 +69,7 @@ Needs example
 ```
 <hr>
 
-### destination
+### `destination`
 
 #### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -80,7 +82,7 @@ Needs example
 ```
 <hr>
 
-### dll
+### `dll`
 
 #### Description
 These fields contain information about code libraries dynamically loaded into processes.
@@ -97,7 +99,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -109,7 +111,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -122,7 +124,7 @@ Needs example
 ```
 <hr>
 
-### file
+### `file`
 
 #### Description
 A file is defined as a set of information that has been created on, or has existed on a filesystem.
@@ -135,7 +137,7 @@ Needs example
 ```
 <hr>
 
-### group
+### `group`
 
 #### Description
 The group fields are meant to represent groups that are relevant to the event.
@@ -147,7 +149,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
@@ -160,7 +162,7 @@ Needs example
 ```
 <hr>
 
-### process
+### `process`
 
 #### Description
 These fields contain information about a process.
@@ -173,7 +175,7 @@ Needs example
 ```
 <hr>
 
-### source
+### `source`
 
 #### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -186,7 +188,7 @@ Needs example
 ```
 <hr>
 
-### user
+### `user`
 
 #### Description
 The user fields describe information about the user that is relevant to the event.
diff --git a/scripts/generate-docs/output/metadata.md b/scripts/generate-docs/output/metadata.md
index a9ddaa113..79850c5b5 100644
--- a/scripts/generate-docs/output/metadata.md
+++ b/scripts/generate-docs/output/metadata.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # metadata
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### Endpoint
+### `Endpoint`
 
 #### Description
 Fields describing the state of the Elastic Endpoint when an event occurs.
@@ -26,7 +28,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -39,7 +41,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -51,7 +53,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -63,7 +65,7 @@ Needs example
 ```
 <hr>
 
-### elastic
+### `elastic`
 
 #### Description
 Holds fields and properties of data points and concepts in the elastic domain or namespace.
@@ -75,7 +77,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -88,7 +90,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
diff --git a/scripts/generate-docs/output/metrics.md b/scripts/generate-docs/output/metrics.md
index 8d254a845..7d5cb2b8a 100644
--- a/scripts/generate-docs/output/metrics.md
+++ b/scripts/generate-docs/output/metrics.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # metrics
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -27,7 +29,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### Endpoint
+### `Endpoint`
 
 #### Description
 Fields describing the state of the Elastic Endpoint when an event occurs.
@@ -39,7 +41,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -52,7 +54,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -64,7 +66,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -76,7 +78,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -89,7 +91,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
diff --git a/scripts/generate-docs/output/network.md b/scripts/generate-docs/output/network.md
index 9d2f8b3d6..355901e2f 100644
--- a/scripts/generate-docs/output/network.md
+++ b/scripts/generate-docs/output/network.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # network
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -27,7 +29,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -40,7 +42,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -52,7 +54,7 @@ Needs example
 ```
 <hr>
 
-### destination
+### `destination`
 
 #### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -65,7 +67,7 @@ Needs example
 ```
 <hr>
 
-### dns
+### `dns`
 
 #### Description
 Fields describing DNS queries and answers.
@@ -78,7 +80,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -90,7 +92,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -103,7 +105,7 @@ Needs example
 ```
 <hr>
 
-### group
+### `group`
 
 #### Description
 The group fields are meant to represent groups that are relevant to the event.
@@ -115,7 +117,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
@@ -128,7 +130,7 @@ Needs example
 ```
 <hr>
 
-### http
+### `http`
 
 #### Description
 Fields related to HTTP activity. Use the `url` field set to store the url of the request.
@@ -140,7 +142,7 @@ Needs example
 ```
 <hr>
 
-### network
+### `network`
 
 #### Description
 The network is defined as the communication path over which a host or network event happens.
@@ -153,7 +155,7 @@ Needs example
 ```
 <hr>
 
-### process
+### `process`
 
 #### Description
 These fields contain information about a process.
@@ -166,7 +168,7 @@ Needs example
 ```
 <hr>
 
-### source
+### `source`
 
 #### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -179,7 +181,7 @@ Needs example
 ```
 <hr>
 
-### user
+### `user`
 
 #### Description
 The user fields describe information about the user that is relevant to the event.
diff --git a/scripts/generate-docs/output/policy.md b/scripts/generate-docs/output/policy.md
index 0b15bbe4c..c95d7f197 100644
--- a/scripts/generate-docs/output/policy.md
+++ b/scripts/generate-docs/output/policy.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # policy
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -27,7 +29,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### Endpoint
+### `Endpoint`
 
 #### Description
 Fields describing the state of the Elastic Endpoint when an event occurs.
@@ -39,7 +41,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -52,7 +54,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -64,7 +66,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -76,7 +78,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -89,7 +91,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
diff --git a/scripts/generate-docs/output/process.md b/scripts/generate-docs/output/process.md
index 4b47ceb23..f01e42637 100644
--- a/scripts/generate-docs/output/process.md
+++ b/scripts/generate-docs/output/process.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # process
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -27,7 +29,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -40,7 +42,7 @@ Needs example
 ```
 <hr>
 
-### cloud
+### `cloud`
 
 #### Description
 Fields related to the cloud or infrastructure the events are coming from.
@@ -52,7 +54,7 @@ Needs example
 ```
 <hr>
 
-### container
+### `container`
 
 #### Description
 Container fields are used for meta information about the specific container that is the source of information.
@@ -65,7 +67,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -77,7 +79,7 @@ Needs example
 ```
 <hr>
 
-### destination
+### `destination`
 
 #### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -90,7 +92,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -102,7 +104,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -115,7 +117,7 @@ Needs example
 ```
 <hr>
 
-### group
+### `group`
 
 #### Description
 The group fields are meant to represent groups that are relevant to the event.
@@ -127,7 +129,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
@@ -140,7 +142,7 @@ Needs example
 ```
 <hr>
 
-### orchestrator
+### `orchestrator`
 
 #### Description
 Fields that describe the resources which container orchestrators manage or act upon.
@@ -152,7 +154,7 @@ Needs example
 ```
 <hr>
 
-### package
+### `package`
 
 #### Description
 These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.
@@ -164,7 +166,7 @@ Needs example
 ```
 <hr>
 
-### process
+### `process`
 
 #### Description
 These fields contain information about a process.
@@ -177,7 +179,7 @@ Needs example
 ```
 <hr>
 
-### source
+### `source`
 
 #### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -190,7 +192,7 @@ Needs example
 ```
 <hr>
 
-### user
+### `user`
 
 #### Description
 The user fields describe information about the user that is relevant to the event.
diff --git a/scripts/generate-docs/output/registry.md b/scripts/generate-docs/output/registry.md
index 5a662f748..b750e28c3 100644
--- a/scripts/generate-docs/output/registry.md
+++ b/scripts/generate-docs/output/registry.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # registry
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -27,7 +29,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### Effective_process
+### `Effective_process`
 
 #### Description
 These fields contain information about an effective process.
@@ -42,7 +44,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -55,7 +57,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -67,7 +69,7 @@ Needs example
 ```
 <hr>
 
-### destination
+### `destination`
 
 #### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -80,7 +82,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -92,7 +94,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -105,7 +107,7 @@ Needs example
 ```
 <hr>
 
-### group
+### `group`
 
 #### Description
 The group fields are meant to represent groups that are relevant to the event.
@@ -117,7 +119,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
@@ -130,7 +132,7 @@ Needs example
 ```
 <hr>
 
-### process
+### `process`
 
 #### Description
 These fields contain information about a process.
@@ -143,7 +145,7 @@ Needs example
 ```
 <hr>
 
-### registry
+### `registry`
 
 #### Description
 Fields related to Windows Registry operations.
@@ -155,7 +157,7 @@ Needs example
 ```
 <hr>
 
-### source
+### `source`
 
 #### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -168,7 +170,7 @@ Needs example
 ```
 <hr>
 
-### user
+### `user`
 
 #### Description
 The user fields describe information about the user that is relevant to the event.
diff --git a/scripts/generate-docs/output/security.md b/scripts/generate-docs/output/security.md
index a48247838..363350db9 100644
--- a/scripts/generate-docs/output/security.md
+++ b/scripts/generate-docs/output/security.md
@@ -1,6 +1,8 @@
+[Back to index](README.md)
+
 # security
 
-### @timestamp
+### `@timestamp`
 
 #### Description
 Date/time when the event originated.
@@ -14,7 +16,7 @@ Required field for all events.
 ```
 <hr>
 
-### message
+### `message`
 
 #### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
@@ -27,7 +29,7 @@ If multiple messages exist, they can be combined into one message.
 ```
 <hr>
 
-### Target
+### `Target`
 
 #### Description
 These fields contain information about a target.
@@ -40,7 +42,7 @@ Needs example
 ```
 <hr>
 
-### agent
+### `agent`
 
 #### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
@@ -53,7 +55,7 @@ Needs example
 ```
 <hr>
 
-### data_stream
+### `data_stream`
 
 #### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
@@ -65,7 +67,7 @@ Needs example
 ```
 <hr>
 
-### destination
+### `destination`
 
 #### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -78,7 +80,7 @@ Needs example
 ```
 <hr>
 
-### ecs
+### `ecs`
 
 #### Description
 Meta-information specific to ECS.
@@ -90,7 +92,7 @@ Needs example
 ```
 <hr>
 
-### event
+### `event`
 
 #### Description
 The event fields are used for context information about the log or metric event itself.
@@ -103,7 +105,7 @@ Needs example
 ```
 <hr>
 
-### file
+### `file`
 
 #### Description
 A file is defined as a set of information that has been created on, or has existed on a filesystem.
@@ -116,7 +118,7 @@ Needs example
 ```
 <hr>
 
-### group
+### `group`
 
 #### Description
 The group fields are meant to represent groups that are relevant to the event.
@@ -128,7 +130,7 @@ Needs example
 ```
 <hr>
 
-### host
+### `host`
 
 #### Description
 A host is defined as a general computing instance.
@@ -141,7 +143,7 @@ Needs example
 ```
 <hr>
 
-### process
+### `process`
 
 #### Description
 These fields contain information about a process.
@@ -154,7 +156,7 @@ Needs example
 ```
 <hr>
 
-### source
+### `source`
 
 #### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
@@ -167,7 +169,7 @@ Needs example
 ```
 <hr>
 
-### user
+### `user`
 
 #### Description
 The user fields describe information about the user that is relevant to the event.
@@ -180,7 +182,7 @@ Needs example
 ```
 <hr>
 
-### winlog
+### `winlog`
 
 #### Description
 These fields provide detailed information regarding events logged in the Windows Event Log. The Windows Event Log is a centralized system used by Windows to record events related to system, application, and security activities. Each event log entry is categorized by a specific event type, and contains relevant metadata that can include the event source, event ID, timestamp, user details, and other associated data.
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index bcf5f59a6..ea678db22 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -13,9 +13,10 @@ def generate_package_markdown(package: Package):
     Returns:
         markdown string
     """
-    markdown = f"# {package.name}\n\n"
+    markdown = f"[Back to index](README.md)\n\n"
+    markdown += f"# {package.name}\n\n"
     for field in package.fields:
-        markdown += f"### {field.name}\n\n"
+        markdown += f"### `{field.name}`\n\n"
         markdown += f"#### Description\n"
         markdown += f"{field.description}\n"
         markdown += f"#### Example\n\n"

From ed5e013d7a628054638562df75991bb0edd56f98 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Mon, 10 Mar 2025 17:56:33 +0000
Subject: [PATCH 06/25] updated output

---
 scripts/generate-docs/output/README.md        | 4179 ++++++++++++++++-
 .../generate-docs/output/action_responses.md  |  154 +-
 scripts/generate-docs/output/actions.md       |  181 +-
 scripts/generate-docs/output/alerts.md        | 2184 ++++++++-
 scripts/generate-docs/output/api.md           |  628 ++-
 scripts/generate-docs/output/collection.md    |   79 +-
 scripts/generate-docs/output/file.md          |  414 +-
 scripts/generate-docs/output/heartbeat.md     |   55 +-
 scripts/generate-docs/output/library.md       |  392 +-
 scripts/generate-docs/output/metadata.md      |  161 +-
 scripts/generate-docs/output/metrics.md       |  262 +-
 scripts/generate-docs/output/network.md       |  380 +-
 scripts/generate-docs/output/policy.md        |  210 +-
 scripts/generate-docs/output/process.md       |  697 ++-
 scripts/generate-docs/output/registry.md      |  304 +-
 scripts/generate-docs/output/security.md      |  309 +-
 scripts/generate-docs/pydocgen/markdown.py    |   72 +-
 17 files changed, 10003 insertions(+), 658 deletions(-)

diff --git a/scripts/generate-docs/output/README.md b/scripts/generate-docs/output/README.md
index 941b9fbd2..3bbe5985b 100644
--- a/scripts/generate-docs/output/README.md
+++ b/scripts/generate-docs/output/README.md
@@ -1,17 +1,4162 @@
-# Packages
-
-- [alerts](alerts.md)
-- [policy](policy.md)
-- [registry](registry.md)
-- [process](process.md)
-- [security](security.md)
-- [metadata](metadata.md)
-- [action_responses](action_responses.md)
-- [collection](collection.md)
-- [library](library.md)
-- [heartbeat](heartbeat.md)
-- [actions](actions.md)
-- [file](file.md)
-- [api](api.md)
-- [network](network.md)
-- [metrics](metrics.md)
+# alerts
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "agent": {
+        "build": {
+            "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+        },
+        "id": "2b1eb7f7-bd61-436a-98af-c2b182043476",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "container": {
+        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+        "image": {
+            "name": "docker.io/library/nginx",
+            "tag": "latest"
+        },
+        "name": "nginx"
+    },
+    "cloud": {
+        "account": {
+            "id": "1234"
+        },
+        "instance": {
+            "name": "webserver-12"
+        },
+        "project": {
+            "id": "1234"
+        },
+        "provider": "aws",
+        "region": "us-east-1"
+    },
+    "orchestrator": {
+        "cluster": {
+            "name": "webservers"
+        },
+        "namespace": "webapp",
+        "resource": {
+            "name": "webservers",
+            "type": "kubernetes"
+        }
+    },
+    "process": {
+        "Ext": {
+            "ancestry": [
+                "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw"
+            ],
+            "protection": "PsProtectedSignerWinSystem",
+            "user": "SYSTEM",
+            "architecture": "x86_64",
+            "token": {
+                "elevation": true,
+                "integrity_level_name": "system",
+                "domain": "NT AUTHORITY",
+                "user": "SYSTEM",
+                "elevation_type": "default",
+                "sid": "S-1-5-18"
+            },
+            "memory_region": {
+                "region_size": 4096,
+                "region_protection": "RWX",
+                "allocation_base": 2401471234048,
+                "allocation_type": "PRIVATE",
+                "bytes_allocation_offset": 0,
+                "region_state": "COMMIT",
+                "bytes_compressed_present": false,
+                "region_start_bytes": "58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124",
+                "allocation_protection": "RW-",
+                "region_base": 2401471238144,
+                "allocation_size": 8192,
+                "bytes_address": 2401471234048
+            }
+        },
+        "parent": {
+            "Ext": {
+                "protection": "",
+                "user": "",
+                "architecture": "unknown"
+            },
+            "name": "System Idle Process",
+            "start": "2022-04-04T12:15:41.4606245Z",
+            "pid": 0,
+            "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
+            "command_line": "",
+            "executable": "",
+            "ppid": 0,
+            "uptime": 822
+        },
+        "pe": {},
+        "name": "System",
+        "start": "2022-04-04T12:15:41.4606245Z",
+        "pid": 4,
+        "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTQtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
+        "command_line": "",
+        "executable": "",
+        "thread": {
+            "Ext": {
+                "call_stack": [
+                    {
+                        "instruction_pointer": 140705188471348,
+                        "memory_section": {
+                            "memory_address": 140705187827712,
+                            "memory_size": 1163264,
+                            "protection": "R-X"
+                        },
+                        "module_name": "ntdll.dll",
+                        "module_path": "c:\\windows\\system32\\ntdll.dll",
+                        "symbol_info": "c:\\windows\\system32\\ntdll.dll!NtAlpcSendWaitReceivePort+0x14"
+                    },
+                    {
+                        "instruction_pointer": 140705158956066,
+                        "memory_section": {
+                            "memory_address": 140705158664192,
+                            "memory_size": 921600,
+                            "protection": "R-X"
+                        },
+                        "module_name": "rpcrt4.dll",
+                        "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                        "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879048422"
+                    },
+                    {
+                        "instruction_pointer": 140705158944113,
+                        "memory_section": {
+                            "memory_address": 140705158664192,
+                            "memory_size": 921600,
+                            "protection": "R-X"
+                        },
+                        "module_name": "rpcrt4.dll",
+                        "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                        "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879045571"
+                    },
+                    {
+                        "instruction_pointer": 140705158854463,
+                        "memory_section": {
+                            "memory_address": 140705158664192,
+                            "memory_size": 921600,
+                            "protection": "R-X"
+                        },
+                        "module_name": "rpcrt4.dll",
+                        "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                        "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF87902F73F"
+                    },
+                    {
+                        "instruction_pointer": 140705155101013,
+                        "memory_section": {
+                            "memory_address": 140705154535424,
+                            "memory_size": 2334720,
+                            "protection": "R-X"
+                        },
+                        "module_name": "combase.dll",
+                        "module_path": "c:\\windows\\system32\\combase.dll",
+                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9B155"
+                    },
+                    {
+                        "instruction_pointer": 140705155097096,
+                        "memory_section": {
+                            "memory_address": 140705154535424,
+                            "memory_size": 2334720,
+                            "protection": "R-X"
+                        },
+                        "module_name": "combase.dll",
+                        "module_path": "c:\\windows\\system32\\combase.dll",
+                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9A208"
+                    },
+                    {
+                        "instruction_pointer": 140705155090820,
+                        "memory_section": {
+                            "memory_address": 140705154535424,
+                            "memory_size": 2334720,
+                            "protection": "R-X"
+                        },
+                        "module_name": "combase.dll",
+                        "module_path": "c:\\windows\\system32\\combase.dll",
+                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C98984"
+                    },
+                    {
+                        "instruction_pointer": 140705155093243,
+                        "memory_section": {
+                            "memory_address": 140705154535424,
+                            "memory_size": 2334720,
+                            "protection": "R-X"
+                        },
+                        "module_name": "combase.dll",
+                        "module_path": "c:\\windows\\system32\\combase.dll",
+                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C992FB"
+                    },
+                    {
+                        "instruction_pointer": 140705155073556,
+                        "memory_section": {
+                            "memory_address": 140705154535424,
+                            "memory_size": 2334720,
+                            "protection": "R-X"
+                        },
+                        "module_name": "combase.dll",
+                        "module_path": "c:\\windows\\system32\\combase.dll",
+                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C94614"
+                    },
+                    {
+                        "instruction_pointer": 140705155277630,
+                        "memory_section": {
+                            "memory_address": 140705154535424,
+                            "memory_size": 2334720,
+                            "protection": "R-X"
+                        },
+                        "module_name": "combase.dll",
+                        "module_path": "c:\\windows\\system32\\combase.dll",
+                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC633E"
+                    },
+                    {
+                        "instruction_pointer": 140705158666224,
+                        "memory_section": {
+                            "memory_address": 140705158664192,
+                            "memory_size": 921600,
+                            "protection": "R-X"
+                        },
+                        "module_name": "rpcrt4.dll",
+                        "module_path": "c:\\windows\\system32\\rpcrt4.dll",
+                        "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF8790017F0"
+                    },
+                    {
+                        "instruction_pointer": 140705155255496,
+                        "memory_section": {
+                            "memory_address": 140705154535424,
+                            "memory_size": 2334720,
+                            "protection": "R-X"
+                        },
+                        "module_name": "combase.dll",
+                        "module_path": "c:\\windows\\system32\\combase.dll",
+                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC0CC8"
+                    },
+                    {
+                        "instruction_pointer": 140705155775858,
+                        "memory_section": {
+                            "memory_address": 140705154535424,
+                            "memory_size": 2334720,
+                            "protection": "R-X"
+                        },
+                        "module_name": "combase.dll",
+                        "module_path": "c:\\windows\\system32\\combase.dll",
+                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878D3FD72"
+                    },
+                    {
+                        "instruction_pointer": 140704876148243,
+                        "memory_section": {
+                            "memory_address": 140704875483136,
+                            "memory_size": 708608,
+                            "protection": "R-X"
+                        },
+                        "module_name": "fastprox.dll",
+                        "module_path": "c:\\windows\\system32\\wbem\\fastprox.dll",
+                        "symbol_info": "c:\\windows\\system32\\wbem\\fastprox.dll!0x7FF868293613"
+                    },
+                    {
+                        "instruction_pointer": 140699640718787,
+                        "memory_section": {
+                            "memory_address": 140699634241536,
+                            "memory_size": 9220096,
+                            "protection": "R-X"
+                        },
+                        "module_name": "alertstests.exe",
+                        "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
+                        "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301AE5C3"
+                    },
+                    {
+                        "instruction_pointer": 140699640807495,
+                        "memory_section": {
+                            "memory_address": 140699634241536,
+                            "memory_size": 9220096,
+                            "protection": "R-X"
+                        },
+                        "module_name": "alertstests.exe",
+                        "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
+                        "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301C4047"
+                    },
+                    {
+                        "instruction_pointer": 140705160001044,
+                        "memory_section": {
+                            "memory_address": 140705159909376,
+                            "memory_size": 520192,
+                            "protection": "R-X"
+                        },
+                        "module_name": "kernel32.dll",
+                        "module_path": "c:\\windows\\system32\\kernel32.dll",
+                        "symbol_info": "c:\\windows\\system32\\kernel32.dll!BaseThreadInitThunk+0x14"
+                    },
+                    {
+                        "instruction_pointer": 140705188161185,
+                        "memory_section": {
+                            "memory_address": 140705187827712,
+                            "memory_size": 1163264,
+                            "protection": "R-X"
+                        },
+                        "module_name": "ntdll.dll",
+                        "module_path": "c:\\windows\\system32\\ntdll.dll",
+                        "symbol_info": "c:\\windows\\system32\\ntdll.dll!RtlUserThreadStart+0x21"
+                    }
+                ],
+                "call_stack_final_hook_module": {
+                    "code_signature": [
+                        {
+                            "exists": true,
+                            "status": "trusted",
+                            "subject_name": "Microsoft Corporation",
+                            "trusted": true
+                        }
+                    ],
+                    "hash": {
+                        "sha256": "e5bfc1a2967fa513177a0327770927d9a2efa5a4f33ac18f716bae7c3f857994"
+                    },
+                    "path": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\131.0.2903.112\\msedge_elf.dll"
+                },
+                "call_stack_final_user_module": {
+                    "code_signature": [
+                        {
+                            "exists": true,
+                            "status": "trusted",
+                            "subject_name": "Microsoft Windows",
+                            "trusted": true
+                        }
+                    ],
+                    "hash": {
+                        "sha256": "8c9740e7fe9c97d5782b8d3db102c7880c40f0b27f20d3ec9f334fe0161b7e55"
+                    },
+                    "name": "rpcrt4.dll",
+                    "path": "c:\\windows\\system32\\rpcrt4.dll"
+                },
+                "call_stack_summary": "ntdll.dll, rpcrt4.dll, combase.dll, rpcrt4.dll, combase.dll, fastprox.dll, alertstests.exe, kernel32.dll, ntdll.dll",
+                "hardware_breakpoint_set": true,
+                "start_address": 140699640807104,
+                "start_address_module": "C:\\Users\\vagrant\\endpoint-dev\\Build\\_WS-vs2019-x64-dbg\\AlertsTests\\Debug\\AlertsTests.exe"
+            },
+            "id": 5752
+        },
+        "uptime": 822
+    },
+    "rule": {
+        "ruleset": "production"
+    },
+    "message": "Malware Prevention Alert",
+    "@timestamp": "2022-04-04T12:15:41.5944062Z",
+    "file": {
+        "Ext": {
+            "temp_file_path": "C:\\Windows\\TEMP\\90edbe42-fe6c-4965-8a6b-222aa2b15cf2",
+            "code_signature": [
+                {
+                    "exists": false
+                }
+            ],
+            "quarantine_path": "C:\\.equarantine\\20a65f043449c96f10e538a860a415b55ff46c93",
+            "quarantine_message": "Success",
+            "quarantine_result": true,
+            "malware_classification": {
+                "identifier": "endpointpe-v4-model",
+                "score": 0.692318737506866,
+                "threshold": 0.58,
+                "version": "4.0.19000"
+            }
+        },
+        "owner": "Administrators",
+        "extension": "dll",
+        "drive_letter": "C",
+        "created": "2022-04-04T12:15:41.4606245Z",
+        "accessed": "2022-04-04T12:15:41.4606245Z",
+        "mtime": "2022-04-04T12:15:41.4606245Z",
+        "directory": "C:\\sysmon",
+        "path": "C:\\sysmon\\9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
+        "code_signature": {
+            "exists": false
+        },
+        "size": 4608,
+        "pe": {
+            "file_version": "0.0.0.0",
+            "description": " ",
+            "original_file_name": "5t5mpwxc.dll",
+            "Ext": {
+                "dotnet": true,
+                "streams": [
+                    {
+                        "name": "#~",
+                        "hash": {
+                            "md5": "debf08c09d49337fbe7acde4d3749242",
+                            "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
+                        }
+                    },
+                    {
+                        "name": "#Blob",
+                        "hash": {
+                            "md5": "debf08c09d49337fbe7acde4d3749242",
+                            "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
+                        }
+                    }
+                ],
+                "sections": [
+                    {
+                        "name": ".reloc",
+                        "hash": {
+                            "md5": "debf08c09d49337fbe7acde4d3749242",
+                            "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
+                        }
+                    }
+                ]
+            }
+        },
+        "name": "9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
+        "hash": {
+            "sha1": "9c0e42a47d34240a9a4101cc5d3bc5787dc5ad73",
+            "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53",
+            "md5": "debf08c09d49337fbe7acde4d3749242"
+        }
+    },
+    "Endpoint": {
+        "policy": {
+            "applied": {
+                "artifacts": {
+                    "global": {
+                        "identifiers": [
+                            {
+                                "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
+                                "name": "diagnostic-configuration-v1"
+                            },
+                            {
+                                "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
+                                "name": "diagnostic-endpointpe-v4-blocklist"
+                            },
+                            {
+                                "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
+                                "name": "diagnostic-endpointpe-v4-exceptionlist"
+                            },
+                            {
+                                "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
+                                "name": "diagnostic-endpointpe-v4-model"
+                            },
+                            {
+                                "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
+                                "name": "diagnostic-malware-signature-v1-windows"
+                            },
+                            {
+                                "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
+                                "name": "diagnostic-ransomware-v1-windows"
+                            },
+                            {
+                                "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
+                                "name": "diagnostic-rules-windows-v1"
+                            },
+                            {
+                                "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
+                                "name": "endpointpe-v4-blocklist"
+                            },
+                            {
+                                "sha256": "d784c2aa70a2216dd5bfeecfdd67a83ff5b656e9321bd70cf345a8667a63fb2e",
+                                "name": "endpointpe-v4-exceptionlist"
+                            },
+                            {
+                                "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
+                                "name": "endpointpe-v4-model"
+                            },
+                            {
+                                "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
+                                "name": "global-configuration-v1"
+                            },
+                            {
+                                "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
+                                "name": "global-exceptionlist-windows"
+                            },
+                            {
+                                "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
+                                "name": "global-trustlist-windows-v1"
+                            },
+                            {
+                                "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
+                                "name": "production-malware-signature-v1-windows"
+                            },
+                            {
+                                "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
+                                "name": "production-ransomware-v1-windows"
+                            },
+                            {
+                                "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
+                                "name": "production-rules-windows-v1"
+                            }
+                        ],
+                        "update_age": 0,
+                        "snapshot": "2023-09-26",
+                        "version": "1.0.260"
+                    },
+                    "user": {
+                        "identifiers": [
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-blocklist-windows-v1"
+                            },
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-eventfilterlist-windows-v1"
+                            },
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-exceptionlist-windows-v1"
+                            },
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-hostisolationexceptionlist-windows-v1"
+                            },
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-trustlist-windows-v1"
+                            }
+                        ],
+                        "version": "1.0.0"
+                    }
+                }
+            }
+        }
+    },
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "logs",
+        "dataset": "endpoint.alerts"
+    },
+    "elastic": {
+        "agent": {
+            "id": "2b1eb7f7-bd61-436a-98af-c2b182043476"
+        }
+    },
+    "host": {
+        "hostname": "security-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.34",
+            "fe80::4850:4f4f:4b53:8103",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "security-win-1",
+        "id": "bbea673e-eae6-4b03-8724-2183f79da331",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "severity": 73,
+        "code": "malicious_file",
+        "risk_score": 73,
+        "created": "2022-04-04T12:15:41.5944062Z",
+        "kind": "alert",
+        "module": "endpoint",
+        "type": [
+            "info",
+            "change",
+            "denied"
+        ],
+        "agent_id_status": "verified",
+        "sequence": 29414,
+        "ingested": "2022-04-04T12:19:33Z",
+        "action": "rename",
+        "id": "MYfSjQEEEFe1o09b+++++D5Q",
+        "category": [
+            "malware",
+            "intrusion_detection",
+            "file"
+        ],
+        "dataset": "endpoint.alerts",
+        "outcome": "success"
+    },
+    "user": {
+        "domain": "NT AUTHORITY",
+        "name": "SYSTEM"
+    },
+    "Memory_protection": {
+        "cross_session": false,
+        "feature": "shellcode_thread",
+        "parent_to_child": false,
+        "self_injection": false,
+        "unique_key_v2": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
+    },
+    "Responses": [
+        {
+            "@timestamp": "2023-04-13T16:15:16.0Z",
+            "action": {
+                "action": "file_rollback",
+                "file": {
+                    "attributes": [
+                        "invalid"
+                    ],
+                    "path": "",
+                    "reason": 2147484160
+                },
+                "source": {
+                    "attributes": [
+                        "archive"
+                    ],
+                    "path": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy55\\git\\endpoint-dev\\Python\\runtime\\failed_test_logs\\20230413_181248\\EndpointRollbackTestCase\\test_rollback_trigger_malware_1_prevent\\tmp\\TRA14KA5Z2\\ExceptionlistTester-Windows.1d1phoq97d"
+                }
+            },
+            "message": "Successful production rollback",
+            "result": 0
+        },
+        {
+            "@timestamp": "2023-04-13T16:15:16.0Z",
+            "action": {
+                "action": "registry_rollback",
+                "key": {
+                    "actions": [
+                        "Deleted"
+                    ],
+                    "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback\\1"
+                }
+            },
+            "message": "Successful production registry rollback",
+            "result": 0
+        },
+        {
+            "@timestamp": "2023-04-13T16:15:16.0Z",
+            "action": {
+                "action": "registry_rollback",
+                "key": {
+                    "actions": [
+                        "Modified"
+                    ],
+                    "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback.valuetest",
+                    "values": [
+                        {
+                            "actions": [
+                                "Deleted"
+                            ],
+                            "name": "SomeValue"
+                        }
+                    ]
+                }
+            }
+        },
+        {
+            "@timestamp": "2023-07-19T14:21:05.0Z",
+            "action": {
+                "action": "process_rollback",
+                "process": {
+                    "path": "C:\\Users\\Pawel Mirski\\AppData\\Local\\Programs\\Python\\Python38-32\\python.exe"
+                }
+            },
+            "message": "Successful production process rollback",
+            "result": 0
+        }
+    ]
+}
+```
+</details>
+
+### [Fields](alerts.md)
+- [@timestamp](alerts.md#@timestamp)
+- [Events](alerts.md#Events)
+- [message](alerts.md#message)
+- [Endpoint](alerts.md#Endpoint)
+- [Memory_protection](alerts.md#Memory_protection)
+- [Ransomware](alerts.md#Ransomware)
+- [Responses](alerts.md#Responses)
+- [Target](alerts.md#Target)
+- [agent](alerts.md#agent)
+- [cloud](alerts.md#cloud)
+- [container](alerts.md#container)
+- [data_stream](alerts.md#data_stream)
+- [destination](alerts.md#destination)
+- [dll](alerts.md#dll)
+- [dns](alerts.md#dns)
+- [ecs](alerts.md#ecs)
+- [elastic](alerts.md#elastic)
+- [event](alerts.md#event)
+- [file](alerts.md#file)
+- [group](alerts.md#group)
+- [host](alerts.md#host)
+- [orchestrator](alerts.md#orchestrator)
+- [process](alerts.md#process)
+- [registry](alerts.md#registry)
+- [rule](alerts.md#rule)
+- [source](alerts.md#source)
+- [threat](alerts.md#threat)
+- [user](alerts.md#user)
+# policy
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "agent": {
+        "build": {
+            "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+        },
+        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "message": "Endpoint policy change",
+    "@timestamp": "2022-04-04T18:38:15.7178887Z",
+    "Endpoint": {
+        "configuration": {
+            "isolation": false
+        },
+        "state": {
+            "isolation": false
+        },
+        "policy": {
+            "applied": {
+                "response": {
+                    "configurations": {
+                        "behavior_protection": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "load_config",
+                                "workflow",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "configure_file_events",
+                                "configure_network_events",
+                                "configure_process_events",
+                                "configure_kernel",
+                                "connect_kernel",
+                                "configure_imageload_events",
+                                "configure_dns_events",
+                                "configure_security_events",
+                                "configure_registry_events",
+                                "configure_malicious_behavior"
+                            ],
+                            "status": "success"
+                        },
+                        "streaming": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "load_config",
+                                "configure_output",
+                                "workflow"
+                            ],
+                            "status": "success"
+                        },
+                        "malware": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "load_config",
+                                "workflow",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "configure_malware",
+                                "configure_kernel",
+                                "detect_process_events",
+                                "detect_file_write_events",
+                                "connect_kernel",
+                                "configure_user_notification",
+                                "configure_alerts",
+                                "detect_file_open_events",
+                                "detect_sync_image_load_events"
+                            ],
+                            "status": "success"
+                        },
+                        "logging": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "load_config",
+                                "configure_logging",
+                                "workflow"
+                            ],
+                            "status": "success"
+                        },
+                        "antivirus_registration": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "load_config",
+                                "configure_antivirus_registration",
+                                "workflow"
+                            ],
+                            "status": "unsupported"
+                        },
+                        "host_isolation": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "configure_host_isolation",
+                                "load_config",
+                                "workflow",
+                                "connect_kernel",
+                                "configure_user_notification"
+                            ],
+                            "status": "success"
+                        },
+                        "events": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "load_config",
+                                "workflow",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "detect_process_events",
+                                "detect_file_write_events",
+                                "detect_network_events",
+                                "configure_file_events",
+                                "configure_network_events",
+                                "configure_process_events",
+                                "configure_kernel",
+                                "connect_kernel",
+                                "detect_file_open_events",
+                                "detect_file_access_events",
+                                "detect_async_image_load_events",
+                                "detect_registry_events",
+                                "detect_registry_access_events",
+                                "configure_imageload_events",
+                                "configure_dns_events",
+                                "configure_security_events",
+                                "configure_registry_events"
+                            ],
+                            "status": "success"
+                        },
+                        "ransomware": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "load_config",
+                                "workflow",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "detect_process_events",
+                                "detect_file_write_events",
+                                "configure_process_events",
+                                "configure_file_events",
+                                "configure_ransomware",
+                                "configure_kernel",
+                                "connect_kernel",
+                                "configure_user_notification"
+                            ],
+                            "status": "success"
+                        },
+                        "memory_protection": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "configure_memory_threat",
+                                "configure_process_events",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "workflow",
+                                "load_config",
+                                "detect_process_events",
+                                "configure_kernel",
+                                "connect_kernel",
+                                "detect_thread_events"
+                            ],
+                            "status": "success"
+                        },
+                        "attack_surface_reduction": {
+                            "concerned_actions": [
+                                "agent_connectivity",
+                                "configure_credential_hardening",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "workflow",
+                                "load_config",
+                                "configure_kernel",
+                                "connect_kernel"
+                            ],
+                            "status": "success"
+                        }
+                    },
+                    "diagnostic": {
+                        "behavior_protection": {
+                            "concerned_actions": [
+                                "load_config",
+                                "workflow",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "configure_file_events",
+                                "configure_network_events",
+                                "configure_process_events",
+                                "configure_kernel",
+                                "connect_kernel",
+                                "configure_imageload_events",
+                                "configure_dns_events",
+                                "configure_security_events",
+                                "configure_registry_events",
+                                "configure_diagnostic_rollback",
+                                "detect_process_handle_events",
+                                "configure_diagnostic_malicious_behavior"
+                            ],
+                            "status": "success"
+                        },
+                        "malware": {
+                            "concerned_actions": [
+                                "load_config",
+                                "workflow",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "configure_diagnostic_malware",
+                                "detect_process_events",
+                                "detect_file_write_events",
+                                "connect_kernel",
+                                "configure_kernel",
+                                "detect_file_open_events",
+                                "detect_sync_image_load_events",
+                                "configure_diagnostic_rollback"
+                            ],
+                            "status": "success"
+                        },
+                        "ransomware": {
+                            "concerned_actions": [
+                                "load_config",
+                                "workflow",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "detect_process_events",
+                                "detect_file_write_events",
+                                "configure_process_events",
+                                "configure_file_events",
+                                "configure_diagnostic_ransomware",
+                                "configure_kernel",
+                                "connect_kernel",
+                                "configure_diagnostic_rollback"
+                            ],
+                            "status": "success"
+                        },
+                        "memory_protection": {
+                            "concerned_actions": [
+                                "load_config",
+                                "workflow",
+                                "download_global_artifacts",
+                                "download_user_artifacts",
+                                "detect_process_events",
+                                "configure_process_events",
+                                "configure_diagnostic_memory_threat",
+                                "configure_kernel",
+                                "connect_kernel",
+                                "detect_thread_events",
+                                "configure_diagnostic_rollback"
+                            ],
+                            "status": "success"
+                        }
+                    }
+                },
+                "name": "endpoint-1",
+                "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
+                "actions": [
+                    {
+                        "name": "configure_antivirus_registration",
+                        "message": "Antivirus registration is not possible on servers",
+                        "status": "unsupported"
+                    },
+                    {
+                        "name": "configure_ransomware",
+                        "message": "Successfully enabled ransomware prevention with mbr enabled and canaries enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_memory_threat",
+                        "message": "Successfully enabled memory threat prevention with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_diagnostic_memory_threat",
+                        "message": "Successfully enabled memory threat detection with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_host_isolation",
+                        "message": "Host is not isolated",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_malicious_behavior",
+                        "message": "Enabled 152 out of 152 malicious behavior rules",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_diagnostic_malicious_behavior",
+                        "message": "Enabled 196 out of 196 diagnostic malicious behavior rules",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_user_notification",
+                        "message": "Successfully configured user notification",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_malware",
+                        "message": "Successfully enabled malware prevention",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_diagnostic_malware",
+                        "message": "Successfully enabled malware detection",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_diagnostic_rollback",
+                        "message": "Diagnostic system rollback is enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_kernel",
+                        "message": "Successfully configured kernel",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_output",
+                        "message": "Successfully configured output connection",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_alerts",
+                        "message": "Successfully configured alerts",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_logging",
+                        "message": "Successfully configured logging",
+                        "status": "success"
+                    },
+                    {
+                        "name": "load_config",
+                        "message": "Successfully parsed configuration",
+                        "status": "success"
+                    },
+                    {
+                        "name": "download_user_artifacts",
+                        "message": "Successfully downloaded user artifacts",
+                        "status": "success"
+                    },
+                    {
+                        "name": "download_global_artifacts",
+                        "message": "Global artifacts are available for use",
+                        "status": "success"
+                    },
+                    {
+                        "name": "connect_kernel",
+                        "message": "Successfully connected to kernel",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_process_events",
+                        "message": "Successfully started process event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_sync_image_load_events",
+                        "message": "Successfully started sync image load event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_async_image_load_events",
+                        "message": "Successfully started async image load event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_file_write_events",
+                        "message": "Successfully started file write event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_file_open_events",
+                        "message": "Successfully stopped file open event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_network_events",
+                        "message": "Successfully started network event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_registry_events",
+                        "message": "Successfully started registry event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_thread_events",
+                        "message": "Successfully configured thread events",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_file_access_events",
+                        "message": "Successfully configured file access event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_registry_access_events",
+                        "message": "Successfully configured registry access event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "detect_process_handle_events",
+                        "message": "Successfully started process handle event reporting",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_file_events",
+                        "message": "Success enabling file events; current state is enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_network_events",
+                        "message": "Success enabling network events; current state is enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_process_events",
+                        "message": "Success enabling process events; current state is enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_imageload_events",
+                        "message": "Success enabling image load events; current state is enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_dns_events",
+                        "message": "Success enabling dns events; current state is enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_registry_events",
+                        "message": "Success enabling registry events; current state is enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_security_events",
+                        "message": "Success enabling security events; current state is enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_diagnostic_ransomware",
+                        "message": "Successfully enabled ransomware detection with mbr enabled and canaries enabled",
+                        "status": "success"
+                    },
+                    {
+                        "name": "agent_connectivity",
+                        "message": "Successfully connected to Agent",
+                        "status": "success"
+                    },
+                    {
+                        "name": "workflow",
+                        "message": "Successfully executed all workflows",
+                        "status": "success"
+                    },
+                    {
+                        "name": "configure_credential_hardening",
+                        "message": "Successfully configured credential hardening",
+                        "status": "success"
+                    }
+                ],
+                "endpoint_policy_version": "1",
+                "version": "2",
+                "artifacts": {
+                    "global": {
+                        "channel": "stable",
+                        "identifiers": [
+                            {
+                                "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
+                                "name": "diagnostic-configuration-v1"
+                            },
+                            {
+                                "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
+                                "name": "diagnostic-endpointpe-v4-blocklist"
+                            },
+                            {
+                                "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
+                                "name": "diagnostic-endpointpe-v4-exceptionlist"
+                            },
+                            {
+                                "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
+                                "name": "diagnostic-endpointpe-v4-model"
+                            },
+                            {
+                                "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
+                                "name": "diagnostic-malware-signature-v1-windows"
+                            },
+                            {
+                                "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
+                                "name": "diagnostic-ransomware-v1-windows"
+                            },
+                            {
+                                "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
+                                "name": "diagnostic-rules-windows-v1"
+                            },
+                            {
+                                "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
+                                "name": "endpointpe-v4-blocklist"
+                            },
+                            {
+                                "sha256": "b49fdcd8bf63af07ab1e74352137eb20f1e3710640dfcb1bfff3f7273ee14a7f",
+                                "name": "endpointpe-v4-exceptionlist"
+                            },
+                            {
+                                "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
+                                "name": "endpointpe-v4-model"
+                            },
+                            {
+                                "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
+                                "name": "global-configuration-v1"
+                            },
+                            {
+                                "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
+                                "name": "global-exceptionlist-windows"
+                            },
+                            {
+                                "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
+                                "name": "global-trustlist-windows-v1"
+                            },
+                            {
+                                "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
+                                "name": "production-malware-signature-v1-windows"
+                            },
+                            {
+                                "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
+                                "name": "production-ransomware-v1-windows"
+                            },
+                            {
+                                "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
+                                "name": "production-rules-windows-v1"
+                            }
+                        ],
+                        "update_age": 0,
+                        "snapshot": "2023-09-26",
+                        "version": "1.0.261"
+                    },
+                    "user": {
+                        "identifiers": [
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-blocklist-windows-v1"
+                            },
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-eventfilterlist-windows-v1"
+                            },
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-exceptionlist-windows-v1"
+                            },
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-hostisolationexceptionlist-windows-v1"
+                            },
+                            {
+                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
+                                "name": "endpoint-trustlist-windows-v1"
+                            }
+                        ],
+                        "version": "1.0.0"
+                    }
+                },
+                "status": "success"
+            }
+        }
+    },
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "endpoint.policy"
+    },
+    "host": {
+        "hostname": "data-viz-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.13",
+            "fe80::f40a:aed0:618a:972d",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "data-viz-win-1",
+        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "sequence": 35122,
+        "ingested": "2022-04-04T18:38:16Z",
+        "created": "2022-04-04T18:38:15.7178887Z",
+        "kind": "state",
+        "module": "endpoint",
+        "action": "endpoint_policy_response",
+        "id": "MYfZG00oEwD2/fqT+++++Bye",
+        "category": [
+            "host"
+        ],
+        "type": [
+            "change"
+        ],
+        "dataset": "endpoint.policy"
+    }
+}
+```
+</details>
+
+### [Fields](policy.md)
+- [@timestamp](policy.md#@timestamp)
+- [message](policy.md#message)
+- [Endpoint](policy.md#Endpoint)
+- [agent](policy.md#agent)
+- [data_stream](policy.md#data_stream)
+- [ecs](policy.md#ecs)
+- [event](policy.md#event)
+- [host](policy.md#host)
+# registry
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "registry": {
+        "hive": "HKLM",
+        "path": "HKLM\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
+        "data": {
+            "strings": [],
+            "type": "REG_NONE"
+        },
+        "value": "Enabled",
+        "key": "SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
+    },
+    "agent": {
+        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "Effective_process": {
+        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
+        "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
+        "name": "WMIC.exe",
+        "pid": 2732
+    },
+    "process": {
+        "Ext": {
+            "ancestry": [
+                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+            ],
+            "code_signature": [
+                {
+                    "trusted": true,
+                    "subject_name": "Microsoft Windows Publisher",
+                    "exists": true,
+                    "status": "trusted"
+                }
+            ]
+        },
+        "code_signature": {
+            "trusted": true,
+            "subject_name": "Microsoft Windows Publisher",
+            "exists": true,
+            "status": "trusted"
+        },
+        "name": "svchost.exe",
+        "pid": 2772,
+        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
+        "executable": "C:\\Windows\\System32\\svchost.exe",
+        "thread": {
+            "id": 340,
+            "Ext": {
+                "call_stack": [
+                    {
+                        "allocation_private_bytes": 16384,
+                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                        "protection": "RWX",
+                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                    }
+                ],
+                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                "hardware_breakpoint_set": true
+            }
+        }
+    },
+    "message": "Endpoint registry event",
+    "@timestamp": "2022-04-04T18:53:09.1283846Z",
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "logs",
+        "dataset": "endpoint.events.registry"
+    },
+    "host": {
+        "hostname": "data-viz-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.13",
+            "fe80::f40a:aed0:618a:972d",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "data-viz-win-1",
+        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "sequence": 36271,
+        "ingested": "2022-04-04T18:53:18Z",
+        "created": "2022-04-04T18:53:09.1283846Z",
+        "kind": "event",
+        "module": "endpoint",
+        "action": "query",
+        "id": "MYfZG00oEwD2/fqT+++++CMy",
+        "category": [
+            "registry"
+        ],
+        "type": [
+            "access"
+        ],
+        "dataset": "endpoint.events.registry"
+    },
+    "user": {
+        "domain": "NT AUTHORITY",
+        "name": "SYSTEM",
+        "id": "S-1-5-18"
+    }
+}
+```
+</details>
+
+### [Fields](registry.md)
+- [@timestamp](registry.md#@timestamp)
+- [message](registry.md#message)
+- [Effective_process](registry.md#Effective_process)
+- [agent](registry.md#agent)
+- [data_stream](registry.md#data_stream)
+- [destination](registry.md#destination)
+- [ecs](registry.md#ecs)
+- [event](registry.md#event)
+- [group](registry.md#group)
+- [host](registry.md#host)
+- [process](registry.md#process)
+- [registry](registry.md#registry)
+- [source](registry.md#source)
+- [user](registry.md#user)
+# process
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "agent": {
+        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "container": {
+        "id": "8d38b2f18290e973c5ea8f9ee207e970a8aa9191fa89bf3d4ea2a126f2f010a6",
+        "image": {
+            "name": "gke.gcr.io/csi-node-driver-registrar:v2.5.0-gke.1",
+            "tag": [
+                "v2.5.0-gke.1"
+            ],
+            "hash": {
+                "all": [
+                    "sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d"
+                ]
+            }
+        },
+        "name": "csi-driver-registrar"
+    },
+    "cloud": {
+        "account": {
+            "id": "1234"
+        },
+        "instance": {
+            "name": "webserver-12"
+        },
+        "project": {
+            "id": "1234"
+        },
+        "provider": "aws",
+        "region": "us-east-1"
+    },
+    "orchestrator": {
+        "cluster": {
+            "id": "f0cd61d5-327b-43e0-bc94-d9ea922fb4b5",
+            "name": "webservers"
+        },
+        "namespace": "webapp",
+        "resource": {
+            "ip": [
+                "10.1.237.155"
+            ],
+            "name": "pdcsi-node-6zh4j",
+            "type": "pod",
+            "parent": {
+                "type": "DaemonSet"
+            }
+        }
+    },
+    "process": {
+        "entry_leader": {
+            "attested_user": {
+                "id": "123",
+                "name": "userA"
+            },
+            "attested_groups": {
+                "name": "groupA"
+            }
+        },
+        "Ext": {
+            "ancestry": [
+                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+            ],
+            "memfd": {
+                "flag_hugetlb": false,
+                "flag_allow_seal": true,
+                "flags": 2,
+                "name": "test_memfd",
+                "flag_exec": false,
+                "flag_cloexec": false,
+                "flag_noexec_seal": false
+            },
+            "code_signature": [
+                {
+                    "trusted": true,
+                    "subject_name": "Microsoft Windows Publisher",
+                    "exists": true,
+                    "status": "trusted"
+                }
+            ],
+            "created_suspended": true,
+            "mitigation_policies": [
+                "Microsoft only, Opt-in to restrict to Microsoft, Windows Store and WHQL",
+                "CET dynamic APIs can only be called out of proc",
+                "CF Guard"
+            ],
+            "protection": "PsProtectedSignerAntimalware-Light",
+            "device": {
+                "volume_device_type": "Disk File System"
+            },
+            "authentication_id": "0x3e7",
+            "token": {
+                "integrity_level_name": "system",
+                "security_attributes": [
+                    "TSA://ProcUnique"
+                ],
+                "elevation_level": "default"
+            },
+            "effective_parent": {
+                "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
+                "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
+                "name": "WMIC.exe",
+                "pid": 2732
+            },
+            "relative_file_creation_time": 48628704.4029488,
+            "relative_file_name_modify_time": 48628704.4029488,
+            "session_info": {
+                "logon_type": "Interactive",
+                "client_address": "127.0.0.1",
+                "id": 1,
+                "authentication_package": "NTLM",
+                "relative_logon_time": 0.1,
+                "relative_password_age": 2592000.123,
+                "user_flags": [
+                    "LOGON_EXTRA_SIDS",
+                    "LOGON_NTLMV2_ENABLED",
+                    "LOGON_WINLOGON"
+                ]
+            }
+        },
+        "parent": {
+            "args": [],
+            "name": "services.exe",
+            "pid": 600,
+            "args_count": 0,
+            "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+            "command_line": "",
+            "executable": "C:\\Windows\\System32\\services.exe",
+            "thread": {
+                "Ext": {
+                    "call_stack": [
+                        {
+                            "allocation_private_bytes": 16384,
+                            "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                            "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                            "protection": "RWX",
+                            "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                        }
+                    ],
+                    "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                    "call_stack_contains_unbacked": true,
+                    "hardware_breakpoint_set": true
+                }
+            }
+        },
+        "pid": 2772,
+        "working_directory": "C:\\Windows\\system32\\",
+        "end": "2022-07-18T21:05:19.9419692Z",
+        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
+        "executable": "C:\\Windows\\System32\\svchost.exe",
+        "args": [
+            "C:\\Windows\\System32\\svchost.exe",
+            "-k",
+            "WerSvcGroup"
+        ],
+        "code_signature": {
+            "trusted": true,
+            "subject_name": "Microsoft Windows Publisher",
+            "exists": true,
+            "status": "trusted"
+        },
+        "pe": {
+            "original_file_name": "svchost.exe"
+        },
+        "name": "svchost.exe",
+        "args_count": 3,
+        "command_line": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
+        "hash": {
+            "sha1": "4fbfc6004084d97032837c21d3f426892d868eac",
+            "sha256": "cb19fd67b1d028e01f54c426a0924528c4a8d8ed8996cfe0ee0c6e45285436a1",
+            "md5": "1b280ad032268a636ecfe6f9165431b7"
+        },
+        "tty": {
+            "char_device": {
+                "major": 4,
+                "minor": 1
+            },
+            "rows": 24,
+            "columns": 80
+        },
+        "io": {
+            "text": "helloworld",
+            "total_bytes_captured": 10,
+            "total_bytes_skipped": 0,
+            "max_bytes_per_process_exceeded": false
+        },
+        "env_vars": [
+            "NICK=test",
+            "OTHER=why"
+        ]
+    },
+    "message": "Endpoint process event",
+    "@timestamp": "2022-04-04T18:53:08.6578986Z",
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "logs",
+        "dataset": "endpoint.events.process"
+    },
+    "host": {
+        "hostname": "data-viz-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.13",
+            "fe80::f40a:aed0:618a:972d",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "data-viz-win-1",
+        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "sequence": 36236,
+        "ingested": "2022-04-04T18:53:18Z",
+        "created": "2022-04-04T18:53:08.6578986Z",
+        "kind": "event",
+        "module": "endpoint",
+        "action": "start",
+        "id": "MYfZG00oEwD2/fqT+++++CLz",
+        "category": [
+            "process"
+        ],
+        "type": [
+            "start"
+        ],
+        "dataset": "endpoint.events.process"
+    },
+    "user": {
+        "domain": "NT AUTHORITY",
+        "name": "SYSTEM",
+        "id": "S-1-5-18"
+    }
+}
+```
+</details>
+
+### [Fields](process.md)
+- [@timestamp](process.md#@timestamp)
+- [message](process.md#message)
+- [agent](process.md#agent)
+- [cloud](process.md#cloud)
+- [container](process.md#container)
+- [data_stream](process.md#data_stream)
+- [destination](process.md#destination)
+- [ecs](process.md#ecs)
+- [event](process.md#event)
+- [group](process.md#group)
+- [host](process.md#host)
+- [orchestrator](process.md#orchestrator)
+- [package](process.md#package)
+- [process](process.md#process)
+- [source](process.md#source)
+- [user](process.md#user)
+# security
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "Target": {
+        "process": {
+            "Ext": {
+                "authentication_id": "0x3e7"
+            }
+        }
+    },
+    "agent": {
+        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "file": {
+        "path": "/User/admin/Downloads/application",
+        "code_signature": {
+            "signing_id": "com.developer.identifier",
+            "team_id": "XYZABC"
+        }
+    },
+    "process": {
+        "Ext": {
+            "ancestry": [
+                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+            ],
+            "authentication_id": "0x3e7",
+            "code_signature": [
+                {
+                    "trusted": true,
+                    "subject_name": "Microsoft Windows Publisher",
+                    "exists": true,
+                    "status": "trusted"
+                }
+            ]
+        },
+        "code_signature": {
+            "trusted": true,
+            "subject_name": "Microsoft Windows Publisher",
+            "exists": true,
+            "status": "trusted"
+        },
+        "name": "C:\\Windows\\System32\\services.exe",
+        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+        "executable": "C:\\Windows\\System32\\services.exe"
+    },
+    "message": "Endpoint security event",
+    "@timestamp": "2022-04-04T18:53:08.6510289Z",
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "logs",
+        "dataset": "endpoint.events.security"
+    },
+    "host": {
+        "hostname": "data-viz-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.13",
+            "fe80::f40a:aed0:618a:972d",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "data-viz-win-1",
+        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "sequence": 36385,
+        "ingested": "2022-04-04T18:53:18Z",
+        "created": "2022-04-04T18:53:08.6510289Z",
+        "kind": "event",
+        "module": "endpoint",
+        "action": "log_on",
+        "id": "MYfZG00oEwD2/fqT+++++CQ/",
+        "category": [
+            "authentication",
+            "session"
+        ],
+        "type": [
+            "start"
+        ],
+        "dataset": "endpoint.events.security",
+        "outcome": "success"
+    },
+    "user": {
+        "domain": "DESKTOP-1TK590J",
+        "effective": {
+            "domain": "DESKTOP-1TK590J",
+            "name": "EafTestLogon80589",
+            "id": "S-1-5-18",
+            "email": "EafTestLogon80589@DESKTOP-1TK590J.local",
+            "full_name": "EafTestLogon80589",
+            "hash": "f1297b0233914ec6ebf8fc01195e8712dfd8322f5e8d9d8bbe0083a0fc1860fd"
+        },
+        "id": "S-1-5-21-1749029863-1064264096-968553628-1001",
+        "name": "Default"
+    },
+    "winlog": {
+        "event_data": {
+            "PrivilegeList": [
+                "SeSecurityPrivilege",
+                "SeTakeOwnershipPrivilege",
+                "SeLoadDriverPrivilege",
+                "SeBackupPrivilege",
+                "SeRestorePrivilege",
+                "SeDebugPrivilege",
+                "SeSystemEnvironmentPrivilege",
+                "SeImpersonatePrivilege",
+                "SeDelegateSessionUserImpersonatePrivilege"
+            ]
+        }
+    }
+}
+```
+</details>
+
+### [Fields](security.md)
+- [@timestamp](security.md#@timestamp)
+- [message](security.md#message)
+- [Target](security.md#Target)
+- [agent](security.md#agent)
+- [data_stream](security.md#data_stream)
+- [destination](security.md#destination)
+- [ecs](security.md#ecs)
+- [event](security.md#event)
+- [file](security.md#file)
+- [group](security.md#group)
+- [host](security.md#host)
+- [process](security.md#process)
+- [source](security.md#source)
+- [user](security.md#user)
+- [winlog](security.md#winlog)
+# metadata
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "agent": {
+        "build": {
+            "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+        },
+        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "@timestamp": "2022-04-04T12:33:36.6664577Z",
+    "Endpoint": {
+        "capabilities": [
+            "isolation"
+        ],
+        "configuration": {
+            "isolation": false
+        },
+        "state": {
+            "isolation": false
+        },
+        "policy": {
+            "applied": {
+                "name": "endpoint-1",
+                "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
+                "status": "success"
+            }
+        },
+        "status": "enrolled"
+    },
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "endpoint.metadata"
+    },
+    "elastic": {
+        "agent": {
+            "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21"
+        }
+    },
+    "host": {
+        "hostname": "data-viz-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.13",
+            "fe80::f40a:aed0:618a:972d",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "data-viz-win-1",
+        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "sequence": 5054,
+        "ingested": "2022-04-04T12:33:37Z",
+        "created": "2022-04-04T12:33:36.6664577Z",
+        "kind": "metric",
+        "module": "endpoint",
+        "action": "endpoint_metadata",
+        "id": "MYfZG00oEwD2/fqT+++++/SC",
+        "category": [
+            "host"
+        ],
+        "type": [
+            "info"
+        ],
+        "dataset": "endpoint.metadata"
+    }
+}
+```
+</details>
+
+### [Fields](metadata.md)
+- [@timestamp](metadata.md#@timestamp)
+- [Endpoint](metadata.md#Endpoint)
+- [agent](metadata.md#agent)
+- [data_stream](metadata.md#data_stream)
+- [ecs](metadata.md#ecs)
+- [elastic](metadata.md#elastic)
+- [event](metadata.md#event)
+- [host](metadata.md#host)
+# action_responses
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "EndpointActions": {
+        "completed_at": "2022-04-04T20:44:14.0Z",
+        "data": {
+            "comment": "Action completed successfully",
+            "command": "isolate"
+        },
+        "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
+        "started_at": "2022-04-04T20:44:08.0Z"
+    },
+    "agent": {
+        "id": "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
+    },
+    "@timestamp": "2022-04-04T20:44:14.0Z",
+    "data_stream": {
+        "namespace": "default",
+        "type": ".logs",
+        "dataset": "endpoint.action.responses"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "ingested": "2022-04-04T20:44:45Z"
+    }
+}
+```
+</details>
+
+### [Fields](action_responses.md)
+- [@timestamp](action_responses.md#@timestamp)
+- [action_id](action_responses.md#action_id)
+- [agent_id](action_responses.md#agent_id)
+- [completed_at](action_responses.md#completed_at)
+- [data.alert_id](action_responses.md#data.alert_id)
+- [data.command](action_responses.md#data.command)
+- [data.comment](action_responses.md#data.comment)
+- [started_at](action_responses.md#started_at)
+- [status](action_responses.md#status)
+- [EndpointActions](action_responses.md#EndpointActions)
+- [agent](action_responses.md#agent)
+- [data_stream](action_responses.md#data_stream)
+- [ecs](action_responses.md#ecs)
+- [error](action_responses.md#error)
+- [event](action_responses.md#event)
+# collection
+### [Fields](collection.md)
+- [@timestamp](collection.md#@timestamp)
+- [data_stream](collection.md#data_stream)
+- [ecs](collection.md#ecs)
+- [event](collection.md#event)
+# library
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "agent": {
+        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "process": {
+        "Ext": {
+            "ancestry": [
+                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
+                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
+            ],
+            "code_signature": [
+                {
+                    "trusted": true,
+                    "subject_name": "Microsoft Windows",
+                    "exists": true,
+                    "status": "trusted"
+                }
+            ],
+            "protection": "PsProtectedSignerAntimalware-Light"
+        },
+        "code_signature": {
+            "trusted": true,
+            "subject_name": "Microsoft Windows",
+            "exists": true,
+            "status": "trusted"
+        },
+        "name": "VSSVC.exe",
+        "pid": 4528,
+        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ1MjgtMTMyOTM1NzEwODYuNjI4MzM0NzAw",
+        "executable": "C:\\Windows\\System32\\VSSVC.exe",
+        "thread": {
+            "id": 340,
+            "Ext": {
+                "call_stack": [
+                    {
+                        "allocation_private_bytes": 16384,
+                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                        "protection": "RWX",
+                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                    }
+                ],
+                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                "hardware_breakpoint_set": true
+            }
+        }
+    },
+    "dll": {
+        "Ext": {
+            "code_signature": [
+                {
+                    "trusted": true,
+                    "subject_name": "Microsoft Windows",
+                    "exists": true,
+                    "status": "trusted"
+                }
+            ],
+            "device": {
+                "volume_device_type": "Disk File System"
+            },
+            "load_index": 1,
+            "relative_file_creation_time": 48628704.4029488,
+            "relative_file_name_modify_time": 48628704.4029488,
+            "size": 65536
+        },
+        "path": "C:\\Windows\\System32\\msxml3.dll",
+        "code_signature": {
+            "trusted": true,
+            "subject_name": "Microsoft Windows",
+            "exists": true,
+            "status": "trusted"
+        },
+        "pe": {
+            "file_version": "8.110.17763.1911",
+            "imphash": "2e1d1e35c17be5497d2de33f06dc41b4",
+            "original_file_name": "MSXML3.dll"
+        },
+        "name": "msxml3.dll",
+        "hash": {
+            "sha1": "02488fb2dbf679a3282338178b451da635b79b54",
+            "sha256": "a9698adcf789d9e30f37dd5e6c9be0441bc37662ba7402e85071ccec2135d36c",
+            "md5": "65e4fd0564411bb60c600fae12cde2f9"
+        }
+    },
+    "message": "Endpoint DLL load event",
+    "@timestamp": "2022-04-04T18:38:08.3185831Z",
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "logs",
+        "dataset": "endpoint.events.library"
+    },
+    "host": {
+        "hostname": "data-viz-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.13",
+            "fe80::f40a:aed0:618a:972d",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "data-viz-win-1",
+        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "sequence": 34339,
+        "ingested": "2022-04-04T18:38:16Z",
+        "created": "2022-04-04T18:38:08.3185831Z",
+        "kind": "event",
+        "module": "endpoint",
+        "action": "load",
+        "id": "MYfZG00oEwD2/fqT+++++BRi",
+        "category": [
+            "library"
+        ],
+        "type": [
+            "start"
+        ],
+        "dataset": "endpoint.events.library"
+    },
+    "user": {
+        "domain": "NT AUTHORITY",
+        "name": "SYSTEM",
+        "id": "S-1-5-18"
+    },
+    "Effective_process": {
+        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTU2NS0xNjk1MTkyOTQ3",
+        "executable": "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
+        "name": "Terminal",
+        "pid": 565
+    }
+}
+```
+</details>
+
+### [Fields](library.md)
+- [@timestamp](library.md#@timestamp)
+- [message](library.md#message)
+- [Effective_process](library.md#Effective_process)
+- [agent](library.md#agent)
+- [data_stream](library.md#data_stream)
+- [destination](library.md#destination)
+- [dll](library.md#dll)
+- [ecs](library.md#ecs)
+- [event](library.md#event)
+- [file](library.md#file)
+- [group](library.md#group)
+- [host](library.md#host)
+- [process](library.md#process)
+- [source](library.md#source)
+- [user](library.md#user)
+# heartbeat
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "@timestamp": "2023-07-18T20:40:09.279939Z",
+    "agent": {
+        "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
+    },
+    "data_stream": {
+        "dataset": "endpoint.heartbeat",
+        "namespace": "default",
+        "type": ".logs"
+    },
+    "message": "Endpoint heartbeat",
+    "event": {
+        "ingested": "2023-07-18T20:40:09.279939Z"
+    },
+    "billable": true
+}
+```
+</details>
+
+### [Fields](heartbeat.md)
+- [@timestamp](heartbeat.md#@timestamp)
+- [billable](heartbeat.md#billable)
+- [message](heartbeat.md#message)
+- [agent](heartbeat.md#agent)
+- [data_stream](heartbeat.md#data_stream)
+- [event](heartbeat.md#event)
+# actions
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "EndpointActions": {
+        "data": {
+            "comment": "testing isolation",
+            "command": "isolate"
+        },
+        "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
+        "input_type": "endpoint",
+        "expiration": "2022-04-18T20:44:07.805Z",
+        "type": "INPUT_ACTION"
+    },
+    "agent": {
+        "id": [
+            "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
+        ]
+    },
+    "@timestamp": "2022-04-04T20:44:07.805Z",
+    "event": {
+        "agent_id_status": "auth_metadata_missing",
+        "ingested": "2022-04-04T20:44:07Z"
+    },
+    "user": {
+        "id": "user@elastic.co"
+    }
+}
+```
+</details>
+
+### [Fields](actions.md)
+- [@timestamp](actions.md#@timestamp)
+- [action_id](actions.md#action_id)
+- [agents](actions.md#agents)
+- [data.alert_id](actions.md#data.alert_id)
+- [data.command](actions.md#data.command)
+- [data.comment](actions.md#data.comment)
+- [expiration](actions.md#expiration)
+- [input_type](actions.md#input_type)
+- [type](actions.md#type)
+- [user_id](actions.md#user_id)
+- [EndpointActions](actions.md#EndpointActions)
+- [agent](actions.md#agent)
+- [data_stream](actions.md#data_stream)
+- [ecs](actions.md#ecs)
+- [error](actions.md#error)
+- [event](actions.md#event)
+- [rule](actions.md#rule)
+- [user](actions.md#user)
+# file
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "agent": {
+        "id": "ccb7b1a1-303e-416f-b975-311737e8e125",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "Effective_process": {
+        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
+        "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
+        "name": "WMIC.exe",
+        "pid": 2732
+    },
+    "process": {
+        "Ext": {
+            "ancestry": [
+                "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTYwNC0xMzI5MzU0OTEwOS4zNTg1OTc3MDA=",
+                "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ3Mi0xMzI5MzU0OTEwOS43NjU4MjcwMA=="
+            ],
+            "code_signature": [
+                {
+                    "trusted": true,
+                    "subject_name": "Elasticsearch, Inc.",
+                    "exists": true,
+                    "status": "trusted"
+                }
+            ]
+        },
+        "args_count": 1,
+        "parent": {
+            "pid": 604,
+            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
+            "group_leader": {
+                "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+            }
+        },
+        "entry_leader": {
+            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
+            "parent": {
+                "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+            }
+        },
+        "session_leader": {
+            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+        },
+        "group_leader": {
+            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
+        },
+        "code_signature": {
+            "trusted": true,
+            "subject_name": "Elasticsearch, Inc.",
+            "exists": true,
+            "status": "trusted"
+        },
+        "name": "winlogbeat.exe",
+        "pid": 4512,
+        "thread": {
+            "id": 340,
+            "Ext": {
+                "call_stack": [
+                    {
+                        "allocation_private_bytes": 16384,
+                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
+                        "protection": "RWX",
+                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
+                    }
+                ],
+                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
+                "hardware_breakpoint_set": true
+            }
+        },
+        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
+        "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
+    },
+    "message": "Endpoint file event",
+    "@timestamp": "2022-04-04T18:37:01.5775771Z",
+    "file": {
+        "Ext": {
+            "header_data": [],
+            "entropy": 5.28353871945538,
+            "device": {
+                "volume_device_type": "Disk File System"
+            },
+            "header_bytes": "7570646174655f74696d653a20323032",
+            "windows": {
+                "zone_identifier": -1
+            },
+            "monotonic_id": 3526
+        },
+        "path": "C:\\ProgramData\\winlogbeat\\.winlogbeat.yml.new",
+        "extension": "new",
+        "size": 1406,
+        "name": ".winlogbeat.yml.new",
+        "origin_referrer_url": "https://example.com",
+        "origin_url": "https://example.com/file.zip"
+    },
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "logs",
+        "dataset": "endpoint.events.file"
+    },
+    "host": {
+        "hostname": "response-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.9",
+            "fe80::4d1:ef01:c0ed:299a",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "response-win-1",
+        "id": "bcbbe9cb-0278-43f9-aa1b-2dc9839bbf6f",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "sequence": 32114,
+        "ingested": "2022-04-04T18:37:29Z",
+        "created": "2022-04-04T18:37:01.5775771Z",
+        "kind": "event",
+        "module": "endpoint",
+        "action": "creation",
+        "id": "MYfZFpbNKturKgFp+++++AlT",
+        "category": [
+            "file"
+        ],
+        "type": [
+            "creation"
+        ],
+        "dataset": "endpoint.events.file"
+    },
+    "user": {
+        "domain": "NT AUTHORITY",
+        "name": "SYSTEM",
+        "id": "S-1-5-18"
+    }
+}
+```
+</details>
+
+### [Fields](file.md)
+- [@timestamp](file.md#@timestamp)
+- [message](file.md#message)
+- [Effective_process](file.md#Effective_process)
+- [Persistence](file.md#Persistence)
+- [agent](file.md#agent)
+- [data_stream](file.md#data_stream)
+- [destination](file.md#destination)
+- [ecs](file.md#ecs)
+- [event](file.md#event)
+- [file](file.md#file)
+- [group](file.md#group)
+- [host](file.md#host)
+- [process](file.md#process)
+- [source](file.md#source)
+- [user](file.md#user)
+# api
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "@timestamp": "2023-01-09T19:38:51.5141503Z",
+    "Target": {
+        "process": {
+            "Ext": {
+                "created_suspended": true,
+                "protection": "PsProtectedSignerWinTcb",
+                "memory_region": {
+                    "allocation_base": 1649160290304,
+                    "allocation_protection": "RWX",
+                    "allocation_size": 4096,
+                    "allocation_type": "PRIVATE",
+                    "bytes_address": 1649160290304,
+                    "bytes_allocation_offset": 0,
+                    "bytes_compressed": "eJztwbEJACAMALA+5uAtWnAoOPg/+EWnJO9k1bo742XuMRsEAAAA0OsD8lge9g==",
+                    "bytes_compressed_present": true,
+                    "hash": {
+                        "sha256": "0b28b598ef70fd2377613fd88a50d52047ae31c16f2c688f3aa4e0b98d63730c"
+                    },
+                    "memory_pe_detected": false,
+                    "region_base": 1649160290304,
+                    "region_protection": "R--",
+                    "region_size": 4096,
+                    "region_state": "COMMIT",
+                    "strings": [
+                        "shellcode",
+                        "seed=AAAA"
+                    ]
+                },
+                "token": {
+                    "integrity_level_name": "high"
+                }
+            },
+            "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI1NzMyLTE2OTkwMDE3NDAuOTU4NTY4MDAw",
+            "executable": "C:\\Temp\\1_StayRunningWin32_x64.exe",
+            "name": "1_StayRunningWin32_x64.exe",
+            "pid": 25732
+        }
+    },
+    "dll": {
+        "Ext": {
+            "code_signature": [
+                {
+                    "exists": true,
+                    "status": "trusted",
+                    "subject_name": "Microsoft Windows",
+                    "trusted": true
+                }
+            ]
+        },
+        "hash": {
+            "sha256": "8b9731a4b83e801cda7b918f8194608e91f86b3a86ffb6bb24230b1cc28e1a54"
+        },
+        "path": "c:\\windows\\system32\\drivers\\pktmon.sys"
+    },
+    "destination": {
+        "ip": "2001:4860:4860::8844",
+        "port": 139
+    },
+    "event": {
+        "category": [
+            "api",
+            "intrusion_detection"
+        ],
+        "created": "2023-01-09T19:38:51.5141503Z",
+        "dataset": "endpoint.events.api",
+        "id": "MvlgiHxIZtj1+Abi++++++ul",
+        "kind": "event",
+        "module": "endpoint",
+        "outcome": "success",
+        "provider": "Microsoft-Windows-Threat-Intelligence",
+        "sequence": 3802,
+        "type": [
+            "credential_access"
+        ]
+    },
+    "host": {
+        "architecture": "x86_64",
+        "hostname": "DESKTOP-OCG8CR6",
+        "id": "dabadaba-0000-0000-0000-000000000000",
+        "ip": [
+            "169.254.104.226",
+            "fe80::6037:d589:2ee9:772f",
+            "172.22.6.230",
+            "fe80::80ea:8e8d:e1f2:6622",
+            "169.254.74.35",
+            "fe80::900c:a9d3:fd8:9345",
+            "127.0.0.1",
+            "::1"
+        ],
+        "mac": [
+            "00-15-5D-00-09-18",
+            "00-15-5D-00-09-19",
+            "00-15-5D-00-09-17"
+        ],
+        "name": "DESKTOP-OCG8CR6",
+        "os": {
+            "Ext": {
+                "variant": "Windows 11 Enterprise N"
+            },
+            "family": "windows",
+            "full": "Windows 11 Enterprise N 22H2 (10.0.22621.963)",
+            "kernel": "22H2 (10.0.22621.963)",
+            "name": "Windows",
+            "platform": "windows",
+            "type": "windows",
+            "version": "22H2 (10.0.22621.963)"
+        }
+    },
+    "message": "Endpoint API event - hand-crafted with a superset of fields",
+    "network": {
+        "transport": "tcp",
+        "type": "ipv6"
+    },
+    "process": {
+        "Ext": {
+            "ancestry": [
+                "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTgxMi0xNjczMjkxNTMzLjcxNjczMTgwMA==",
+                "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ5NjAtMTY3Mjk2NTgzMC4yODc0OTYxMDA=",
+                "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTY2MjgtMTY3Mjk2NTc3Mi41MTg4MDA1MDA=",
+                "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ2MDAtMTY3Mjk2NTcxMy40NzY1NDUyMDA="
+            ],
+            "api": {
+                "behaviors": [
+                    "cross-process",
+                    "rapid_background_polling",
+                    "multiple_polling_processes",
+                    "pid_spoofing"
+                ],
+                "metadata": {
+                    "target_address_name": "Unbacked",
+                    "target_address_path": "c:\\windows\\system32\\ntdll.dll",
+                    "return_value": 1,
+                    "windows_count": 2,
+                    "visible_windows_count": 0,
+                    "thread_info_flags": 16,
+                    "start_address_module": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe",
+                    "start_address_allocation_protection": "RCX",
+                    "procedure_symbol": "taskbar.dll",
+                    "ms_since_last_keyevent": 94,
+                    "background_callcount": 6021,
+                    "security_descriptor": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)",
+                    "client_machine": "DESKTOP-EXAMPLE",
+                    "client_machine_fqdn": "DESKTOP-EXAMPLE",
+                    "client_process_id": 3600,
+                    "client_is_local": true,
+                    "amsi_filenames": [
+                        "C:\\script.ps1"
+                    ],
+                    "amsi_logs": {
+                        "entries": [
+                            "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
+                        ],
+                        "type": "PowerShell"
+                    }
+                },
+                "name": "OpenProcess",
+                "parameters": {
+                    "desired_access": [
+                        "PROCESS_QUERY_LIMITED_INFORMATION",
+                        "PROCESS_VM_READ"
+                    ],
+                    "desired_access_numeric": 4112,
+                    "handle_type": "process",
+                    "address": 2904525045760,
+                    "allocation_type": "COMMIT|RESERVE",
+                    "protection": "R-X",
+                    "protection_old": "R-X",
+                    "size": 16,
+                    "context_flags": 1048607,
+                    "r8": 8,
+                    "r9": 9,
+                    "rax": 10,
+                    "rbp": 3,
+                    "rbx": 11,
+                    "rcx": 2883351609344,
+                    "rdi": 5,
+                    "rdx": 13,
+                    "rip": 140706538588528,
+                    "rsi": 4,
+                    "rsp": 2,
+                    "eax": 10,
+                    "ebp": 3,
+                    "ebx": 11,
+                    "ecx": 12,
+                    "edi": 5,
+                    "edx": 0,
+                    "eip": 1,
+                    "esi": 4,
+                    "esp": 2,
+                    "argument1": 2583984274656,
+                    "argument2": 4105953215,
+                    "argument3": 31058890,
+                    "procedure": 140705553857280,
+                    "usage_page": "GENERIC",
+                    "usage": "KEYBOARD",
+                    "flags": "INPUTSINK",
+                    "hook_type": "WH_KEYBOARD_LL",
+                    "hook_module": "c:\\windows\\system32\\taskbar.dll",
+                    "device": "\\Device\\PktMonDev",
+                    "io_control_code": 27365,
+                    "event_filter_name": "ExampleFilter",
+                    "event_filter_details": "__EventFilter{EventNamespace = \"root\\CimV2\"; Name = \"ExampleFilter\";};",
+                    "consumer_name": "ExampleConsumer",
+                    "consumer_type": "CommandLineEventConsumer",
+                    "consumer_details": "CommandLineEventConsumer{Name = \"ExampleConsumer\";};",
+                    "namespace": "root\\Microsoft\\Windows\\DeviceGuard",
+                    "operation": "Win32_Process::Create",
+                    "app_name": "PowerShell",
+                    "content_name": "C:\\script.ps1",
+                    "buffer": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
+                },
+                "summary": "VirtualAllocEx( charmap.exe, NULL, 0x10, COMMIT|RESERVE, R-X )"
+            },
+            "code_signature": [
+                {
+                    "exists": true,
+                    "status": "errorBadDigest",
+                    "subject_name": "Microsoft Windows",
+                    "trusted": false
+                }
+            ],
+            "memory_region": {
+                "allocation_base": 140712018378752,
+                "allocation_protection": "RCX",
+                "allocation_size": 45056,
+                "allocation_type": "IMAGE",
+                "mapped_path": "C:\\Program Files\\Python39\\DLLs\\libffi-7.dll",
+                "region_base": 140712018395136,
+                "region_protection": "R-X",
+                "region_size": 8192,
+                "region_state": "COMMIT"
+            },
+            "token": {
+                "integrity_level_name": "system"
+            }
+        },
+        "code_signature": {
+            "exists": true,
+            "status": "errorBadDigest",
+            "subject_name": "Microsoft Windows",
+            "trusted": false
+        },
+        "command_line": "",
+        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTkxNi0xNjczMjkzMTMwLjk0NjAwMjAw",
+        "executable": "c\\git\\endpoint-dev\\Tools\\Leia\\modules\\exe_malware\\mimikatz.exe",
+        "name": "mimikatz.exe",
+        "pid": 916,
+        "thread": {
+            "Ext": {
+                "call_stack": [
+                    {
+                        "allocation_private_bytes": 4096,
+                        "protection_provenance": "dabapi.dll",
+                        "symbol_info": "c:\\windows\\system32\\ntdll.dll!ZwProtectVirtualMemory+0x14"
+                    },
+                    {
+                        "symbol_info": "c:\\windows\\system32\\kernelbase.dll!VirtualProtect+0x36"
+                    },
+                    {
+                        "allocation_private_bytes": 8192,
+                        "callsite_leading_bytes": "c048895424204c8bc9488d0d801f0000418d500248ff15052a00000f1f4400004883c438c3cccccccccccccccccccccc4883ec2048b880bf1acaf87f0000ffd0",
+                        "callsite_trailing_bytes": "4883c420c3ec48498363e800498d4320ba2500000049c743e004000000440fb7ca4c8d05d0320000ba2b000000498943d848ff15f82a00000f1f4400004883c4",
+                        "protection": "RWX",
+                        "protection_provenance": "eventstests.exe",
+                        "symbol_info": "c:\\windows\\system32\\dabapi.dll!DabApiBufferFree+0x10"
+                    },
+                    {
+                        "symbol_info": "Unknown"
+                    }
+                ],
+                "call_stack_final_user_module": {
+                    "allocation_private_bytes": 4096,
+                    "code_signature": [
+                        {
+                            "exists": true,
+                            "status": "trusted",
+                            "subject_name": "Microsoft Windows",
+                            "trusted": true
+                        }
+                    ],
+                    "hash": {
+                        "sha256": "0386c57d59ee1292bb74d9878358da7a0ba00e5b56ed52fd6171b9e6d29d85aa"
+                    },
+                    "name": "dabapi.dll",
+                    "path": "c:\\windows\\system32\\dabapi.dll",
+                    "protection": "RWX",
+                    "protection_provenance": "eventstests.exe",
+                    "protection_provenance_path": "c:\\dev\\eventstests.exe",
+                    "reason": "ntdll.dll"
+                },
+                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll"
+            },
+            "id": 11628
+        }
+    },
+    "user": {
+        "domain": "DESKTOP-OCG8CR6",
+        "id": "S-1-5-21-3820246941-898183108-3095036578-1001",
+        "name": "User"
+    }
+}
+```
+</details>
+
+### [Fields](api.md)
+- [@timestamp](api.md#@timestamp)
+- [message](api.md#message)
+- [Target](api.md#Target)
+- [data_stream](api.md#data_stream)
+- [destination](api.md#destination)
+- [dll](api.md#dll)
+- [ecs](api.md#ecs)
+- [event](api.md#event)
+- [host](api.md#host)
+- [network](api.md#network)
+- [process](api.md#process)
+- [user](api.md#user)
+# network
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "agent": {
+        "id": "afd348c6-0ec9-4961-805e-8ed2fc4c043b",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "process": {
+        "Ext": {
+            "ancestry": [
+                "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTYxMi0xMzI5MzU0OTEwOS43MzU5NDk3MDA=",
+                "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTQ3Ni0xMzI5MzU0OTEwOS4zODExMTM3MDA="
+            ],
+            "code_signature": [
+                {
+                    "trusted": false,
+                    "subject_name": "Google LLC",
+                    "exists": true,
+                    "status": "errorExpired"
+                }
+            ]
+        },
+        "parent": {
+            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
+            "group_leader": {
+                "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+            }
+        },
+        "entry_leader": {
+            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
+            "parent": {
+                "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+            }
+        },
+        "session_leader": {
+            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+        },
+        "group_leader": {
+            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
+        },
+        "code_signature": {
+            "trusted": false,
+            "subject_name": "Google LLC",
+            "exists": true,
+            "status": "errorExpired"
+        },
+        "name": "GCEWindowsAgent.exe",
+        "pid": 580,
+        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
+        "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
+    },
+    "destination": {
+        "geo": {
+            "continent_name": "North America",
+            "country_iso_code": "US",
+            "country_name": "United States",
+            "location": {
+                "lon": -97.822,
+                "lat": 37.751
+            }
+        },
+        "as": {
+            "number": 15169,
+            "organization": {
+                "name": "GOOGLE"
+            }
+        },
+        "address": "64.233.191.95",
+        "port": 443,
+        "bytes": 4923,
+        "ip": "64.233.191.95"
+    },
+    "source": {
+        "address": "10.201.0.32",
+        "port": 54924,
+        "bytes": 498,
+        "ip": "10.201.0.32"
+    },
+    "dns": {
+        "Ext": {
+            "status": 123,
+            "options": 9223372036854775808
+        },
+        "resolved_ip": [
+            "10.10.10.10",
+            "10.10.10.11"
+        ],
+        "question": {
+            "name": "foo",
+            "type": "A"
+        }
+    },
+    "message": "Endpoint network event",
+    "network": {
+        "transport": "tcp",
+        "type": "ipv4",
+        "direction": "egress"
+    },
+    "@timestamp": "2022-04-04T18:52:00.6007809Z",
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "logs",
+        "dataset": "endpoint.events.network"
+    },
+    "host": {
+        "hostname": "mgmt-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.32",
+            "fe80::f8e6:a511:69ea:27c4",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "mgmt-win-1",
+        "id": "51b19c6c-27e3-4c80-ac2a-b72ed52c40c9",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "sequence": 36090,
+        "ingested": "2022-04-04T18:52:21Z",
+        "created": "2022-04-04T18:52:00.6007809Z",
+        "kind": "event",
+        "module": "endpoint",
+        "action": "disconnect_received",
+        "id": "MYfZG5h8j1qej16H+++++CFe",
+        "category": [
+            "network"
+        ],
+        "type": [
+            "end"
+        ],
+        "dataset": "endpoint.events.network"
+    },
+    "user": {
+        "domain": "NT AUTHORITY",
+        "name": "SYSTEM",
+        "id": "S-1-5-18"
+    }
+}
+```
+</details>
+
+### [Fields](network.md)
+- [@timestamp](network.md#@timestamp)
+- [message](network.md#message)
+- [agent](network.md#agent)
+- [data_stream](network.md#data_stream)
+- [destination](network.md#destination)
+- [dns](network.md#dns)
+- [ecs](network.md#ecs)
+- [event](network.md#event)
+- [group](network.md#group)
+- [host](network.md#host)
+- [http](network.md#http)
+- [network](network.md#network)
+- [process](network.md#process)
+- [source](network.md#source)
+- [user](network.md#user)
+# metrics
+### Sample Event
+<details>
+<summary>
+Click to expand
+</summary>
+
+```json
+{
+    "agent": {
+        "build": {
+            "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
+        },
+        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
+        "type": "endpoint",
+        "version": "8.3.0-SNAPSHOT"
+    },
+    "message": "Endpoint metrics",
+    "@timestamp": "2022-04-04T18:38:15.7178887Z",
+    "Endpoint": {
+        "metrics": {
+            "system_impact": [
+                {
+                    "file_events": {
+                        "week_ms": 418
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows Publisher",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Windows\\System32\\svchost.exe"
+                    },
+                    "malware": {
+                        "week_ms": 7483
+                    },
+                    "process_events": {
+                        "week_ms": 78
+                    },
+                    "registry_events": {
+                        "week_ms": 248
+                    },
+                    "dns_events": {
+                        "week_ms": 16
+                    },
+                    "network_events": {
+                        "week_ms": 8
+                    },
+                    "overall": {
+                        "week_ms": 11744
+                    },
+                    "authentication_events": {
+                        "week_ms": 155
+                    },
+                    "library_load_events": {
+                        "week_ms": 3028
+                    },
+                    "cred_access_events": {
+                        "week_ms": 10
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 250
+                    },
+                    "win32k_events": {
+                        "week_ms": 50
+                    }
+                },
+                {
+                    "file_events": {
+                        "week_ms": 46
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
+                    },
+                    "malware": {
+                        "week_ms": 2
+                    },
+                    "process_events": {
+                        "week_ms": 19
+                    },
+                    "registry_events": {
+                        "week_ms": 3
+                    },
+                    "overall": {
+                        "week_ms": 8290
+                    },
+                    "library_load_events": {
+                        "week_ms": 7890
+                    },
+                    "cred_access_events": {
+                        "week_ms": 20
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 300
+                    },
+                    "win32k_events": {
+                        "week_ms": 10
+                    }
+                },
+                {
+                    "file_events": {
+                        "week_ms": 1641
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Elasticsearch, Inc.",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
+                    },
+                    "malware": {
+                        "week_ms": 2589
+                    },
+                    "process_events": {
+                        "week_ms": 419
+                    },
+                    "registry_events": {
+                        "week_ms": 1
+                    },
+                    "network_events": {
+                        "week_ms": 32
+                    },
+                    "overall": {
+                        "week_ms": 5046
+                    },
+                    "library_load_events": {
+                        "week_ms": 4
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 360
+                    }
+                },
+                {
+                    "file_events": {
+                        "week_ms": 2
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows Publisher",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Windows\\System32\\lsass.exe"
+                    },
+                    "process_events": {
+                        "week_ms": 3
+                    },
+                    "registry_events": {
+                        "week_ms": 83
+                    },
+                    "overall": {
+                        "week_ms": 4761
+                    },
+                    "authentication_events": {
+                        "week_ms": 3177
+                    },
+                    "library_load_events": {
+                        "week_ms": 26
+                    },
+                    "cred_access_events": {
+                        "week_ms": 1350
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 120
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Windows\\System32\\conhost.exe"
+                    },
+                    "malware": {
+                        "week_ms": 16
+                    },
+                    "process_events": {
+                        "week_ms": 26
+                    },
+                    "registry_events": {
+                        "week_ms": 3
+                    },
+                    "overall": {
+                        "week_ms": 3261
+                    },
+                    "library_load_events": {
+                        "week_ms": 2966
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 250
+                    }
+                },
+                {
+                    "file_events": {
+                        "week_ms": 51
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "exists": false,
+                                "status": "errorCode_endpoint: Initital state, no attempt to load signature was made"
+                            }
+                        ],
+                        "executable": "System"
+                    },
+                    "malware": {
+                        "week_ms": 1978
+                    },
+                    "overall": {
+                        "week_ms": 2029
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "exists": false
+                            }
+                        ],
+                        "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\e266326169887aa7cb26b9e2aa421ee4\\System.Web.ni.dll"
+                    },
+                    "malware": {
+                        "week_ms": 1015
+                    },
+                    "overall": {
+                        "week_ms": 1015
+                    }
+                },
+                {
+                    "file_events": {
+                        "week_ms": 8
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Elasticsearch, Inc.",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\metricbeat-8.3.0-SNAPSHOT-windows-x86_64\\metricbeat.exe"
+                    },
+                    "process_events": {
+                        "week_ms": 502
+                    },
+                    "dns_events": {
+                        "week_ms": 84
+                    },
+                    "network_events": {
+                        "week_ms": 1
+                    },
+                    "overall": {
+                        "week_ms": 1162
+                    },
+                    "library_load_events": {
+                        "week_ms": 417
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 150
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": false,
+                                "subject_name": "Google LLC",
+                                "exists": true,
+                                "status": "errorExpired"
+                            }
+                        ],
+                        "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
+                    },
+                    "malware": {
+                        "week_ms": 627
+                    },
+                    "process_events": {
+                        "week_ms": 89
+                    },
+                    "registry_events": {
+                        "week_ms": 2
+                    },
+                    "dns_events": {
+                        "week_ms": 7
+                    },
+                    "network_events": {
+                        "week_ms": 8
+                    },
+                    "overall": {
+                        "week_ms": 1068
+                    },
+                    "library_load_events": {
+                        "week_ms": 85
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 250
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "exists": false
+                            }
+                        ],
+                        "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\39ce4aafe1a3bc56fb1435f6550dd7a3\\Microsoft.PowerShell.Commands.Utility.ni.dll"
+                    },
+                    "malware": {
+                        "week_ms": 760
+                    },
+                    "overall": {
+                        "week_ms": 760
+                    }
+                },
+                {
+                    "file_events": {
+                        "week_ms": 15
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "exists": false
+                            }
+                        ],
+                        "executable": "C:\\Program Files\\metricbeat-7.10.0-windows-x86_64\\metricbeat.exe"
+                    },
+                    "malware": {
+                        "week_ms": 29
+                    },
+                    "process_events": {
+                        "week_ms": 634
+                    },
+                    "registry_events": {
+                        "week_ms": 1
+                    },
+                    "dns_events": {
+                        "week_ms": 8
+                    },
+                    "network_events": {
+                        "week_ms": 4
+                    },
+                    "overall": {
+                        "week_ms": 744
+                    },
+                    "library_load_events": {
+                        "week_ms": 3
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 50
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Windows\\System32\\spoolsv.exe"
+                    },
+                    "process_events": {
+                        "week_ms": 8
+                    },
+                    "registry_events": {
+                        "week_ms": 40
+                    },
+                    "overall": {
+                        "week_ms": 795
+                    },
+                    "library_load_events": {
+                        "week_ms": 627
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 120
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Elasticsearch, Inc.",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Program Files\\Packetbeat\\packetbeat.exe"
+                    },
+                    "malware": {
+                        "week_ms": 74
+                    },
+                    "process_events": {
+                        "week_ms": 432
+                    },
+                    "registry_events": {
+                        "week_ms": 1
+                    },
+                    "network_events": {
+                        "week_ms": 1
+                    },
+                    "overall": {
+                        "week_ms": 599
+                    },
+                    "library_load_events": {
+                        "week_ms": 61
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 30
+                    }
+                },
+                {
+                    "file_events": {
+                        "week_ms": 20
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Corporation",
+                                "exists": true,
+                                "status": "trusted"
+                            },
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Corporation",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"
+                    },
+                    "malware": {
+                        "week_ms": 350
+                    },
+                    "process_events": {
+                        "week_ms": 19
+                    },
+                    "registry_events": {
+                        "week_ms": 1
+                    },
+                    "overall": {
+                        "week_ms": 480
+                    },
+                    "library_load_events": {
+                        "week_ms": 70
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 20
+                    }
+                },
+                {
+                    "file_events": {
+                        "week_ms": 6
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Elasticsearch, Inc.",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\filebeat-8.3.0-SNAPSHOT-windows-x86_64\\filebeat.exe"
+                    },
+                    "process_events": {
+                        "week_ms": 395
+                    },
+                    "dns_events": {
+                        "week_ms": 51
+                    },
+                    "network_events": {
+                        "week_ms": 2
+                    },
+                    "overall": {
+                        "week_ms": 494
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 40
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Google LLC",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Program Files\\Google\\Compute Engine\\vss\\GoogleVssProvider.dll"
+                    },
+                    "malware": {
+                        "week_ms": 439
+                    },
+                    "overall": {
+                        "week_ms": 439
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Windows\\System32\\VSSVC.exe"
+                    },
+                    "malware": {
+                        "week_ms": 45
+                    },
+                    "process_events": {
+                        "week_ms": 13
+                    },
+                    "registry_events": {
+                        "week_ms": 124
+                    },
+                    "overall": {
+                        "week_ms": 476
+                    },
+                    "authentication_events": {
+                        "week_ms": 8
+                    },
+                    "library_load_events": {
+                        "week_ms": 216
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 70
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Windows\\SYSTEM32\\mispace.dll"
+                    },
+                    "malware": {
+                        "week_ms": 353
+                    },
+                    "overall": {
+                        "week_ms": 353
+                    }
+                },
+                {
+                    "process": {
+                        "code_signature": [
+                            {
+                                "exists": false
+                            }
+                        ],
+                        "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\b1cbeb46534d9974961496306f2f1a28\\System.Web.Extensions.ni.dll"
+                    },
+                    "malware": {
+                        "week_ms": 305
+                    },
+                    "overall": {
+                        "week_ms": 305
+                    }
+                },
+                {
+                    "file_events": {
+                        "week_ms": 25
+                    },
+                    "process": {
+                        "code_signature": [
+                            {
+                                "trusted": true,
+                                "subject_name": "Microsoft Windows",
+                                "exists": true,
+                                "status": "trusted"
+                            }
+                        ],
+                        "executable": "C:\\Windows\\System32\\wbem\\WMIADAP.exe"
+                    },
+                    "malware": {
+                        "week_ms": 247
+                    },
+                    "process_events": {
+                        "week_ms": 4
+                    },
+                    "registry_events": {
+                        "week_ms": 5
+                    },
+                    "overall": {
+                        "week_ms": 345
+                    },
+                    "library_load_events": {
+                        "week_ms": 14
+                    },
+                    "threat_intelligence_events": {
+                        "week_ms": 50
+                    }
+                }
+            ],
+            "memory": {
+                "endpoint": {
+                    "private": {
+                        "mean": 288590259,
+                        "latest": 493723648
+                    }
+                }
+            },
+            "disks": [
+                {
+                    "endpoint_drive": true,
+                    "total": 53564403712,
+                    "free": 25891106816,
+                    "device": "\\Device\\HarddiskVolume3",
+                    "mount": "C:\\",
+                    "fstype": "NTFS"
+                },
+                {
+                    "total": 100663296,
+                    "free": 73579520,
+                    "device": "\\Device\\HarddiskVolume2",
+                    "mount": "",
+                    "fstype": "FAT32"
+                }
+            ],
+            "documents_volume": {
+                "file_events": {
+                    "suppressed_count": 0,
+                    "suppressed_bytes": 0,
+                    "sent_count": 3485,
+                    "sent_bytes": 7302875
+                },
+                "security_events": {
+                    "suppressed_count": 0,
+                    "suppressed_bytes": 0,
+                    "sent_count": 259,
+                    "sent_bytes": 422247
+                },
+                "library_events": {
+                    "suppressed_count": 0,
+                    "suppressed_bytes": 0,
+                    "sent_count": 114,
+                    "sent_bytes": 287954
+                },
+                "process_events": {
+                    "suppressed_count": 0,
+                    "suppressed_bytes": 0,
+                    "sent_count": 201,
+                    "sent_bytes": 602914
+                },
+                "registry_events": {
+                    "suppressed_count": 0,
+                    "suppressed_bytes": 0,
+                    "sent_count": 605,
+                    "sent_bytes": 1288593
+                },
+                "dns_events": {
+                    "suppressed_count": 0,
+                    "suppressed_bytes": 0,
+                    "sent_count": 5250,
+                    "sent_bytes": 11364752
+                },
+                "network_events": {
+                    "suppressed_count": 0,
+                    "suppressed_bytes": 0,
+                    "sent_count": 1753,
+                    "sent_bytes": 3479631
+                },
+                "overall": {
+                    "suppressed_count": 0,
+                    "suppressed_bytes": 0,
+                    "sent_count": 11667,
+                    "sent_bytes": 24748966
+                }
+            },
+            "cpu": {
+                "endpoint": {
+                    "mean": 0.324235176435677,
+                    "latest": 62.6406111450215
+                }
+            },
+            "threads": [
+                {
+                    "name": "actionsAPIThread",
+                    "cpu": {
+                        "mean": 0.00456829602558246
+                    }
+                },
+                {
+                    "name": "stateReportThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "checkinAPIThread",
+                    "cpu": {
+                        "mean": 0.0365463682046597
+                    }
+                },
+                {
+                    "name": "KernelAsyncMessageQueueConsumerThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "Cron",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "File Cache",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "FileLogThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "LoggingLimitThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "CredentialAccessEventDispatcherThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelPortConsumerThread",
+                    "cpu": {
+                        "mean": 0.00456454263282819
+                    }
+                },
+                {
+                    "name": "KernelPortConsumerThread",
+                    "cpu": {
+                        "mean": 0.00456454263282819
+                    }
+                },
+                {
+                    "name": "RulesEngineThread",
+                    "cpu": {
+                        "mean": 0.0091324200913242
+                    }
+                },
+                {
+                    "name": "KernelPortConsumerThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelAsyncMessageQueueConsumerThread",
+                    "cpu": {
+                        "mean": 0.00456454263282819
+                    }
+                },
+                {
+                    "name": "KernelSyncQueueConsumerThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "DocumentLoggingThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "DocumentLoggingMaintenance",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "BulkConsumerThread",
+                    "cpu": {
+                        "mean": 0.00455871626549964
+                    }
+                },
+                {
+                    "name": "DocumentLoggingConsumerThread",
+                    "cpu": {
+                        "mean": 0.113967906637491
+                    }
+                },
+                {
+                    "name": "DocumentLoggingLimitThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.022822713164141
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.022822713164141
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelSyncMessageThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "ArtifactManifestDownload",
+                    "cpu": {
+                        "mean": 0.12311901504788
+                    }
+                },
+                {
+                    "name": "PolicyReloadThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "CredentialAccessClassifierThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "KernelPortConsumerThread",
+                    "cpu": {
+                        "mean": 0.0136936278984846
+                    }
+                },
+                {
+                    "name": "PerformanceMonitorWorkerThread",
+                    "cpu": {
+                        "mean": 0.00912200684150513
+                    }
+                },
+                {
+                    "name": "MetadataThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "EventsQueueThread",
+                    "cpu": {
+                        "mean": 0.0729760547320411
+                    }
+                },
+                {
+                    "name": "DelayedAlertEnrichment",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "MaintainProcessMap",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "FileScoreThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "DiagnosticMalwareThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "QuarantineManagerWorkerThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "EventProcessingThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "HostIsolationMonitorThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "serviceCommsThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "grpcConnectionManagerThread",
+                    "cpu": {
+                        "mean": 0.0
+                    }
+                },
+                {
+                    "name": "RansomwareGlobalUserThread"
+                },
+                {
+                    "name": "RansomwareProcessMonitorThread"
+                },
+                {
+                    "name": "RansomwareFileCacheCleanupThread"
+                },
+                {
+                    "name": "RansomwareParseUnverifiedThread"
+                },
+                {
+                    "name": "RansomwareLuaVerifiedThread"
+                }
+            ],
+            "uptime": {
+                "endpoint": 21930,
+                "system": 21992
+            }
+        }
+    },
+    "ecs": {
+        "version": "1.11.0"
+    },
+    "data_stream": {
+        "namespace": "default",
+        "type": "metrics",
+        "dataset": "endpoint.metrics"
+    },
+    "host": {
+        "hostname": "data-viz-win-1",
+        "os": {
+            "Ext": {
+                "variant": "Windows Server 2019 Datacenter"
+            },
+            "kernel": "1809 (10.0.17763.2686)",
+            "name": "Windows",
+            "family": "windows",
+            "type": "windows",
+            "version": "1809 (10.0.17763.2686)",
+            "platform": "windows",
+            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
+        },
+        "ip": [
+            "10.201.0.13",
+            "fe80::f40a:aed0:618a:972d",
+            "127.0.0.1",
+            "::1"
+        ],
+        "name": "data-viz-win-1",
+        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
+        "mac": [
+            "00-00-5E-00-53-23"
+        ],
+        "architecture": "x86_64"
+    },
+    "event": {
+        "agent_id_status": "verified",
+        "sequence": 35124,
+        "ingested": "2022-04-04T18:38:16Z",
+        "created": "2022-04-04T18:38:15.7178887Z",
+        "kind": "metric",
+        "module": "endpoint",
+        "action": "endpoint_metrics",
+        "id": "MYfZG00oEwD2/fqT+++++Byi",
+        "category": [
+            "host"
+        ],
+        "type": [
+            "info"
+        ],
+        "dataset": "endpoint.metrics"
+    }
+}
+```
+</details>
+
+### [Fields](metrics.md)
+- [@timestamp](metrics.md#@timestamp)
+- [message](metrics.md#message)
+- [Endpoint](metrics.md#Endpoint)
+- [agent](metrics.md#agent)
+- [data_stream](metrics.md#data_stream)
+- [ecs](metrics.md#ecs)
+- [event](metrics.md#event)
+- [host](metrics.md#host)
diff --git a/scripts/generate-docs/output/action_responses.md b/scripts/generate-docs/output/action_responses.md
index 450b600ca..773a9d851 100644
--- a/scripts/generate-docs/output/action_responses.md
+++ b/scripts/generate-docs/output/action_responses.md
@@ -1,26 +1,24 @@
 [Back to index](README.md)
 
-# action_responses
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `action_id`
+## `action_id`
 
-#### Description
+### Description
 The action id
-#### Example
+### Example
 
 ```json
 Needs example
@@ -28,11 +26,11 @@ Needs example
 ```
 <hr>
 
-### `agent_id`
+## `agent_id`
 
-#### Description
+### Description
 Alias field that maps to {agent: {id}}
-#### Example
+### Example
 
 ```json
 Needs example
@@ -40,11 +38,11 @@ Needs example
 ```
 <hr>
 
-### `completed_at`
+## `completed_at`
 
-#### Description
+### Description
 Request completion timestamp when the response is done executing. Usually matches with @timestamp.
-#### Example
+### Example
 
 ```json
 Needs example
@@ -52,11 +50,11 @@ Needs example
 ```
 <hr>
 
-### `data.alert_id`
+## `data.alert_id`
 
-#### Description
+### Description
 List of alert ids that triggered the action
-#### Example
+### Example
 
 ```json
 Needs example
@@ -64,11 +62,11 @@ Needs example
 ```
 <hr>
 
-### `data.command`
+## `data.command`
 
-#### Description
+### Description
 The action that is requested
-#### Example
+### Example
 
 ```json
 Needs example
@@ -76,11 +74,11 @@ Needs example
 ```
 <hr>
 
-### `data.comment`
+## `data.comment`
 
-#### Description
+### Description
 A comment that describes the action that is requested
-#### Example
+### Example
 
 ```json
 Needs example
@@ -88,11 +86,11 @@ Needs example
 ```
 <hr>
 
-### `started_at`
+## `started_at`
 
-#### Description
+### Description
 Timestamp of start of request
-#### Example
+### Example
 
 ```json
 Needs example
@@ -100,11 +98,11 @@ Needs example
 ```
 <hr>
 
-### `status`
+## `status`
 
-#### Description
+### Description
 The status of the request that distinguishes if the request is queued, running or completed.
-#### Example
+### Example
 
 ```json
 Needs example
@@ -112,11 +110,22 @@ Needs example
 ```
 <hr>
 
-### `EndpointActions`
+## `EndpointActions`
 
-#### Description
+### Description
 Fields to describe the endpoint  action requests and responses.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action_id` | The action id | None |
+| `completed_at` | Request completion timestamp when the response is done executing. Usually matches with @timestamp. | None |
+| `data` | The action request information | None |
+| `data.alert_id` | List of alert ids that triggered the action | None |
+| `data.command` | The action that is requested | isolate |
+| `data.comment` | A comment that describes the action that is requested | None |
+| `started_at` | Timestamp of start of request | None |
+| `status` | The status of the request that distinguishes if the request is queued, running or completed. | None |
+### Example
 
 ```json
 Needs example
@@ -124,12 +133,17 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+### Example
 
 ```json
 Needs example
@@ -137,11 +151,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -149,11 +169,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -161,12 +186,20 @@ Needs example
 ```
 <hr>
 
-### `error`
+## `error`
 
-#### Description
+### Description
 These fields can represent errors of any kind.
 Use them for errors that happen while fetching events or in cases where the event itself contains an error.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `code` | Error code describing the error. | None |
+| `id` | Unique identifier for the error. | None |
+| `message` | Error message. | None |
+| `stack_trace` | The stack trace of this error in plain text. | None |
+| `type` | The type of the error, for example the class name of the exception. | java.lang.NullPointerException |
+### Example
 
 ```json
 Needs example
@@ -174,12 +207,39 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `end` | `event.end` contains the date when the event ended or when the activity was last observed. | None |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `start` | `event.start` contains the date when the event started or when the activity was first observed. | None |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/actions.md b/scripts/generate-docs/output/actions.md
index 008a4838e..0ff390b22 100644
--- a/scripts/generate-docs/output/actions.md
+++ b/scripts/generate-docs/output/actions.md
@@ -1,26 +1,24 @@
 [Back to index](README.md)
 
-# actions
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `action_id`
+## `action_id`
 
-#### Description
+### Description
 The action id
-#### Example
+### Example
 
 ```json
 Needs example
@@ -28,11 +26,11 @@ Needs example
 ```
 <hr>
 
-### `agents`
+## `agents`
 
-#### Description
+### Description
 Alias field that maps to {agent: {id}}
-#### Example
+### Example
 
 ```json
 Needs example
@@ -40,11 +38,11 @@ Needs example
 ```
 <hr>
 
-### `data.alert_id`
+## `data.alert_id`
 
-#### Description
+### Description
 List of alert ids that triggered the action
-#### Example
+### Example
 
 ```json
 Needs example
@@ -52,11 +50,11 @@ Needs example
 ```
 <hr>
 
-### `data.command`
+## `data.command`
 
-#### Description
+### Description
 The action that is requested
-#### Example
+### Example
 
 ```json
 Needs example
@@ -64,11 +62,11 @@ Needs example
 ```
 <hr>
 
-### `data.comment`
+## `data.comment`
 
-#### Description
+### Description
 A comment that describes the action that is requested
-#### Example
+### Example
 
 ```json
 Needs example
@@ -76,11 +74,11 @@ Needs example
 ```
 <hr>
 
-### `expiration`
+## `expiration`
 
-#### Description
+### Description
 Request expiration timestamp
-#### Example
+### Example
 
 ```json
 Needs example
@@ -88,11 +86,11 @@ Needs example
 ```
 <hr>
 
-### `input_type`
+## `input_type`
 
-#### Description
+### Description
 The input type of the action, distinguishes endpoint actions as `endpoint`
-#### Example
+### Example
 
 ```json
 Needs example
@@ -100,11 +98,11 @@ Needs example
 ```
 <hr>
 
-### `type`
+## `type`
 
-#### Description
+### Description
 Distinguishes the type of input. Usually set to `INPUT_ACTION`
-#### Example
+### Example
 
 ```json
 Needs example
@@ -112,11 +110,11 @@ Needs example
 ```
 <hr>
 
-### `user_id`
+## `user_id`
 
-#### Description
+### Description
 The user id
-#### Example
+### Example
 
 ```json
 Needs example
@@ -124,11 +122,22 @@ Needs example
 ```
 <hr>
 
-### `EndpointActions`
+## `EndpointActions`
 
-#### Description
+### Description
 Fields to describe the endpoint  action requests and responses.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action_id` | The action id | None |
+| `data` | The action request information | None |
+| `data.alert_id` | List of alert ids that triggered the action | None |
+| `data.command` | The action that is requested | isolate |
+| `data.comment` | A comment that describes the action that is requested | None |
+| `expiration` | Request expiration timestamp | None |
+| `input_type` | The input type of the action, distinguishes endpoint actions as `endpoint` | None |
+| `type` | Distinguishes the type of input. Usually set to `INPUT_ACTION` | None |
+### Example
 
 ```json
 Needs example
@@ -136,12 +145,17 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+### Example
 
 ```json
 Needs example
@@ -149,11 +163,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -161,11 +181,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -173,12 +198,20 @@ Needs example
 ```
 <hr>
 
-### `error`
+## `error`
 
-#### Description
+### Description
 These fields can represent errors of any kind.
 Use them for errors that happen while fetching events or in cases where the event itself contains an error.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `code` | Error code describing the error. | None |
+| `id` | Unique identifier for the error. | None |
+| `message` | Error message. | None |
+| `stack_trace` | The stack trace of this error in plain text. | None |
+| `type` | The type of the error, for example the class name of the exception. | java.lang.NullPointerException |
+### Example
 
 ```json
 Needs example
@@ -186,12 +219,39 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `end` | `event.end` contains the date when the event ended or when the activity was last observed. | None |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `start` | `event.start` contains the date when the event started or when the activity was first observed. | None |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -199,12 +259,17 @@ Needs example
 ```
 <hr>
 
-### `rule`
+## `rule`
 
-#### Description
+### Description
 Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
 Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | 101 |
+| `name` | The name of the rule or signature generating the event. | BLOCK_DNS_over_TLS |
+### Example
 
 ```json
 Needs example
@@ -212,12 +277,16 @@ Needs example
 ```
 <hr>
 
-### `user`
+## `user`
 
-#### Description
+### Description
 The user fields describe information about the user that is relevant to the event.
 Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/alerts.md b/scripts/generate-docs/output/alerts.md
index bf7cba0bd..cc4b15e87 100644
--- a/scripts/generate-docs/output/alerts.md
+++ b/scripts/generate-docs/output/alerts.md
@@ -1,26 +1,24 @@
 [Back to index](README.md)
 
-# alerts
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `Events`
+## `Events`
 
-#### Description
+### Description
 events array
-#### Example
+### Example
 
 ```json
 Needs example
@@ -28,24 +26,47 @@ Needs example
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `Endpoint`
+## `Endpoint`
 
-#### Description
+### Description
 Fields describing the state of the Elastic Endpoint when an event occurs.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `policy` | The policy fields are used to hold information about applied policy. | None |
+| `policy.applied` | information about the policy that is applied | None |
+| `policy.applied.artifacts` | information about protection artifacts applied. | None |
+| `policy.applied.artifacts.global` | information about global protection artifacts applied. | None |
+| `policy.applied.artifacts.global.channel` | global artifacts rollout channel | None |
+| `policy.applied.artifacts.global.identifiers` | the identifiers of global artifacts applied. | None |
+| `policy.applied.artifacts.global.identifiers.name` | the name of global artifact applied. | None |
+| `policy.applied.artifacts.global.identifiers.sha256` | the sha256 of global artifacts applied. | None |
+| `policy.applied.artifacts.global.snapshot` | the snapshot date of applied global artifacts or 'latest' | None |
+| `policy.applied.artifacts.global.update_age` | number of days since global artifacts were made up-to-date | None |
+| `policy.applied.artifacts.global.version` | the version of global artifacts applied. | None |
+| `policy.applied.artifacts.user` | information about user protection artifacts applied. | None |
+| `policy.applied.artifacts.user.identifiers` | the identifiers of user artifacts applied. | None |
+| `policy.applied.artifacts.user.identifiers.name` | the name of user artifact applied. | None |
+| `policy.applied.artifacts.user.identifiers.sha256` | the sha256 of user artifacts applied. | None |
+| `policy.applied.artifacts.user.version` | the version of user artifacts applied. | None |
+| `policy.applied.id` | the id of the applied policy | None |
+| `policy.applied.name` | the name of this applied policy | None |
+| `policy.applied.status` | the status of the applied policy | None |
+| `policy.applied.version` | the version of this applied policy | None |
+### Example
 
 ```json
 Needs example
@@ -53,11 +74,21 @@ Needs example
 ```
 <hr>
 
-### `Memory_protection`
+## `Memory_protection`
 
-#### Description
+### Description
 These fields contain information specific to Memory Protection alerts.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `cross_session` | Is this process injecting across operating system sessions? | None |
+| `feature` | Memory Protection feature which triggered the alert. | shellcode_thread |
+| `parent_to_child` | Is this process injecting into its child? | None |
+| `self_injection` | Is this alert about a process injecting into itself? | None |
+| `thread_count` | The number of threads that this alert applies to. If several alerts occur in a short period of time, they can be combined into a single alert with thread_count > 1. | None |
+| `unique_key_v1` | A unique key created by hashing several characteristics of this alert. | None |
+| `unique_key_v2` | A unique key created by hashing several characteristics of this alert. | 00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67 |
+### Example
 
 ```json
 Needs example
@@ -65,11 +96,44 @@ Needs example
 ```
 <hr>
 
-### `Ransomware`
+## `Ransomware`
 
-#### Description
+### Description
 These fields contain information specific to ransomware alerts.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `child_processes.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `child_processes.feature` | Ransomware feature which triggered the alert. | None |
+| `child_processes.files` | Information about each file event attributed to the ransomware. Expected to be an array. | None |
+| `child_processes.files.data` | File header or MBR bytes. | None |
+| `child_processes.files.entropy` | Entropy of file contents. | None |
+| `child_processes.files.extension` | File extension, excluding the leading dot. | None |
+| `child_processes.files.metrics` | Suspicious ransomware behaviours associated with the file event. | None |
+| `child_processes.files.operation` | Operation applied to file. | None |
+| `child_processes.files.original.extension` | Original file extension prior to the file event. | None |
+| `child_processes.files.original.path` | Original file path prior to the file event. | None |
+| `child_processes.files.path` | Full path to the file, including the file name. | None |
+| `child_processes.files.score` | Ransomware score for this particular file event. | None |
+| `child_processes.pid` | Process id. | 4242 |
+| `child_processes.score` | Total ransomware score for aggregated file events. | None |
+| `child_processes.version` | Ransomware artifact version. | None |
+| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `feature` | Ransomware feature which triggered the alert. | None |
+| `files` | Information about each file event attributed to the ransomware. Expected to be an array. | None |
+| `files.data` | File header or MBR bytes. | None |
+| `files.entropy` | Entropy of file contents. | None |
+| `files.extension` | File extension, excluding the leading dot. | None |
+| `files.metrics` | Suspicious ransomware behaviours associated with the file event. | None |
+| `files.operation` | Operation applied to file. | None |
+| `files.original.extension` | Original file extension prior to the file event. | None |
+| `files.original.path` | Original file path prior to the file event. | None |
+| `files.path` | Full path to the file, including the file name. | None |
+| `files.score` | Ransomware score for this particular file event. | None |
+| `pid` | Process id. | 4242 |
+| `score` | Total ransomware score for aggregated file events. | None |
+| `version` | Ransomware artifact version. | None |
+### Example
 
 ```json
 Needs example
@@ -77,11 +141,39 @@ Needs example
 ```
 <hr>
 
-### `Responses`
+## `Responses`
 
-#### Description
+### Description
 responses array contains rule response action results
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `@timestamp` | Timestamp in which action was taken | None |
+| `action` | Dictionary representing requested response action | None |
+| `action.action` | Response action name | None |
+| `action.field` | Field in the triggering event to use as input for action | None |
+| `action.file.attributes` | Destination file attributes | None |
+| `action.file.path` | Destination file path | None |
+| `action.file.reason` | Combined USN file modification reason | None |
+| `action.key.actions` | Actions taken by Registry Rollback for key | None |
+| `action.key.path` | NT path of registry key recovered by Rollback | None |
+| `action.key.values` | Values modified | None |
+| `action.key.values.actions` | Actions taken by Registry Rollback for value | None |
+| `action.key.values.name` | Value name recovered by Rollback | None |
+| `action.process.message` | Status message for Process Rollback | None |
+| `action.process.path` | Path of process killed by Process Rollback | None |
+| `action.process.result` | Result code for Process Rollback | None |
+| `action.source.attributes` | Source file attributes | None |
+| `action.source.path` | Source file path | None |
+| `action.state` | Index of event in events array to use for field lookup | None |
+| `action.tree` | Indicates whether or not an action was taken against an entire process tree | None |
+| `message` | Result message | None |
+| `process` | Dictionary representing process information | None |
+| `process.entity_id` | Entity id of actionable process | None |
+| `process.name` | Name of actionable process | None |
+| `process.pid` | pid of actionable process | None |
+| `result` | Response action result code | None |
+### Example
 
 ```json
 Needs example
@@ -89,12 +181,404 @@ Needs example
 ```
 <hr>
 
-### `Target`
+## `Target`
 
-#### Description
+### Description
 These fields contain information about a target.
 These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dll.Ext` | Object for all custom defined fields to live in. | None |
+| `dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `dll.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
+| `dll.Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
+| `dll.Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
+| `dll.Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
+| `dll.Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
+| `dll.Ext.malware_classification.identifier` | The model's unique identifier. | None |
+| `dll.Ext.malware_classification.score` | The score produced by the classification model. | None |
+| `dll.Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
+| `dll.Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
+| `dll.Ext.malware_classification.version` | The version of the model used. | None |
+| `dll.Ext.mapped_address` | The base address where this module is loaded. | None |
+| `dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
+| `dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `dll.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `dll.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `dll.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `dll.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `dll.hash.md5` | MD5 hash. | None |
+| `dll.hash.sha1` | SHA1 hash. | None |
+| `dll.hash.sha256` | SHA256 hash. | None |
+| `dll.hash.sha512` | SHA512 hash. | None |
+| `dll.name` | Name of the library.
+This generally maps to the name of the file on disk. | kernel32.dll |
+| `dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
+| `dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `process.Ext` | Object for all custom defined fields to live in. | None |
+| `process.Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
+| `process.Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
+| `process.Ext.authentication_id` | Process authentication ID | None |
+| `process.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `process.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `process.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `process.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `process.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `process.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `process.Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
+| `process.Ext.dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `process.Ext.dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `process.Ext.dll.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `process.Ext.dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `process.Ext.dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `process.Ext.dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `process.Ext.dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
+| `process.Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
+| `process.Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
+| `process.Ext.dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `process.Ext.dll.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `process.Ext.dll.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `process.Ext.dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `process.Ext.dll.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `process.Ext.dll.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `process.Ext.dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `process.Ext.dll.hash.md5` | MD5 hash. | None |
+| `process.Ext.dll.hash.sha1` | SHA1 hash. | None |
+| `process.Ext.dll.hash.sha256` | SHA256 hash. | None |
+| `process.Ext.dll.hash.sha512` | SHA512 hash. | None |
+| `process.Ext.dll.name` | Name of the library.
+This generally maps to the name of the file on disk. | kernel32.dll |
+| `process.Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
+| `process.Ext.dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `process.Ext.dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `process.Ext.dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `process.Ext.dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `process.Ext.dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `process.Ext.dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `process.Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
+| `process.Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
+| `process.Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
+| `process.Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
+| `process.Ext.malware_classification.identifier` | The model's unique identifier. | None |
+| `process.Ext.malware_classification.score` | The score produced by the classification model. | None |
+| `process.Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
+| `process.Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
+| `process.Ext.malware_classification.version` | The version of the model used. | None |
+| `process.Ext.memory_region.allocation_base` | Base address of the memory allocation containing the memory region. | 2431737462784 |
+| `process.Ext.memory_region.allocation_protection` | Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X". | RWX |
+| `process.Ext.memory_region.allocation_size` | Original memory size requested when the memory was allocated. | 4096 |
+| `process.Ext.memory_region.allocation_type` | The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE". | PRIVATE |
+| `process.Ext.memory_region.bytes_address` | The address where bytes_compressed begins. | 2431737462784 |
+| `process.Ext.memory_region.bytes_allocation_offset` | Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base. | 0 |
+| `process.Ext.memory_region.bytes_compressed` | Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | eJzzSM3JyVcIzy/KSVEEABxJBD4= |
+| `process.Ext.memory_region.bytes_compressed_present` | Whether bytes_compressed is present in this event. | False |
+| `process.Ext.memory_region.malware_signature.all_names` | A sequence of signature names matched. | Windows.EICAR.Not-a-virus |
+| `process.Ext.memory_region.malware_signature.identifier` | malware signature identifier | None |
+| `process.Ext.memory_region.malware_signature.primary` | The first matching details. | None |
+| `process.Ext.memory_region.malware_signature.primary.matches` | The first matching details. | None |
+| `process.Ext.memory_region.malware_signature.primary.signature.hash` | hash of file matching signature. | None |
+| `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256` | sha256 hash of file matching signature. | None |
+| `process.Ext.memory_region.malware_signature.primary.signature.id` | The id of the first yara rule matched. | None |
+| `process.Ext.memory_region.malware_signature.primary.signature.name` | The name of the first yara rule matched. | None |
+| `process.Ext.memory_region.malware_signature.version` | malware signature version | None |
+| `process.Ext.memory_region.mapped_path` | If the memory corresponds to a file mapping, this is the file's path. | C:\Windows\System32\mshtml.dll |
+| `process.Ext.memory_region.mapped_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `process.Ext.memory_region.mapped_pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `process.Ext.memory_region.mapped_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `process.Ext.memory_region.mapped_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `process.Ext.memory_region.mapped_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `process.Ext.memory_region.mapped_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `process.Ext.memory_region.mapped_pe_detected` | Whether the file at mapped_path is an executable. | False |
+| `process.Ext.memory_region.memory_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `process.Ext.memory_region.memory_pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `process.Ext.memory_region.memory_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `process.Ext.memory_region.memory_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `process.Ext.memory_region.memory_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `process.Ext.memory_region.memory_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `process.Ext.memory_region.memory_pe_detected` | Whether an executable file was found in memory. | False |
+| `process.Ext.memory_region.region_base` | Base address of the memory region. | 2431737462784 |
+| `process.Ext.memory_region.region_protection` | Memory protection of the memory region. Example values include "RWX" and "R-X". | RWX |
+| `process.Ext.memory_region.region_size` | Size of the memory region. | 4096 |
+| `process.Ext.memory_region.region_start_bytes` | First 64 bytes at the region base address. | 4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000 |
+| `process.Ext.memory_region.region_state` | State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE". | COMMIT |
+| `process.Ext.memory_region.strings` | Array of strings found within the memory region. | None |
+| `process.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
+| `process.Ext.services` | Services running in this process. | None |
+| `process.Ext.session` | Session information for the current process | None |
+| `process.Ext.token.domain` | Domain of token user. | None |
+| `process.Ext.token.elevation` | Whether the token is elevated or not | None |
+| `process.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
+| `process.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
+| `process.Ext.token.integrity_level` | Numeric integrity level. | None |
+| `process.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
+| `process.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
+| `process.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
+| `process.Ext.token.privileges.description` | Description of the privilege. | None |
+| `process.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
+| `process.Ext.token.privileges.name` | Name of the privilege. | None |
+| `process.Ext.token.sid` | Token user's Security Identifier (SID). | None |
+| `process.Ext.token.type` | Type of the token, either primary or impersonation. | None |
+| `process.Ext.token.user` | Username of token owner. | None |
+| `process.Ext.user` | User associated with the running process. | None |
+| `process.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `process.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `process.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `process.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `process.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `process.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `process.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `process.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `process.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `process.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `process.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `process.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `process.exit_code` | The exit code of the process, if this is a termination event.
+The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
+| `process.hash.md5` | MD5 hash. | None |
+| `process.hash.sha1` | SHA1 hash. | None |
+| `process.hash.sha256` | SHA256 hash. | None |
+| `process.hash.sha512` | SHA512 hash. | None |
+| `process.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `process.parent.Ext` | Object for all custom defined fields to live in. | None |
+| `process.parent.Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
+| `process.parent.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `process.parent.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `process.parent.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `process.parent.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `process.parent.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `process.parent.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `process.parent.Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
+| `process.parent.Ext.dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `process.parent.Ext.dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `process.parent.Ext.dll.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `process.parent.Ext.dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `process.parent.Ext.dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `process.parent.Ext.dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `process.parent.Ext.dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
+| `process.parent.Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
+| `process.parent.Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
+| `process.parent.Ext.dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `process.parent.Ext.dll.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `process.parent.Ext.dll.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `process.parent.Ext.dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `process.parent.Ext.dll.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `process.parent.Ext.dll.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `process.parent.Ext.dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `process.parent.Ext.dll.hash.md5` | MD5 hash. | None |
+| `process.parent.Ext.dll.hash.sha1` | SHA1 hash. | None |
+| `process.parent.Ext.dll.hash.sha256` | SHA256 hash. | None |
+| `process.parent.Ext.dll.hash.sha512` | SHA512 hash. | None |
+| `process.parent.Ext.dll.name` | Name of the library.
+This generally maps to the name of the file on disk. | kernel32.dll |
+| `process.parent.Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
+| `process.parent.Ext.dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `process.parent.Ext.dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `process.parent.Ext.dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `process.parent.Ext.dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `process.parent.Ext.dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `process.parent.Ext.dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `process.parent.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
+| `process.parent.Ext.real` | The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent. | None |
+| `process.parent.Ext.real.pid` | For process.parent this will be the ppid of the process that actually spawned the current process. | None |
+| `process.parent.Ext.token.domain` | Domain of token user. | None |
+| `process.parent.Ext.token.elevation` | Whether the token is elevated or not | None |
+| `process.parent.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
+| `process.parent.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
+| `process.parent.Ext.token.integrity_level` | Numeric integrity level. | None |
+| `process.parent.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
+| `process.parent.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
+| `process.parent.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
+| `process.parent.Ext.token.privileges.description` | Description of the privilege. | None |
+| `process.parent.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
+| `process.parent.Ext.token.privileges.name` | Name of the privilege. | None |
+| `process.parent.Ext.token.sid` | Token user's Security Identifier (SID). | None |
+| `process.parent.Ext.token.type` | Type of the token, either primary or impersonation. | None |
+| `process.parent.Ext.token.user` | Username of token owner. | None |
+| `process.parent.Ext.user` | User associated with the running process. | None |
+| `process.parent.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `process.parent.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `process.parent.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `process.parent.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `process.parent.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `process.parent.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `process.parent.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `process.parent.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `process.parent.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `process.parent.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `process.parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `process.parent.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `process.parent.exit_code` | The exit code of the process, if this is a termination event.
+The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
+| `process.parent.hash.md5` | MD5 hash. | None |
+| `process.parent.hash.sha1` | SHA1 hash. | None |
+| `process.parent.hash.sha256` | SHA256 hash. | None |
+| `process.parent.hash.sha512` | SHA512 hash. | None |
+| `process.parent.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `process.parent.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `process.parent.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `process.parent.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `process.parent.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `process.parent.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `process.parent.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `process.parent.pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
+Identifier of the group of processes the process belongs to. | None |
+| `process.parent.pid` | Process id. | 4242 |
+| `process.parent.ppid` | Parent process' pid. | 4241 |
+| `process.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `process.parent.thread.id` | Thread ID. | 4242 |
+| `process.parent.thread.name` | Thread name. | thread-0 |
+| `process.parent.title` | Process title.
+The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
+| `process.parent.uptime` | Seconds the process has been up. | 1325 |
+| `process.parent.working_directory` | The working directory of the process. | /home/alice |
+| `process.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `process.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `process.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `process.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `process.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `process.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `process.pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
+Identifier of the group of processes the process belongs to. | None |
+| `process.pid` | Process id. | 4242 |
+| `process.ppid` | Parent process' pid. | 4241 |
+| `process.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `process.thread.Ext` | Object for all custom defined fields to live in. | None |
+| `process.thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
+| `process.thread.Ext.call_stack.instruction_pointer` | The return address of this stack frame. | None |
+| `process.thread.Ext.call_stack.memory_section.memory_address` | Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress` | None |
+| `process.thread.Ext.call_stack.memory_section.memory_size` | Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize` | None |
+| `process.thread.Ext.call_stack.memory_section.protection` | Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | None |
+| `process.thread.Ext.call_stack.module_name` | The name of the DLL/module containing `instruction_pointer`. | None |
+| `process.thread.Ext.call_stack.module_path` | The path to the DLL/module containing `instruction_pointer`. | None |
+| `process.thread.Ext.call_stack.rva` | The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`. | None |
+| `process.thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
+| `process.thread.Ext.call_stack_final_user_module` | The final non-win32 module in the call stack. | None |
+| `process.thread.Ext.call_stack_final_user_module.code_signature` | Code signature of the call_stack_final_user_module. | None |
+| `process.thread.Ext.call_stack_final_user_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `process.thread.Ext.call_stack_final_user_module.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `process.thread.Ext.call_stack_final_user_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `process.thread.Ext.call_stack_final_user_module.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `process.thread.Ext.call_stack_final_user_module.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `process.thread.Ext.call_stack_final_user_module.hash` | Hashes of the call_stack_final_user_module. | None |
+| `process.thread.Ext.call_stack_final_user_module.hash.sha256` | The sha256 of the call_stack_final_user_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
+| `process.thread.Ext.call_stack_final_user_module.name` | The file name of the call_stack_final_user_module. | example.dll |
+| `process.thread.Ext.call_stack_final_user_module.path` | The file path of the call_stack_final_user_module. | C:\Program Files\Example\example.dll |
+| `process.thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
+| `process.thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
+| `process.thread.Ext.original_start_address` | When a trampoline was detected, this indicates the original content for the thread start address in memory. | 4194304 |
+| `process.thread.Ext.original_start_address_allocation_offset` | When a trampoline was detected, this indicates the offset of original_start_address from the allocation base. | 0 |
+| `process.thread.Ext.original_start_address_bytes` | When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address. | 48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc |
+| `process.thread.Ext.original_start_address_bytes_disasm` | When a trampoline was detected, this holds the disassembled code at the original thread start address. | mov rax, 0x4141414141414141\njmp rax |
+| `process.thread.Ext.original_start_address_bytes_disasm_hash` | When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed. | aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c |
+| `process.thread.Ext.original_start_address_module` | When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution. | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe |
+| `process.thread.Ext.parameter` | When a thread is created, this is the raw numerical value of its parameter. | None |
+| `process.thread.Ext.parameter_bytes_compressed` | Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | None |
+| `process.thread.Ext.parameter_bytes_compressed_present` | Whether parameter_bytes_compressed is present in this event. | None |
+| `process.thread.Ext.service` | Service associated with the thread. | VaultSvc |
+| `process.thread.Ext.start` | The time the thread started. | 2016-05-23T08:05:34.853Z |
+| `process.thread.Ext.start_address` | Memory address where the thread began execution. | 4194304 |
+| `process.thread.Ext.start_address_allocation_offset` | Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base. | 0 |
+| `process.thread.Ext.start_address_bytes` | A few (typically 32) raw opcode bytes at the thread start address, hex-encoded. | c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc |
+| `process.thread.Ext.start_address_bytes_disasm` | The bytes at the thread start address, disassembled into human-readable assembly code. | ret\nint3 |
+| `process.thread.Ext.start_address_bytes_disasm_hash` | The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed. | aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c |
+| `process.thread.Ext.start_address_module` | The dll/module where the thread began execution. | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe |
+| `process.thread.Ext.token.domain` | Domain of token user. | None |
+| `process.thread.Ext.token.elevation` | Whether the token is elevated or not | None |
+| `process.thread.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
+| `process.thread.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
+| `process.thread.Ext.token.integrity_level` | Numeric integrity level. | None |
+| `process.thread.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
+| `process.thread.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
+| `process.thread.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
+| `process.thread.Ext.token.privileges.description` | Description of the privilege. | None |
+| `process.thread.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
+| `process.thread.Ext.token.privileges.name` | Name of the privilege. | None |
+| `process.thread.Ext.token.sid` | Token user's Security Identifier (SID). | None |
+| `process.thread.Ext.token.type` | Type of the token, either primary or impersonation. | None |
+| `process.thread.Ext.token.user` | Username of token owner. | None |
+| `process.thread.Ext.uptime` | Seconds since thread started. | None |
+| `process.thread.id` | Thread ID. | 4242 |
+| `process.thread.name` | Thread name. | thread-0 |
+| `process.title` | Process title.
+The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
+| `process.uptime` | Seconds the process has been up. | 1325 |
+| `process.working_directory` | The working directory of the process. | /home/alice |
+### Example
 
 ```json
 Needs example
@@ -102,12 +586,24 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `ephemeral_id` | Ephemeral identifier of this agent (if one exists).
+This id normally changes across restarts, but `agent.id` does not. | 8a4f500f |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `name` | Custom name of the agent.
+This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | foo |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -115,11 +611,21 @@ Needs example
 ```
 <hr>
 
-### `cloud`
+## `cloud`
 
-#### Description
+### Description
 Fields related to the cloud or infrastructure the events are coming from.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `account.id` | The cloud account or organization id used to identify different entities in a multi-tenant environment.
+Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | 666777888999 |
+| `instance.name` | Instance name of the host machine. | None |
+| `project.id` | The cloud project identifier.
+Examples: Google Cloud Project id, Azure Project id. | my-project |
+| `provider` | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | aws |
+| `region` | Region in which this host, resource, or service is located. | us-east-1 |
+### Example
 
 ```json
 Needs example
@@ -127,12 +633,19 @@ Needs example
 ```
 <hr>
 
-### `container`
+## `container`
 
-#### Description
+### Description
 Container fields are used for meta information about the specific container that is the source of information.
 These fields help correlate data based containers from any runtime.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique container id. | None |
+| `image.name` | Name of the image the container was built on. | None |
+| `image.tag` | Container image tags. | None |
+| `name` | Container name. | None |
+### Example
 
 ```json
 Needs example
@@ -140,11 +653,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -152,12 +671,30 @@ Needs example
 ```
 <hr>
 
-### `destination`
+## `destination`
 
-#### Description
+### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+| `ip` | IP address of the destination (IPv4 or IPv6). | None |
+### Example
 
 ```json
 Needs example
@@ -165,16 +702,67 @@ Needs example
 ```
 <hr>
 
-### `dll`
+## `dll`
 
-#### Description
+### Description
 These fields contain information about code libraries dynamically loaded into processes.
 
 Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
 * Dynamic-link library (`.dll`) commonly used on Windows
 * Shared Object (`.so`) commonly used on Unix-like operating systems
 * Dynamic library (`.dylib`) commonly used on macOS
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `Ext.compile_time` | Timestamp from when the module was compiled. | None |
+| `Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
+| `Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
+| `Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
+| `Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
+| `Ext.malware_classification.identifier` | The model's unique identifier. | None |
+| `Ext.malware_classification.score` | The score produced by the classification model. | None |
+| `Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
+| `Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
+| `Ext.malware_classification.version` | The version of the model used. | None |
+| `Ext.mapped_address` | The base address where this module is loaded. | None |
+| `Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `hash.md5` | MD5 hash. | None |
+| `hash.sha1` | SHA1 hash. | None |
+| `hash.sha256` | SHA256 hash. | None |
+| `hash.sha512` | SHA512 hash. | None |
+| `name` | Name of the library.
+This generally maps to the name of the file on disk. | kernel32.dll |
+| `path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
+| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+### Example
 
 ```json
 Needs example
@@ -182,12 +770,18 @@ Needs example
 ```
 <hr>
 
-### `dns`
+## `dns`
 
-#### Description
+### Description
 Fields describing DNS queries and answers.
 DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `question.name` | The name being queried.
+If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | www.example.com |
+| `question.type` | The type of record being queried. | AAAA |
+### Example
 
 ```json
 Needs example
@@ -195,11 +789,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -207,11 +806,16 @@ Needs example
 ```
 <hr>
 
-### `elastic`
+## `elastic`
 
-#### Description
+### Description
 Holds fields and properties of data points and concepts in the elastic domain or namespace.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `agent` | The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host. | None |
+| `agent.id` | Unique identifier of this elastic agent (if one exists). | c2a9093e-e289-4c0a-aa44-8c32a414fa7a |
+### Example
 
 ```json
 Needs example
@@ -219,12 +823,55 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `risk_score` | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | None |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -232,12 +879,132 @@ Needs example
 ```
 <hr>
 
-### `file`
+## `file`
 
-#### Description
+### Description
 A file is defined as a set of information that has been created on, or has existed on a filesystem.
 File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `Ext.entry_modified` | Time of last status change.  See `st_ctim` member of `struct stat`. | None |
+| `Ext.macro.code_page` | Identifies the character encoding used for this macro.  https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers | None |
+| `Ext.macro.collection` | Object containing hashes for the macro collection. | None |
+| `Ext.macro.collection.hash.md5` | MD5 hash. | None |
+| `Ext.macro.collection.hash.sha1` | SHA1 hash. | None |
+| `Ext.macro.collection.hash.sha256` | SHA256 hash. | None |
+| `Ext.macro.collection.hash.sha512` | SHA512 hash. | None |
+| `Ext.macro.errors` | Errors that occurred when parsing this document file. | None |
+| `Ext.macro.errors.count` | Number of times this error that occurred. | None |
+| `Ext.macro.errors.error_type` | The type of parsing error that occurred. | None |
+| `Ext.macro.file_extension` | The extension of the file containing this macro (e.g. .docm) | None |
+| `Ext.macro.project_file` | Metadata about the corresponding VBA project file | None |
+| `Ext.macro.project_file.hash.md5` | MD5 hash. | None |
+| `Ext.macro.project_file.hash.sha1` | SHA1 hash. | None |
+| `Ext.macro.project_file.hash.sha256` | SHA256 hash. | None |
+| `Ext.macro.project_file.hash.sha512` | SHA512 hash. | None |
+| `Ext.macro.stream` | Streams associated with the document. | None |
+| `Ext.macro.stream.hash.md5` | MD5 hash. | None |
+| `Ext.macro.stream.hash.sha1` | SHA1 hash. | None |
+| `Ext.macro.stream.hash.sha256` | SHA256 hash. | None |
+| `Ext.macro.stream.hash.sha512` | SHA512 hash. | None |
+| `Ext.macro.stream.name` | Name of the stream. | None |
+| `Ext.macro.stream.raw_code` | First 100KB of raw stream binary.  Can be useful to analyze false positives and malicious payloads. | None |
+| `Ext.macro.stream.raw_code_size` | The original stream size.  Indicates whether stream.raw_code was truncated. | None |
+| `Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
+| `Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
+| `Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
+| `Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
+| `Ext.malware_classification.identifier` | The model's unique identifier. | None |
+| `Ext.malware_classification.score` | The score produced by the classification model. | None |
+| `Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
+| `Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
+| `Ext.malware_classification.version` | The version of the model used. | None |
+| `Ext.original` | Original file information during a modification event. | None |
+| `Ext.original.gid` | Primary group ID (GID) of the file. | 1001 |
+| `Ext.original.group` | Primary group name of the file. | alice |
+| `Ext.original.mode` | Original file mode prior to a modification event | None |
+| `Ext.original.name` | Original file name prior to a modification event | None |
+| `Ext.original.owner` | File owner's username. | alice |
+| `Ext.original.path` | Original file path prior to a modification event | None |
+| `Ext.original.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
+| `Ext.quarantine_message` | Message describing quarantine results. | None |
+| `Ext.quarantine_path` | Path on endpoint the quarantined file was originally. | None |
+| `Ext.quarantine_result` | Boolean representing whether or not file quarantine succeeded. | None |
+| `Ext.temp_file_path` | Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable. | None |
+| `Ext.windows` | Platform-specific Windows fields | None |
+| `Ext.windows.zone_identifier` | Windows zone identifier for a file | None |
+| `accessed` | Last time the file was accessed.
+Note that not all filesystems keep track of access time. | None |
+| `attributes` | Array of file attributes.
+Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | ["readonly", "system"] |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `created` | File creation time.
+Note that not all filesystems store the creation time. | None |
+| `ctime` | Last time the file attributes or metadata changed.
+Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | None |
+| `device` | Device that is the source of the file. | sda |
+| `directory` | Directory where the file is located. It should include the drive letter, when appropriate. | /home/alice |
+| `drive_letter` | Drive letter where the file is located. This field is only relevant on Windows.
+The value should be uppercase, and not include the colon. | C |
+| `extension` | File extension, excluding the leading dot.
+Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
+| `gid` | Primary group ID (GID) of the file. | 1001 |
+| `group` | Primary group name of the file. | alice |
+| `hash.md5` | MD5 hash. | None |
+| `hash.sha1` | SHA1 hash. | None |
+| `hash.sha256` | SHA256 hash. | None |
+| `hash.sha512` | SHA512 hash. | None |
+| `inode` | Inode representing the file in the filesystem. | 256383 |
+| `mime_type` | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | None |
+| `mode` | Mode of the file in octal representation. | 0640 |
+| `mtime` | Last time the file content was modified. | None |
+| `name` | Name of the file including the extension, without the directory. | example.png |
+| `owner` | File owner's username. | alice |
+| `path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
+| `pe.Ext.dotnet` | Whether this file is a .NET PE | true |
+| `pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
+| `pe.Ext.sections.hash.md5` | MD5 hash. | None |
+| `pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
+| `pe.Ext.sections.name` | The section's name | .reloc |
+| `pe.Ext.streams` | The file's streams, if it is a PE | None |
+| `pe.Ext.streams.hash.md5` | MD5 hash. | None |
+| `pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
+| `pe.Ext.streams.name` | The stream's name | .reloc |
+| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `size` | File size in bytes.
+Only relevant when `file.type` is "file". | 16384 |
+| `target_path` | Target path for symlinks. | None |
+| `type` | File type (file, dir, or symlink). | file |
+| `uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
+### Example
 
 ```json
 Needs example
@@ -245,11 +1012,21 @@ Needs example
 ```
 <hr>
 
-### `group`
+## `group`
 
-#### Description
+### Description
 The group fields are meant to represent groups that are relevant to the event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | Group info prior to any setgid operations. | None |
+| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `Ext.real.name` | Name of the group. | None |
+| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `id` | Unique identifier for the group on the system/platform. | None |
+| `name` | Name of the group. | None |
+### Example
 
 ```json
 Needs example
@@ -257,12 +1034,76 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `boot.id` | Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container. | 88a1f0ed-5ae5-41ee-af6b-41921c311872 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `pid_ns_ino` | This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. | 256383 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+| `user.Ext` | Object for all custom defined fields to live in. | None |
+| `user.Ext.real` | User info prior to any setuid operations. | None |
+| `user.Ext.real.id` | One or multiple unique identifiers of the user. | None |
+| `user.Ext.real.name` | Short name or login of the user. | None |
+| `user.domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `user.email` | User email address. | None |
+| `user.full_name` | User's full name, if available. | Albert Einstein |
+| `user.group.Ext` | Object for all custom defined fields to live in. | None |
+| `user.group.Ext.real` | Group info prior to any setgid operations. | None |
+| `user.group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `user.group.Ext.real.name` | Name of the group. | None |
+| `user.group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `user.group.id` | Unique identifier for the group on the system/platform. | None |
+| `user.group.name` | Name of the group. | None |
+| `user.hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `user.name` | Short name or login of the user. | a.einstein |
+### Example
 
 ```json
 Needs example
@@ -270,11 +1111,18 @@ Needs example
 ```
 <hr>
 
-### `orchestrator`
+## `orchestrator`
 
-#### Description
+### Description
 Fields that describe the resources which container orchestrators manage or act upon.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `cluster.name` | Name of the cluster. | None |
+| `namespace` | Namespace in which the action is taking place. | kube-system |
+| `resource.name` | Name of the resource being acted upon. | test-pod-cdcws |
+| `resource.type` | Type of resource being acted upon. | service |
+### Example
 
 ```json
 Needs example
@@ -282,12 +1130,592 @@ Needs example
 ```
 <hr>
 
-### `process`
+## `process`
 
-#### Description
+### Description
 These fields contain information about a process.
 These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
+| `Ext.api.behaviors` | A list of observed behaviors.
+  "cross-process" - the observed activity was between two processes
+  "parent-child" - the observed activity was between a parent process and its child
+  "native_api" - a call was made directly to the Native API rather than the Win32 API
+  "direct_syscall" - a syscall instruction originated outside of the Native API layer
+  "proxy_call" - the call stack may indicate of a proxied API call to mask the true source
+  "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API
+  "shellcode" - suspicious executable non-image memory is calling a sensitive API
+  "image_hooked" - an entry in the callstack appears to have been hooked
+  "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function
+  "image_rop" - no call instruction preceded an entry in the call stack
+  "image_rwx" - an entry in the callstack is writable
+  "unbacked_rwx" - an entry in the callstack is non-image and writable
+  "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load
+  "allocate_shellcode" - a region of non-image executable memory allocated more executable memory
+  "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating
+  "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating
+  "hook_api" - a change to the memory protection of a small executable image memory region was made
+  "hollow_image" - a change to the memory protection of a large executable image memory region was made
+  "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made
+  "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made
+  "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD
+  "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS
+  "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control
+  "hardware_breakpoint_set" - a hardware breakpoint was set
+  "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed
+  "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed
+  "pid_spoofing" - The acting process details may have been spoofed to hide the true origin
+  "legacy_api" - a deprecated or superseded API was called | [ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ] |
+| `Ext.api.name` | The name of the API, usually the name of the function or system call. | VirtualAlloc |
+| `Ext.api.summary` | The summary of the API call and its parameters. | VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX ) |
+| `Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
+| `Ext.authentication_id` | Process authentication ID | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `Ext.created_suspended` | A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls. | true |
+| `Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.dll.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `Ext.dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
+| `Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
+| `Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
+| `Ext.dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.dll.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `Ext.dll.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.dll.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `Ext.dll.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `Ext.dll.hash.md5` | MD5 hash. | None |
+| `Ext.dll.hash.sha1` | SHA1 hash. | None |
+| `Ext.dll.hash.sha256` | SHA256 hash. | None |
+| `Ext.dll.hash.sha512` | SHA512 hash. | None |
+| `Ext.dll.name` | Name of the library.
+This generally maps to the name of the file on disk. | kernel32.dll |
+| `Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
+| `Ext.dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `Ext.dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `Ext.dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `Ext.dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `Ext.dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `Ext.dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
+| `Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
+| `Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
+| `Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
+| `Ext.malware_classification.identifier` | The model's unique identifier. | None |
+| `Ext.malware_classification.score` | The score produced by the classification model. | None |
+| `Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
+| `Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
+| `Ext.malware_classification.version` | The version of the model used. | None |
+| `Ext.memory_region.allocation_base` | Base address of the memory allocation containing the memory region. | 2431737462784 |
+| `Ext.memory_region.allocation_protection` | Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X". | RWX |
+| `Ext.memory_region.allocation_size` | Original memory size requested when the memory was allocated. | 4096 |
+| `Ext.memory_region.allocation_type` | The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE". | PRIVATE |
+| `Ext.memory_region.bytes_address` | The address where bytes_compressed begins. | 2431737462784 |
+| `Ext.memory_region.bytes_allocation_offset` | Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base. | 0 |
+| `Ext.memory_region.bytes_compressed` | Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | eJzzSM3JyVcIzy/KSVEEABxJBD4= |
+| `Ext.memory_region.bytes_compressed_present` | Whether bytes_compressed is present in this event. | False |
+| `Ext.memory_region.malware_signature.all_names` | A sequence of signature names matched. | Windows.EICAR.Not-a-virus |
+| `Ext.memory_region.malware_signature.identifier` | malware signature identifier | None |
+| `Ext.memory_region.malware_signature.primary` | The first matching details. | None |
+| `Ext.memory_region.malware_signature.primary.matches` | The first matching details. | None |
+| `Ext.memory_region.malware_signature.primary.signature.hash` | hash of file matching signature. | None |
+| `Ext.memory_region.malware_signature.primary.signature.hash.sha256` | sha256 hash of file matching signature. | None |
+| `Ext.memory_region.malware_signature.primary.signature.id` | The id of the first yara rule matched. | None |
+| `Ext.memory_region.malware_signature.primary.signature.name` | The name of the first yara rule matched. | None |
+| `Ext.memory_region.malware_signature.version` | malware signature version | None |
+| `Ext.memory_region.mapped_path` | If the memory corresponds to a file mapping, this is the file's path. | C:\Windows\System32\mshtml.dll |
+| `Ext.memory_region.mapped_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `Ext.memory_region.mapped_pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `Ext.memory_region.mapped_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `Ext.memory_region.mapped_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `Ext.memory_region.mapped_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `Ext.memory_region.mapped_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `Ext.memory_region.mapped_pe_detected` | Whether the file at mapped_path is an executable. | False |
+| `Ext.memory_region.memory_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `Ext.memory_region.memory_pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `Ext.memory_region.memory_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `Ext.memory_region.memory_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `Ext.memory_region.memory_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `Ext.memory_region.memory_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `Ext.memory_region.memory_pe_detected` | Whether an executable file was found in memory. | False |
+| `Ext.memory_region.region_base` | Base address of the memory region. | 2431737462784 |
+| `Ext.memory_region.region_protection` | Memory protection of the memory region. Example values include "RWX" and "R-X". | RWX |
+| `Ext.memory_region.region_size` | Size of the memory region. | 4096 |
+| `Ext.memory_region.region_start_bytes` | First 64 bytes at the region base address. | 4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000 |
+| `Ext.memory_region.region_state` | State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE". | COMMIT |
+| `Ext.memory_region.strings` | Array of strings found within the memory region. | None |
+| `Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
+| `Ext.services` | Services running in this process. | None |
+| `Ext.session` | Session information for the current process | None |
+| `Ext.token.domain` | Domain of token user. | None |
+| `Ext.token.elevation` | Whether the token is elevated or not | None |
+| `Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
+| `Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
+| `Ext.token.integrity_level` | Numeric integrity level. | None |
+| `Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
+| `Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
+| `Ext.token.privileges` | Array describing the privileges associated with the token. | None |
+| `Ext.token.privileges.description` | Description of the privilege. | None |
+| `Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
+| `Ext.token.privileges.name` | Name of the privilege. | None |
+| `Ext.token.sid` | Token user's Security Identifier (SID). | None |
+| `Ext.token.type` | Type of the token, either primary or impersonation. | None |
+| `Ext.token.user` | Username of token owner. | None |
+| `Ext.user` | User associated with the running process. | None |
+| `args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `entry_leader.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `entry_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `entry_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.entry_meta.source.ip` | IP address of the source (IPv4 or IPv6). | None |
+| `entry_leader.entry_meta.type` | The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console
+Note: This field is only set on process.session_leader. | None |
+| `entry_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `entry_leader.group.id` | Unique identifier for the group on the system/platform. | None |
+| `entry_leader.group.name` | Name of the group. | None |
+| `entry_leader.interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `entry_leader.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `entry_leader.parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.parent.pid` | Process id. | 4242 |
+| `entry_leader.parent.session_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.parent.session_leader.pid` | Process id. | 4242 |
+| `entry_leader.parent.session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `entry_leader.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `entry_leader.pid` | Process id. | 4242 |
+| `entry_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `entry_leader.real_group.name` | Name of the group. | None |
+| `entry_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `entry_leader.real_user.name` | Short name or login of the user. | a.einstein |
+| `entry_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
+For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
+This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
+Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
+Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
+| `entry_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `entry_leader.saved_group.name` | Name of the group. | None |
+| `entry_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `entry_leader.saved_user.name` | Short name or login of the user. | a.einstein |
+| `entry_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `entry_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `entry_leader.supplemental_groups.name` | Name of the group. | None |
+| `entry_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `entry_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `entry_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `entry_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `entry_leader.user.name` | Short name or login of the user. | a.einstein |
+| `entry_leader.working_directory` | The working directory of the process. | /home/alice |
+| `env_vars` | Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.
+May be filtered to protect sensitive information. | ["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"] |
+| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `exit_code` | The exit code of the process, if this is a termination event.
+The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
+| `group_leader.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `group_leader.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `group_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `group_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `group_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `group_leader.group.id` | Unique identifier for the group on the system/platform. | None |
+| `group_leader.group.name` | Name of the group. | None |
+| `group_leader.interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `group_leader.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `group_leader.pid` | Process id. | 4242 |
+| `group_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `group_leader.real_group.name` | Name of the group. | None |
+| `group_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `group_leader.real_user.name` | Short name or login of the user. | a.einstein |
+| `group_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
+For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
+This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
+Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
+Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
+| `group_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `group_leader.saved_group.name` | Name of the group. | None |
+| `group_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `group_leader.saved_user.name` | Short name or login of the user. | a.einstein |
+| `group_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `group_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `group_leader.supplemental_groups.name` | Name of the group. | None |
+| `group_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `group_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `group_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `group_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `group_leader.user.name` | Short name or login of the user. | a.einstein |
+| `group_leader.working_directory` | The working directory of the process. | /home/alice |
+| `hash.md5` | MD5 hash. | None |
+| `hash.sha1` | SHA1 hash. | None |
+| `hash.sha256` | SHA256 hash. | None |
+| `hash.sha512` | SHA512 hash. | None |
+| `interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `parent.Ext` | Object for all custom defined fields to live in. | None |
+| `parent.Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
+| `parent.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `parent.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `parent.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `parent.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `parent.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `parent.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `parent.Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
+| `parent.Ext.dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `parent.Ext.dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `parent.Ext.dll.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `parent.Ext.dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `parent.Ext.dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `parent.Ext.dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `parent.Ext.dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
+| `parent.Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
+| `parent.Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
+| `parent.Ext.dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `parent.Ext.dll.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `parent.Ext.dll.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `parent.Ext.dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `parent.Ext.dll.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `parent.Ext.dll.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `parent.Ext.dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `parent.Ext.dll.hash.md5` | MD5 hash. | None |
+| `parent.Ext.dll.hash.sha1` | SHA1 hash. | None |
+| `parent.Ext.dll.hash.sha256` | SHA256 hash. | None |
+| `parent.Ext.dll.hash.sha512` | SHA512 hash. | None |
+| `parent.Ext.dll.name` | Name of the library.
+This generally maps to the name of the file on disk. | kernel32.dll |
+| `parent.Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
+| `parent.Ext.dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `parent.Ext.dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `parent.Ext.dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `parent.Ext.dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `parent.Ext.dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `parent.Ext.dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `parent.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
+| `parent.Ext.real` | The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent. | None |
+| `parent.Ext.real.pid` | For process.parent this will be the ppid of the process that actually spawned the current process. | None |
+| `parent.Ext.token.domain` | Domain of token user. | None |
+| `parent.Ext.token.elevation` | Whether the token is elevated or not | None |
+| `parent.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
+| `parent.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
+| `parent.Ext.token.integrity_level` | Numeric integrity level. | None |
+| `parent.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
+| `parent.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
+| `parent.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
+| `parent.Ext.token.privileges.description` | Description of the privilege. | None |
+| `parent.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
+| `parent.Ext.token.privileges.name` | Name of the privilege. | None |
+| `parent.Ext.token.sid` | Token user's Security Identifier (SID). | None |
+| `parent.Ext.token.type` | Type of the token, either primary or impersonation. | None |
+| `parent.Ext.token.user` | Username of token owner. | None |
+| `parent.Ext.user` | User associated with the running process. | None |
+| `parent.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `parent.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `parent.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `parent.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `parent.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `parent.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `parent.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `parent.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `parent.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `parent.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `parent.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `parent.exit_code` | The exit code of the process, if this is a termination event.
+The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
+| `parent.group.id` | Unique identifier for the group on the system/platform. | None |
+| `parent.group.name` | Name of the group. | None |
+| `parent.group_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `parent.group_leader.pid` | Process id. | 4242 |
+| `parent.group_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `parent.hash.md5` | MD5 hash. | None |
+| `parent.hash.sha1` | SHA1 hash. | None |
+| `parent.hash.sha256` | SHA256 hash. | None |
+| `parent.hash.sha512` | SHA512 hash. | None |
+| `parent.interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `parent.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `parent.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `parent.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `parent.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `parent.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `parent.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `parent.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `parent.pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
+Identifier of the group of processes the process belongs to. | None |
+| `parent.pid` | Process id. | 4242 |
+| `parent.ppid` | Parent process' pid. | 4241 |
+| `parent.real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `parent.real_group.name` | Name of the group. | None |
+| `parent.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `parent.real_user.name` | Short name or login of the user. | a.einstein |
+| `parent.saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `parent.saved_group.name` | Name of the group. | None |
+| `parent.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `parent.saved_user.name` | Short name or login of the user. | a.einstein |
+| `parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `parent.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `parent.supplemental_groups.name` | Name of the group. | None |
+| `parent.thread.id` | Thread ID. | 4242 |
+| `parent.thread.name` | Thread name. | thread-0 |
+| `parent.title` | Process title.
+The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
+| `parent.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `parent.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `parent.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `parent.uptime` | Seconds the process has been up. | 1325 |
+| `parent.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `parent.user.name` | Short name or login of the user. | a.einstein |
+| `parent.working_directory` | The working directory of the process. | /home/alice |
+| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
+Identifier of the group of processes the process belongs to. | None |
+| `pid` | Process id. | 4242 |
+| `ppid` | Parent process' pid. | 4241 |
+| `previous.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `previous.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `previous.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `real_group.name` | Name of the group. | None |
+| `real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `real_user.name` | Short name or login of the user. | a.einstein |
+| `saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `saved_group.name` | Name of the group. | None |
+| `saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `saved_user.name` | Short name or login of the user. | a.einstein |
+| `session_leader.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `session_leader.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `session_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `session_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `session_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `session_leader.group.id` | Unique identifier for the group on the system/platform. | None |
+| `session_leader.group.name` | Name of the group. | None |
+| `session_leader.interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `session_leader.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `session_leader.parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `session_leader.parent.pid` | Process id. | 4242 |
+| `session_leader.parent.session_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `session_leader.parent.session_leader.pid` | Process id. | 4242 |
+| `session_leader.parent.session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `session_leader.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `session_leader.pid` | Process id. | 4242 |
+| `session_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `session_leader.real_group.name` | Name of the group. | None |
+| `session_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `session_leader.real_user.name` | Short name or login of the user. | a.einstein |
+| `session_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
+For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
+This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
+Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
+Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
+| `session_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `session_leader.saved_group.name` | Name of the group. | None |
+| `session_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `session_leader.saved_user.name` | Short name or login of the user. | a.einstein |
+| `session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `session_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `session_leader.supplemental_groups.name` | Name of the group. | None |
+| `session_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `session_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `session_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `session_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `session_leader.user.name` | Short name or login of the user. | a.einstein |
+| `session_leader.working_directory` | The working directory of the process. | /home/alice |
+| `start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `supplemental_groups.name` | Name of the group. | None |
+| `thread.Ext` | Object for all custom defined fields to live in. | None |
+| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
+| `thread.Ext.call_stack.instruction_pointer` | The return address of this stack frame. | None |
+| `thread.Ext.call_stack.memory_section.memory_address` | Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress` | None |
+| `thread.Ext.call_stack.memory_section.memory_size` | Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize` | None |
+| `thread.Ext.call_stack.memory_section.protection` | Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | None |
+| `thread.Ext.call_stack.module_name` | The name of the DLL/module containing `instruction_pointer`. | None |
+| `thread.Ext.call_stack.module_path` | The path to the DLL/module containing `instruction_pointer`. | None |
+| `thread.Ext.call_stack.rva` | The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`. | None |
+| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
+| `thread.Ext.call_stack_final_hook_module` | The module that installed the final API hook in the call stack. | None |
+| `thread.Ext.call_stack_final_hook_module.code_signature` | Code signature of the call_stack_final_hook_module. | None |
+| `thread.Ext.call_stack_final_hook_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `thread.Ext.call_stack_final_hook_module.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `thread.Ext.call_stack_final_hook_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `thread.Ext.call_stack_final_hook_module.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `thread.Ext.call_stack_final_hook_module.hash` | Hashes of the call_stack_final_hook_module. | None |
+| `thread.Ext.call_stack_final_hook_module.hash.sha256` | The sha256 of the call_stack_final_hook_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
+| `thread.Ext.call_stack_final_hook_module.path` | The file path of the call_stack_final_hook_module. | C:\Program Files\Example\example.dll |
+| `thread.Ext.call_stack_final_user_module` | The final non-win32 module in the call stack. | None |
+| `thread.Ext.call_stack_final_user_module.code_signature` | Code signature of the call_stack_final_user_module. | None |
+| `thread.Ext.call_stack_final_user_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `thread.Ext.call_stack_final_user_module.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `thread.Ext.call_stack_final_user_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `thread.Ext.call_stack_final_user_module.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `thread.Ext.call_stack_final_user_module.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `thread.Ext.call_stack_final_user_module.hash` | Hashes of the call_stack_final_user_module. | None |
+| `thread.Ext.call_stack_final_user_module.hash.sha256` | The sha256 of the call_stack_final_user_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
+| `thread.Ext.call_stack_final_user_module.name` | The file name of the call_stack_final_user_module. | example.dll |
+| `thread.Ext.call_stack_final_user_module.path` | The file path of the call_stack_final_user_module. | C:\Program Files\Example\example.dll |
+| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
+| `thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
+| `thread.Ext.original_start_address` | When a trampoline was detected, this indicates the original content for the thread start address in memory. | 4194304 |
+| `thread.Ext.original_start_address_allocation_offset` | When a trampoline was detected, this indicates the offset of original_start_address from the allocation base. | 0 |
+| `thread.Ext.original_start_address_bytes` | When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address. | 48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc |
+| `thread.Ext.original_start_address_bytes_disasm` | When a trampoline was detected, this holds the disassembled code at the original thread start address. | mov rax, 0x4141414141414141\njmp rax |
+| `thread.Ext.original_start_address_bytes_disasm_hash` | When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed. | aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c |
+| `thread.Ext.original_start_address_module` | When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution. | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe |
+| `thread.Ext.parameter` | When a thread is created, this is the raw numerical value of its parameter. | None |
+| `thread.Ext.parameter_bytes_compressed` | Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | None |
+| `thread.Ext.parameter_bytes_compressed_present` | Whether parameter_bytes_compressed is present in this event. | None |
+| `thread.Ext.service` | Service associated with the thread. | VaultSvc |
+| `thread.Ext.start` | The time the thread started. | 2016-05-23T08:05:34.853Z |
+| `thread.Ext.start_address` | Memory address where the thread began execution. | 4194304 |
+| `thread.Ext.start_address_allocation_offset` | Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base. | 0 |
+| `thread.Ext.start_address_bytes` | A few (typically 32) raw opcode bytes at the thread start address, hex-encoded. | c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc |
+| `thread.Ext.start_address_bytes_disasm` | The bytes at the thread start address, disassembled into human-readable assembly code. | ret\nint3 |
+| `thread.Ext.start_address_bytes_disasm_hash` | The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed. | aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c |
+| `thread.Ext.start_address_module` | The dll/module where the thread began execution. | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe |
+| `thread.Ext.token.domain` | Domain of token user. | None |
+| `thread.Ext.token.elevation` | Whether the token is elevated or not | None |
+| `thread.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
+| `thread.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
+| `thread.Ext.token.integrity_level` | Numeric integrity level. | None |
+| `thread.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
+| `thread.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
+| `thread.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
+| `thread.Ext.token.privileges.description` | Description of the privilege. | None |
+| `thread.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
+| `thread.Ext.token.privileges.name` | Name of the privilege. | None |
+| `thread.Ext.token.sid` | Token user's Security Identifier (SID). | None |
+| `thread.Ext.token.type` | Type of the token, either primary or impersonation. | None |
+| `thread.Ext.token.user` | Username of token owner. | None |
+| `thread.Ext.uptime` | Seconds since thread started. | None |
+| `thread.id` | Thread ID. | 4242 |
+| `thread.name` | Thread name. | thread-0 |
+| `title` | Process title.
+The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
+| `tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `uptime` | Seconds the process has been up. | 1325 |
+| `user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `user.name` | Short name or login of the user. | a.einstein |
+| `working_directory` | The working directory of the process. | /home/alice |
+### Example
 
 ```json
 Needs example
@@ -295,11 +1723,18 @@ Needs example
 ```
 <hr>
 
-### `registry`
+## `registry`
 
-#### Description
+### Description
 Fields related to Windows Registry operations.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `data.strings` | Content when writing string types.
+Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | ["C:\rta\red_ttp\bin\myapp.exe"] |
+| `path` | Full path, including hive, key and value | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger |
+| `value` | Name of the value written. | Debugger |
+### Example
 
 ```json
 Needs example
@@ -307,12 +1742,26 @@ Needs example
 ```
 <hr>
 
-### `rule`
+## `rule`
 
-#### Description
+### Description
 Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
 Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `author` | Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. | ["Star-Lord"] |
+| `category` | A categorization value keyword used by the entity using the rule for detection of this event. | Attempted Information Leak |
+| `description` | The description of the rule generating the event. | Block requests to public DNS over HTTPS / TLS protocols |
+| `id` | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | 101 |
+| `license` | Name of the license under which the rule used to generate this event is made available. | Apache 2.0 |
+| `name` | The name of the rule or signature generating the event. | BLOCK_DNS_over_TLS |
+| `reference` | Reference URL to additional information about the rule used to generate this event.
+The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. | https://en.wikipedia.org/wiki/DNS_over_TLS |
+| `ruleset` | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | Standard_Protocol_Filters |
+| `uuid` | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | 1100110011 |
+| `version` | The version / revision of the rule being used for analysis. | 1.1 |
+### Example
 
 ```json
 Needs example
@@ -320,12 +1769,30 @@ Needs example
 ```
 <hr>
 
-### `source`
+## `source`
 
-#### Description
+### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+| `ip` | IP address of the source (IPv4 or IPv6). | None |
+### Example
 
 ```json
 Needs example
@@ -333,12 +1800,535 @@ Needs example
 ```
 <hr>
 
-### `threat`
+## `threat`
 
-#### Description
+### Description
 Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.
 These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service").
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `enrichments` | A list of associated indicators objects enriching the event, and the context of that association/enrichment. | None |
+| `enrichments.indicator` | Object containing associated indicators enriching the event. | None |
+| `enrichments.indicator.file.Ext` | Object for all custom defined fields to live in. | None |
+| `enrichments.indicator.file.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `enrichments.indicator.file.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `enrichments.indicator.file.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `enrichments.indicator.file.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `enrichments.indicator.file.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `enrichments.indicator.file.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `enrichments.indicator.file.Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
+| `enrichments.indicator.file.Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
+| `enrichments.indicator.file.Ext.device.file_system_type` | Volume device file system type.
+Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
+| `enrichments.indicator.file.Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
+| `enrichments.indicator.file.Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
+| `enrichments.indicator.file.Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
+| `enrichments.indicator.file.Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
+| `enrichments.indicator.file.Ext.device.volume_device_type` | Volume device type.
+Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
+| `enrichments.indicator.file.Ext.entropy` | Entropy calculation of file's header and footer used to check file integrity. | None |
+| `enrichments.indicator.file.Ext.entry_modified` | Time of last status change.  See `st_ctim` member of `struct stat`. | None |
+| `enrichments.indicator.file.Ext.header_bytes` | First 16 bytes of file used to check file integrity. | None |
+| `enrichments.indicator.file.Ext.header_data` | First 16 bytes of file used to check file integrity. | None |
+| `enrichments.indicator.file.Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
+| `enrichments.indicator.file.Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
+| `enrichments.indicator.file.Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
+| `enrichments.indicator.file.Ext.malware_classification.identifier` | The model's unique identifier. | None |
+| `enrichments.indicator.file.Ext.malware_classification.score` | The score produced by the classification model. | None |
+| `enrichments.indicator.file.Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
+| `enrichments.indicator.file.Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
+| `enrichments.indicator.file.Ext.malware_classification.version` | The version of the model used. | None |
+| `enrichments.indicator.file.Ext.malware_signature` | Nested version of malware_signature fieldset. | None |
+| `enrichments.indicator.file.Ext.malware_signature.all_names` | The concatenated names of all yara signatures | None |
+| `enrichments.indicator.file.Ext.malware_signature.identifier` | Malware artifact identifier. | None |
+| `enrichments.indicator.file.Ext.malware_signature.primary` | Primary malware signature match. | None |
+| `enrichments.indicator.file.Ext.malware_signature.primary.matches` | An array of bytes representing yara signature matches | None |
+| `enrichments.indicator.file.Ext.malware_signature.primary.signature` | Primary malware signature match. | None |
+| `enrichments.indicator.file.Ext.malware_signature.primary.signature.hash` | Primary malware signature hash. | None |
+| `enrichments.indicator.file.Ext.malware_signature.primary.signature.hash.sha256` | Primary malware signature sha256. | None |
+| `enrichments.indicator.file.Ext.malware_signature.primary.signature.id` | Primary malware signature id. | None |
+| `enrichments.indicator.file.Ext.malware_signature.primary.signature.name` | Primary malware signature name. | None |
+| `enrichments.indicator.file.Ext.malware_signature.secondary` | An array of malware signature matches | None |
+| `enrichments.indicator.file.Ext.malware_signature.version` | Primary malware signature version. | None |
+| `enrichments.indicator.file.Ext.monotonic_id` | File event monotonic ID. | None |
+| `enrichments.indicator.file.Ext.original` | Original file information during a modification event. | None |
+| `enrichments.indicator.file.Ext.original.gid` | Primary group ID (GID) of the file. | 1001 |
+| `enrichments.indicator.file.Ext.original.group` | Primary group name of the file. | alice |
+| `enrichments.indicator.file.Ext.original.mode` | Original file mode prior to a modification event | None |
+| `enrichments.indicator.file.Ext.original.name` | Original file name prior to a modification event | None |
+| `enrichments.indicator.file.Ext.original.owner` | File owner's username. | alice |
+| `enrichments.indicator.file.Ext.original.path` | Original file path prior to a modification event | None |
+| `enrichments.indicator.file.Ext.original.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
+| `enrichments.indicator.file.Ext.quarantine_message` | Message describing quarantine results. | None |
+| `enrichments.indicator.file.Ext.quarantine_path` | Path on endpoint the quarantined file was originally. | None |
+| `enrichments.indicator.file.Ext.quarantine_result` | Boolean representing whether or not file quarantine succeeded. | None |
+| `enrichments.indicator.file.Ext.temp_file_path` | Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable. | None |
+| `enrichments.indicator.file.Ext.windows` | Platform-specific Windows fields | None |
+| `enrichments.indicator.file.Ext.windows.zone_identifier` | Windows zone identifier for a file | None |
+| `enrichments.indicator.file.accessed` | Last time the file was accessed.
+Note that not all filesystems keep track of access time. | None |
+| `enrichments.indicator.file.attributes` | Array of file attributes.
+Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | ["readonly", "system"] |
+| `enrichments.indicator.file.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `enrichments.indicator.file.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `enrichments.indicator.file.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `enrichments.indicator.file.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `enrichments.indicator.file.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `enrichments.indicator.file.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `enrichments.indicator.file.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `enrichments.indicator.file.created` | File creation time.
+Note that not all filesystems store the creation time. | None |
+| `enrichments.indicator.file.ctime` | Last time the file attributes or metadata changed.
+Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | None |
+| `enrichments.indicator.file.device` | Device that is the source of the file. | sda |
+| `enrichments.indicator.file.directory` | Directory where the file is located. It should include the drive letter, when appropriate. | /home/alice |
+| `enrichments.indicator.file.drive_letter` | Drive letter where the file is located. This field is only relevant on Windows.
+The value should be uppercase, and not include the colon. | C |
+| `enrichments.indicator.file.elf.architecture` | Machine architecture of the ELF file. | x86-64 |
+| `enrichments.indicator.file.elf.byte_order` | Byte sequence of ELF file. | Little Endian |
+| `enrichments.indicator.file.elf.cpu_type` | CPU type of the ELF file. | Intel |
+| `enrichments.indicator.file.elf.creation_date` | Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. | None |
+| `enrichments.indicator.file.elf.exports` | List of exported element names and types. | None |
+| `enrichments.indicator.file.elf.go_import_hash` | A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
+| `enrichments.indicator.file.elf.go_imports` | List of imported Go language element names and types. | None |
+| `enrichments.indicator.file.elf.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
+| `enrichments.indicator.file.elf.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
+| `enrichments.indicator.file.elf.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
+| `enrichments.indicator.file.elf.header.abi_version` | Version of the ELF Application Binary Interface (ABI). | None |
+| `enrichments.indicator.file.elf.header.class` | Header class of the ELF file. | None |
+| `enrichments.indicator.file.elf.header.data` | Data table of the ELF header. | None |
+| `enrichments.indicator.file.elf.header.entrypoint` | Header entrypoint of the ELF file. | None |
+| `enrichments.indicator.file.elf.header.object_version` | "0x1" for original ELF files. | None |
+| `enrichments.indicator.file.elf.header.os_abi` | Application Binary Interface (ABI) of the Linux OS. | None |
+| `enrichments.indicator.file.elf.header.type` | Header type of the ELF file. | None |
+| `enrichments.indicator.file.elf.header.version` | Version of the ELF header. | None |
+| `enrichments.indicator.file.elf.import_hash` | A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+This is an ELF implementation of the Windows PE imphash. | d41d8cd98f00b204e9800998ecf8427e |
+| `enrichments.indicator.file.elf.imports` | List of imported element names and types. | None |
+| `enrichments.indicator.file.elf.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
+| `enrichments.indicator.file.elf.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
+| `enrichments.indicator.file.elf.sections` | An array containing an object for each section of the ELF file.
+The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`. | None |
+| `enrichments.indicator.file.elf.sections.chi2` | Chi-square probability distribution of the section. | None |
+| `enrichments.indicator.file.elf.sections.entropy` | Shannon entropy calculation from the section. | None |
+| `enrichments.indicator.file.elf.sections.flags` | ELF Section List flags. | None |
+| `enrichments.indicator.file.elf.sections.name` | ELF Section List name. | None |
+| `enrichments.indicator.file.elf.sections.physical_offset` | ELF Section List offset. | None |
+| `enrichments.indicator.file.elf.sections.physical_size` | ELF Section List physical size. | None |
+| `enrichments.indicator.file.elf.sections.type` | ELF Section List type. | None |
+| `enrichments.indicator.file.elf.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
+| `enrichments.indicator.file.elf.sections.virtual_address` | ELF Section List virtual address. | None |
+| `enrichments.indicator.file.elf.sections.virtual_size` | ELF Section List virtual size. | None |
+| `enrichments.indicator.file.elf.segments` | An array containing an object for each segment of the ELF file.
+The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`. | None |
+| `enrichments.indicator.file.elf.segments.sections` | ELF object segment sections. | None |
+| `enrichments.indicator.file.elf.segments.type` | ELF object segment type. | None |
+| `enrichments.indicator.file.elf.shared_libraries` | List of shared libraries used by this ELF object. | None |
+| `enrichments.indicator.file.elf.telfhash` | telfhash symbol hash for ELF file. | None |
+| `enrichments.indicator.file.extension` | File extension, excluding the leading dot.
+Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
+| `enrichments.indicator.file.gid` | Primary group ID (GID) of the file. | 1001 |
+| `enrichments.indicator.file.group` | Primary group name of the file. | alice |
+| `enrichments.indicator.file.hash.md5` | MD5 hash. | None |
+| `enrichments.indicator.file.hash.sha1` | SHA1 hash. | None |
+| `enrichments.indicator.file.hash.sha256` | SHA256 hash. | None |
+| `enrichments.indicator.file.hash.sha512` | SHA512 hash. | None |
+| `enrichments.indicator.file.hash.ssdeep` | SSDEEP hash. | None |
+| `enrichments.indicator.file.inode` | Inode representing the file in the filesystem. | 256383 |
+| `enrichments.indicator.file.mime_type` | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | None |
+| `enrichments.indicator.file.mode` | Mode of the file in octal representation. | 0640 |
+| `enrichments.indicator.file.mtime` | Last time the file content was modified. | None |
+| `enrichments.indicator.file.name` | Name of the file including the extension, without the directory. | example.png |
+| `enrichments.indicator.file.owner` | File owner's username. | alice |
+| `enrichments.indicator.file.path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
+| `enrichments.indicator.file.pe.architecture` | CPU architecture target for the file. | x64 |
+| `enrichments.indicator.file.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `enrichments.indicator.file.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `enrichments.indicator.file.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `enrichments.indicator.file.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `enrichments.indicator.file.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `enrichments.indicator.file.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `enrichments.indicator.file.size` | File size in bytes.
+Only relevant when `file.type` is "file". | 16384 |
+| `enrichments.indicator.file.target_path` | Target path for symlinks. | None |
+| `enrichments.indicator.file.type` | File type (file, dir, or symlink). | file |
+| `enrichments.indicator.file.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
+| `enrichments.indicator.first_seen` | The date and time when intelligence source first reported sighting this indicator. | 2020-11-05T17:25:47.000Z |
+| `enrichments.indicator.geo.city_name` | City name. | Montreal |
+| `enrichments.indicator.geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `enrichments.indicator.geo.continent_name` | Name of the continent. | North America |
+| `enrichments.indicator.geo.country_iso_code` | Country ISO code. | CA |
+| `enrichments.indicator.geo.country_name` | Country name. | Canada |
+| `enrichments.indicator.geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `enrichments.indicator.geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `enrichments.indicator.geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `enrichments.indicator.geo.region_iso_code` | Region ISO code. | CA-QC |
+| `enrichments.indicator.geo.region_name` | Region name. | Quebec |
+| `enrichments.indicator.geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+| `enrichments.indicator.ip` | Identifies a threat indicator as an IP address (irrespective of direction). | 1.2.3.4 |
+| `enrichments.indicator.last_seen` | The date and time when intelligence source last reported sighting this indicator. | 2020-11-05T17:25:47.000Z |
+| `enrichments.indicator.marking.tlp` | Traffic Light Protocol sharing markings. | CLEAR |
+| `enrichments.indicator.modified_at` | The date and time when intelligence source last modified information for this indicator. | 2020-11-05T17:25:47.000Z |
+| `enrichments.indicator.port` | Identifies a threat indicator as a port number (irrespective of direction). | 443 |
+| `enrichments.indicator.provider` | The name of the indicator's provider. | lrz_urlhaus |
+| `enrichments.indicator.reference` | Reference URL linking to additional information about this indicator. | https://system.example.com/indicator/0001234 |
+| `enrichments.indicator.registry.data.bytes` | Original bytes written with base64 encoding.
+For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. | ZQBuAC0AVQBTAAAAZQBuAAAAAAA= |
+| `enrichments.indicator.registry.data.strings` | Content when writing string types.
+Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | ["C:\rta\red_ttp\bin\myapp.exe"] |
+| `enrichments.indicator.registry.data.type` | Standard registry type for encoding contents | REG_SZ |
+| `enrichments.indicator.registry.hive` | Abbreviated name for the hive. | HKLM |
+| `enrichments.indicator.registry.key` | Hive-relative path of keys. | SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe |
+| `enrichments.indicator.registry.path` | Full path, including hive, key and value | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger |
+| `enrichments.indicator.registry.value` | Name of the value written. | Debugger |
+| `enrichments.indicator.scanner_stats` | Count of AV/EDR vendors that successfully detected malicious file or URL. | 4 |
+| `enrichments.indicator.sightings` | Number of times this indicator was observed conducting threat activity. | 20 |
+| `enrichments.indicator.type` | Type of indicator as represented by Cyber Observable in STIX 2.0. | ipv4-addr |
+| `enrichments.indicator.url.domain` | Domain of the url, such as "www.elastic.co".
+In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.
+If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | www.elastic.co |
+| `enrichments.indicator.url.extension` | The field contains the file extension from the original request url, excluding the leading dot.
+The file extension is only set if it exists, as not every url has a file extension.
+The leading period must not be included. For example, the value must be "png", not ".png".
+Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
+| `enrichments.indicator.url.fragment` | Portion of the url after the `#`, such as "top".
+The `#` is not part of the fragment. | None |
+| `enrichments.indicator.url.full` | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | https://www.elastic.co:443/search?q=elasticsearch#top |
+| `enrichments.indicator.url.original` | Unmodified original url as seen in the event source.
+Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.
+This field is meant to represent the URL as it was observed, complete or not. | https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch |
+| `enrichments.indicator.url.password` | Password of the request. | None |
+| `enrichments.indicator.url.path` | Path of the request, such as "/search". | None |
+| `enrichments.indicator.url.port` | Port of the request, such as 443. | 443 |
+| `enrichments.indicator.url.query` | The query field describes the query string of the request, such as "q=elasticsearch".
+The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | None |
+| `enrichments.indicator.url.registered_domain` | The highest registered url domain, stripped of the subdomain.
+For example, the registered domain for "foo.example.com" is "example.com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
+| `enrichments.indicator.url.scheme` | Scheme of the request, such as "https".
+Note: The `:` is not part of the scheme. | https |
+| `enrichments.indicator.url.subdomain` | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
+For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | east |
+| `enrichments.indicator.url.top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
+| `enrichments.indicator.url.username` | Username of the request. | None |
+| `enrichments.indicator.x509.alternative_names` | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | *.elastic.co |
+| `enrichments.indicator.x509.issuer.common_name` | List of common name (CN) of issuing certificate authority. | Example SHA2 High Assurance Server CA |
+| `enrichments.indicator.x509.issuer.country` | List of country \(C) codes | US |
+| `enrichments.indicator.x509.issuer.distinguished_name` | Distinguished name (DN) of issuing certificate authority. | C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA |
+| `enrichments.indicator.x509.issuer.locality` | List of locality names (L) | Mountain View |
+| `enrichments.indicator.x509.issuer.organization` | List of organizations (O) of issuing certificate authority. | Example Inc |
+| `enrichments.indicator.x509.issuer.organizational_unit` | List of organizational units (OU) of issuing certificate authority. | www.example.com |
+| `enrichments.indicator.x509.issuer.state_or_province` | List of state or province names (ST, S, or P) | California |
+| `enrichments.indicator.x509.not_after` | Time at which the certificate is no longer considered valid. | 2020-07-16T03:15:39Z |
+| `enrichments.indicator.x509.not_before` | Time at which the certificate is first considered valid. | 2019-08-16T01:40:25Z |
+| `enrichments.indicator.x509.public_key_algorithm` | Algorithm used to generate the public key. | RSA |
+| `enrichments.indicator.x509.public_key_curve` | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | nistp521 |
+| `enrichments.indicator.x509.public_key_exponent` | Exponent used to derive the public key. This is algorithm specific. | 65537 |
+| `enrichments.indicator.x509.public_key_size` | The size of the public key space in bits. | 2048 |
+| `enrichments.indicator.x509.serial_number` | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | 55FBB9C7DEBF09809D12CCAA |
+| `enrichments.indicator.x509.signature_algorithm` | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | SHA256-RSA |
+| `enrichments.indicator.x509.subject.common_name` | List of common names (CN) of subject. | shared.global.example.net |
+| `enrichments.indicator.x509.subject.country` | List of country \(C) code | US |
+| `enrichments.indicator.x509.subject.distinguished_name` | Distinguished name (DN) of the certificate subject entity. | C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net |
+| `enrichments.indicator.x509.subject.locality` | List of locality names (L) | San Francisco |
+| `enrichments.indicator.x509.subject.organization` | List of organizations (O) of subject. | Example, Inc. |
+| `enrichments.indicator.x509.subject.organizational_unit` | List of organizational units (OU) of subject. | None |
+| `enrichments.indicator.x509.subject.state_or_province` | List of state or province names (ST, S, or P) | California |
+| `enrichments.indicator.x509.version_number` | Version of x509 format. | 3 |
+| `enrichments.matched.atomic` | Identifies the atomic indicator value that matched a local environment endpoint or network event. | bad-domain.com |
+| `enrichments.matched.field` | Identifies the field of the atomic indicator that matched a local environment endpoint or network event. | file.hash.sha256 |
+| `enrichments.matched.id` | Identifies the _id of the indicator document enriching the event. | ff93aee5-86a1-4a61-b0e6-0cdc313d01b5 |
+| `enrichments.matched.index` | Identifies the _index of the indicator document enriching the event. | filebeat-8.0.0-2021.05.23-000011 |
+| `enrichments.matched.type` | Identifies the type of match that caused the event to be enriched with the given indicator | indicator_match_rule |
+| `framework` | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | MITRE ATT&CK |
+| `group.alias` | The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.
+While not required, you can use a MITRE ATT&CK® group alias(es). | [ "Magecart Group 6" ] |
+| `group.id` | The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.
+While not required, you can use a MITRE ATT&CK® group id. | G0037 |
+| `group.name` | The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.
+While not required, you can use a MITRE ATT&CK® group name. | FIN6 |
+| `group.reference` | The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.
+While not required, you can use a MITRE ATT&CK® group reference URL. | https://attack.mitre.org/groups/G0037/ |
+| `indicator.as.number` | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | 15169 |
+| `indicator.as.organization.name` | Organization name. | Google LLC |
+| `indicator.confidence` | Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields. | Medium |
+| `indicator.description` | Describes the type of action conducted by the threat. | IP x.x.x.x was observed delivering the Angler EK. |
+| `indicator.email.address` | Identifies a threat indicator as an email address (irrespective of direction). | phish@example.com |
+| `indicator.file.Ext` | Object for all custom defined fields to live in. | None |
+| `indicator.file.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `indicator.file.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `indicator.file.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `indicator.file.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `indicator.file.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `indicator.file.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `indicator.file.Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
+| `indicator.file.Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
+| `indicator.file.Ext.device.file_system_type` | Volume device file system type.
+Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
+| `indicator.file.Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
+| `indicator.file.Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
+| `indicator.file.Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
+| `indicator.file.Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
+| `indicator.file.Ext.device.volume_device_type` | Volume device type.
+Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
+| `indicator.file.Ext.entropy` | Entropy calculation of file's header and footer used to check file integrity. | None |
+| `indicator.file.Ext.entry_modified` | Time of last status change.  See `st_ctim` member of `struct stat`. | None |
+| `indicator.file.Ext.header_bytes` | First 16 bytes of file used to check file integrity. | None |
+| `indicator.file.Ext.header_data` | First 16 bytes of file used to check file integrity. | None |
+| `indicator.file.Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
+| `indicator.file.Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
+| `indicator.file.Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
+| `indicator.file.Ext.malware_classification.identifier` | The model's unique identifier. | None |
+| `indicator.file.Ext.malware_classification.score` | The score produced by the classification model. | None |
+| `indicator.file.Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
+| `indicator.file.Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
+| `indicator.file.Ext.malware_classification.version` | The version of the model used. | None |
+| `indicator.file.Ext.malware_signature` | Nested version of malware_signature fieldset. | None |
+| `indicator.file.Ext.malware_signature.all_names` | The concatenated names of all yara signatures | None |
+| `indicator.file.Ext.malware_signature.identifier` | Malware artifact identifier. | None |
+| `indicator.file.Ext.malware_signature.primary` | Primary malware signature match. | None |
+| `indicator.file.Ext.malware_signature.primary.matches` | An array of bytes representing yara signature matches | None |
+| `indicator.file.Ext.malware_signature.primary.signature` | Primary malware signature match. | None |
+| `indicator.file.Ext.malware_signature.primary.signature.hash` | Primary malware signature hash. | None |
+| `indicator.file.Ext.malware_signature.primary.signature.hash.sha256` | Primary malware signature sha256. | None |
+| `indicator.file.Ext.malware_signature.primary.signature.id` | Primary malware signature id. | None |
+| `indicator.file.Ext.malware_signature.primary.signature.name` | Primary malware signature name. | None |
+| `indicator.file.Ext.malware_signature.secondary` | An array of malware signature matches | None |
+| `indicator.file.Ext.malware_signature.version` | Primary malware signature version. | None |
+| `indicator.file.Ext.monotonic_id` | File event monotonic ID. | None |
+| `indicator.file.Ext.original` | Original file information during a modification event. | None |
+| `indicator.file.Ext.original.gid` | Primary group ID (GID) of the file. | 1001 |
+| `indicator.file.Ext.original.group` | Primary group name of the file. | alice |
+| `indicator.file.Ext.original.mode` | Original file mode prior to a modification event | None |
+| `indicator.file.Ext.original.name` | Original file name prior to a modification event | None |
+| `indicator.file.Ext.original.owner` | File owner's username. | alice |
+| `indicator.file.Ext.original.path` | Original file path prior to a modification event | None |
+| `indicator.file.Ext.original.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
+| `indicator.file.Ext.quarantine_message` | Message describing quarantine results. | None |
+| `indicator.file.Ext.quarantine_path` | Path on endpoint the quarantined file was originally. | None |
+| `indicator.file.Ext.quarantine_result` | Boolean representing whether or not file quarantine succeeded. | None |
+| `indicator.file.Ext.temp_file_path` | Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable. | None |
+| `indicator.file.Ext.windows` | Platform-specific Windows fields | None |
+| `indicator.file.Ext.windows.zone_identifier` | Windows zone identifier for a file | None |
+| `indicator.file.accessed` | Last time the file was accessed.
+Note that not all filesystems keep track of access time. | None |
+| `indicator.file.attributes` | Array of file attributes.
+Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | ["readonly", "system"] |
+| `indicator.file.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `indicator.file.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `indicator.file.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `indicator.file.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `indicator.file.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `indicator.file.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `indicator.file.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `indicator.file.created` | File creation time.
+Note that not all filesystems store the creation time. | None |
+| `indicator.file.ctime` | Last time the file attributes or metadata changed.
+Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | None |
+| `indicator.file.device` | Device that is the source of the file. | sda |
+| `indicator.file.directory` | Directory where the file is located. It should include the drive letter, when appropriate. | /home/alice |
+| `indicator.file.drive_letter` | Drive letter where the file is located. This field is only relevant on Windows.
+The value should be uppercase, and not include the colon. | C |
+| `indicator.file.elf.architecture` | Machine architecture of the ELF file. | x86-64 |
+| `indicator.file.elf.byte_order` | Byte sequence of ELF file. | Little Endian |
+| `indicator.file.elf.cpu_type` | CPU type of the ELF file. | Intel |
+| `indicator.file.elf.creation_date` | Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. | None |
+| `indicator.file.elf.exports` | List of exported element names and types. | None |
+| `indicator.file.elf.go_import_hash` | A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
+| `indicator.file.elf.go_imports` | List of imported Go language element names and types. | None |
+| `indicator.file.elf.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
+| `indicator.file.elf.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
+| `indicator.file.elf.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
+| `indicator.file.elf.header.abi_version` | Version of the ELF Application Binary Interface (ABI). | None |
+| `indicator.file.elf.header.class` | Header class of the ELF file. | None |
+| `indicator.file.elf.header.data` | Data table of the ELF header. | None |
+| `indicator.file.elf.header.entrypoint` | Header entrypoint of the ELF file. | None |
+| `indicator.file.elf.header.object_version` | "0x1" for original ELF files. | None |
+| `indicator.file.elf.header.os_abi` | Application Binary Interface (ABI) of the Linux OS. | None |
+| `indicator.file.elf.header.type` | Header type of the ELF file. | None |
+| `indicator.file.elf.header.version` | Version of the ELF header. | None |
+| `indicator.file.elf.import_hash` | A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+This is an ELF implementation of the Windows PE imphash. | d41d8cd98f00b204e9800998ecf8427e |
+| `indicator.file.elf.imports` | List of imported element names and types. | None |
+| `indicator.file.elf.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
+| `indicator.file.elf.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
+| `indicator.file.elf.sections` | An array containing an object for each section of the ELF file.
+The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`. | None |
+| `indicator.file.elf.sections.chi2` | Chi-square probability distribution of the section. | None |
+| `indicator.file.elf.sections.entropy` | Shannon entropy calculation from the section. | None |
+| `indicator.file.elf.sections.flags` | ELF Section List flags. | None |
+| `indicator.file.elf.sections.name` | ELF Section List name. | None |
+| `indicator.file.elf.sections.physical_offset` | ELF Section List offset. | None |
+| `indicator.file.elf.sections.physical_size` | ELF Section List physical size. | None |
+| `indicator.file.elf.sections.type` | ELF Section List type. | None |
+| `indicator.file.elf.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
+| `indicator.file.elf.sections.virtual_address` | ELF Section List virtual address. | None |
+| `indicator.file.elf.sections.virtual_size` | ELF Section List virtual size. | None |
+| `indicator.file.elf.segments` | An array containing an object for each segment of the ELF file.
+The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`. | None |
+| `indicator.file.elf.segments.sections` | ELF object segment sections. | None |
+| `indicator.file.elf.segments.type` | ELF object segment type. | None |
+| `indicator.file.elf.shared_libraries` | List of shared libraries used by this ELF object. | None |
+| `indicator.file.elf.telfhash` | telfhash symbol hash for ELF file. | None |
+| `indicator.file.extension` | File extension, excluding the leading dot.
+Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
+| `indicator.file.gid` | Primary group ID (GID) of the file. | 1001 |
+| `indicator.file.group` | Primary group name of the file. | alice |
+| `indicator.file.hash.md5` | MD5 hash. | None |
+| `indicator.file.hash.sha1` | SHA1 hash. | None |
+| `indicator.file.hash.sha256` | SHA256 hash. | None |
+| `indicator.file.hash.sha512` | SHA512 hash. | None |
+| `indicator.file.hash.ssdeep` | SSDEEP hash. | None |
+| `indicator.file.inode` | Inode representing the file in the filesystem. | 256383 |
+| `indicator.file.mime_type` | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | None |
+| `indicator.file.mode` | Mode of the file in octal representation. | 0640 |
+| `indicator.file.mtime` | Last time the file content was modified. | None |
+| `indicator.file.name` | Name of the file including the extension, without the directory. | example.png |
+| `indicator.file.owner` | File owner's username. | alice |
+| `indicator.file.path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
+| `indicator.file.pe.architecture` | CPU architecture target for the file. | x64 |
+| `indicator.file.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `indicator.file.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `indicator.file.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `indicator.file.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `indicator.file.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `indicator.file.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `indicator.file.size` | File size in bytes.
+Only relevant when `file.type` is "file". | 16384 |
+| `indicator.file.target_path` | Target path for symlinks. | None |
+| `indicator.file.type` | File type (file, dir, or symlink). | file |
+| `indicator.file.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
+| `indicator.first_seen` | The date and time when intelligence source first reported sighting this indicator. | 2020-11-05T17:25:47.000Z |
+| `indicator.geo.city_name` | City name. | Montreal |
+| `indicator.geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `indicator.geo.continent_name` | Name of the continent. | North America |
+| `indicator.geo.country_iso_code` | Country ISO code. | CA |
+| `indicator.geo.country_name` | Country name. | Canada |
+| `indicator.geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `indicator.geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `indicator.geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `indicator.geo.region_iso_code` | Region ISO code. | CA-QC |
+| `indicator.geo.region_name` | Region name. | Quebec |
+| `indicator.geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+| `indicator.ip` | Identifies a threat indicator as an IP address (irrespective of direction). | 1.2.3.4 |
+| `indicator.last_seen` | The date and time when intelligence source last reported sighting this indicator. | 2020-11-05T17:25:47.000Z |
+| `indicator.marking.tlp` | Traffic Light Protocol sharing markings. | CLEAR |
+| `indicator.modified_at` | The date and time when intelligence source last modified information for this indicator. | 2020-11-05T17:25:47.000Z |
+| `indicator.port` | Identifies a threat indicator as a port number (irrespective of direction). | 443 |
+| `indicator.provider` | The name of the indicator's provider. | lrz_urlhaus |
+| `indicator.reference` | Reference URL linking to additional information about this indicator. | https://system.example.com/indicator/0001234 |
+| `indicator.registry.data.bytes` | Original bytes written with base64 encoding.
+For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. | ZQBuAC0AVQBTAAAAZQBuAAAAAAA= |
+| `indicator.registry.data.strings` | Content when writing string types.
+Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | ["C:\rta\red_ttp\bin\myapp.exe"] |
+| `indicator.registry.data.type` | Standard registry type for encoding contents | REG_SZ |
+| `indicator.registry.hive` | Abbreviated name for the hive. | HKLM |
+| `indicator.registry.key` | Hive-relative path of keys. | SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe |
+| `indicator.registry.path` | Full path, including hive, key and value | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger |
+| `indicator.registry.value` | Name of the value written. | Debugger |
+| `indicator.scanner_stats` | Count of AV/EDR vendors that successfully detected malicious file or URL. | 4 |
+| `indicator.sightings` | Number of times this indicator was observed conducting threat activity. | 20 |
+| `indicator.type` | Type of indicator as represented by Cyber Observable in STIX 2.0. | ipv4-addr |
+| `indicator.url.domain` | Domain of the url, such as "www.elastic.co".
+In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.
+If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | www.elastic.co |
+| `indicator.url.extension` | The field contains the file extension from the original request url, excluding the leading dot.
+The file extension is only set if it exists, as not every url has a file extension.
+The leading period must not be included. For example, the value must be "png", not ".png".
+Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
+| `indicator.url.fragment` | Portion of the url after the `#`, such as "top".
+The `#` is not part of the fragment. | None |
+| `indicator.url.full` | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | https://www.elastic.co:443/search?q=elasticsearch#top |
+| `indicator.url.original` | Unmodified original url as seen in the event source.
+Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.
+This field is meant to represent the URL as it was observed, complete or not. | https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch |
+| `indicator.url.password` | Password of the request. | None |
+| `indicator.url.path` | Path of the request, such as "/search". | None |
+| `indicator.url.port` | Port of the request, such as 443. | 443 |
+| `indicator.url.query` | The query field describes the query string of the request, such as "q=elasticsearch".
+The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | None |
+| `indicator.url.registered_domain` | The highest registered url domain, stripped of the subdomain.
+For example, the registered domain for "foo.example.com" is "example.com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
+| `indicator.url.scheme` | Scheme of the request, such as "https".
+Note: The `:` is not part of the scheme. | https |
+| `indicator.url.subdomain` | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
+For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | east |
+| `indicator.url.top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
+| `indicator.url.username` | Username of the request. | None |
+| `indicator.x509.alternative_names` | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | *.elastic.co |
+| `indicator.x509.issuer.common_name` | List of common name (CN) of issuing certificate authority. | Example SHA2 High Assurance Server CA |
+| `indicator.x509.issuer.country` | List of country \(C) codes | US |
+| `indicator.x509.issuer.distinguished_name` | Distinguished name (DN) of issuing certificate authority. | C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA |
+| `indicator.x509.issuer.locality` | List of locality names (L) | Mountain View |
+| `indicator.x509.issuer.organization` | List of organizations (O) of issuing certificate authority. | Example Inc |
+| `indicator.x509.issuer.organizational_unit` | List of organizational units (OU) of issuing certificate authority. | www.example.com |
+| `indicator.x509.issuer.state_or_province` | List of state or province names (ST, S, or P) | California |
+| `indicator.x509.not_after` | Time at which the certificate is no longer considered valid. | 2020-07-16T03:15:39Z |
+| `indicator.x509.not_before` | Time at which the certificate is first considered valid. | 2019-08-16T01:40:25Z |
+| `indicator.x509.public_key_algorithm` | Algorithm used to generate the public key. | RSA |
+| `indicator.x509.public_key_curve` | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | nistp521 |
+| `indicator.x509.public_key_exponent` | Exponent used to derive the public key. This is algorithm specific. | 65537 |
+| `indicator.x509.public_key_size` | The size of the public key space in bits. | 2048 |
+| `indicator.x509.serial_number` | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | 55FBB9C7DEBF09809D12CCAA |
+| `indicator.x509.signature_algorithm` | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | SHA256-RSA |
+| `indicator.x509.subject.common_name` | List of common names (CN) of subject. | shared.global.example.net |
+| `indicator.x509.subject.country` | List of country \(C) code | US |
+| `indicator.x509.subject.distinguished_name` | Distinguished name (DN) of the certificate subject entity. | C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net |
+| `indicator.x509.subject.locality` | List of locality names (L) | San Francisco |
+| `indicator.x509.subject.organization` | List of organizations (O) of subject. | Example, Inc. |
+| `indicator.x509.subject.organizational_unit` | List of organizational units (OU) of subject. | None |
+| `indicator.x509.subject.state_or_province` | List of state or province names (ST, S, or P) | California |
+| `indicator.x509.version_number` | Version of x509 format. | 3 |
+| `software.id` | The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
+While not required, you can use a MITRE ATT&CK® software id. | S0552 |
+| `software.name` | The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
+While not required, you can use a MITRE ATT&CK® software name. | AdFind |
+| `software.platforms` | The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
+While not required, you can use MITRE ATT&CK® software platform values. | [ "Windows" ] |
+| `software.reference` | The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
+While not required, you can use a MITRE ATT&CK® software reference URL. | https://attack.mitre.org/software/S0552/ |
+| `software.type` | The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
+While not required, you can use a MITRE ATT&CK® software type. | Tool |
+| `tactic.id` | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | TA0002 |
+| `tactic.name` | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | Execution |
+| `tactic.reference` | The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | https://attack.mitre.org/tactics/TA0002/ |
+| `technique.id` | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | T1059 |
+| `technique.name` | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter |
+| `technique.reference` | The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | https://attack.mitre.org/techniques/T1059/ |
+| `technique.subtechnique.id` | The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) | T1059.001 |
+| `technique.subtechnique.name` | The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) | PowerShell |
+| `technique.subtechnique.reference` | The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) | https://attack.mitre.org/techniques/T1059/001/ |
+### Example
 
 ```json
 Needs example
@@ -346,12 +2336,34 @@ Needs example
 ```
 <hr>
 
-### `user`
+## `user`
 
-#### Description
+### Description
 The user fields describe information about the user that is relevant to the event.
 Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | User info prior to any setuid operations. | None |
+| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
+| `Ext.real.name` | Short name or login of the user. | None |
+| `domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `email` | User email address. | None |
+| `full_name` | User's full name, if available. | Albert Einstein |
+| `group.Ext` | Object for all custom defined fields to live in. | None |
+| `group.Ext.real` | Group info prior to any setgid operations. | None |
+| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `group.Ext.real.name` | Name of the group. | None |
+| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `group.id` | Unique identifier for the group on the system/platform. | None |
+| `group.name` | Name of the group. | None |
+| `hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `name` | Short name or login of the user. | a.einstein |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/api.md b/scripts/generate-docs/output/api.md
index 9ce6b7560..b2b9ef731 100644
--- a/scripts/generate-docs/output/api.md
+++ b/scripts/generate-docs/output/api.md
@@ -1,40 +1,179 @@
 [Back to index](README.md)
 
-# api
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `Target`
+## `Target`
 
-#### Description
+### Description
 These fields contain information about a target.
 These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `process.Ext` | Object for all custom defined fields to live in. | None |
+| `process.Ext.created_suspended` | A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls. | true |
+| `process.Ext.memory_region.allocation_base` | Base address of the memory allocation containing the memory region. | 2431737462784 |
+| `process.Ext.memory_region.allocation_protection` | Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X". | RWX |
+| `process.Ext.memory_region.allocation_size` | Original memory size requested when the memory was allocated. | 4096 |
+| `process.Ext.memory_region.allocation_type` | The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE". | PRIVATE |
+| `process.Ext.memory_region.bytes_address` | The address where bytes_compressed begins. | 2431737462784 |
+| `process.Ext.memory_region.bytes_allocation_offset` | Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base. | 0 |
+| `process.Ext.memory_region.bytes_compressed` | Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | eJzzSM3JyVcIzy/KSVEEABxJBD4= |
+| `process.Ext.memory_region.bytes_compressed_present` | Whether bytes_compressed is present in this event. | False |
+| `process.Ext.memory_region.hash.sha256` | The sha256 of the memory region. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
+| `process.Ext.memory_region.malware_signature.all_names` | A sequence of signature names matched. | Windows.EICAR.Not-a-virus |
+| `process.Ext.memory_region.malware_signature.identifier` | malware signature identifier | None |
+| `process.Ext.memory_region.malware_signature.primary` | The first matching details. | None |
+| `process.Ext.memory_region.malware_signature.primary.matches` | The first matching details. | None |
+| `process.Ext.memory_region.malware_signature.primary.signature.hash` | hash of file matching signature. | None |
+| `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256` | sha256 hash of file matching signature. | None |
+| `process.Ext.memory_region.malware_signature.primary.signature.id` | The id of the first yara rule matched. | None |
+| `process.Ext.memory_region.malware_signature.primary.signature.name` | The name of the first yara rule matched. | None |
+| `process.Ext.memory_region.malware_signature.secondary` | Additional matching details if available. | None |
+| `process.Ext.memory_region.malware_signature.secondary.matches` | The second matching details. | None |
+| `process.Ext.memory_region.malware_signature.secondary.signature.hash` | hash of second file matching signature. | None |
+| `process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256` | sha256 hash of second file matching signature. | None |
+| `process.Ext.memory_region.malware_signature.secondary.signature.id` | The id of the second yara rule matched. | None |
+| `process.Ext.memory_region.malware_signature.secondary.signature.name` | The name of the second yara rule matched. | None |
+| `process.Ext.memory_region.malware_signature.version` | malware signature version | None |
+| `process.Ext.memory_region.mapped_path` | If the memory corresponds to a file mapping, this is the file's path. | C:\Windows\System32\mshtml.dll |
+| `process.Ext.memory_region.mapped_pe.Ext.dotnet` | Whether this file is a .NET PE | true |
+| `process.Ext.memory_region.mapped_pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
+| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5` | MD5 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1` | SHA1 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384` | SHA384 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512` | SHA512 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep` | SSDEEP hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh` | TLSH hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.sections.name` | The section's name | .reloc |
+| `process.Ext.memory_region.mapped_pe.Ext.streams` | The file's streams, if it is a PE | None |
+| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5` | MD5 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1` | SHA1 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384` | SHA384 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512` | SHA512 hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep` | SSDEEP hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh` | TLSH hash. | None |
+| `process.Ext.memory_region.mapped_pe.Ext.streams.name` | The stream's name | .reloc |
+| `process.Ext.memory_region.mapped_pe.architecture` | CPU architecture target for the file. | x64 |
+| `process.Ext.memory_region.mapped_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `process.Ext.memory_region.mapped_pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `process.Ext.memory_region.mapped_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `process.Ext.memory_region.mapped_pe.go_import_hash` | A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
+| `process.Ext.memory_region.mapped_pe.go_imports` | List of imported Go language element names and types. | None |
+| `process.Ext.memory_region.mapped_pe.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
+| `process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
+| `process.Ext.memory_region.mapped_pe.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
+| `process.Ext.memory_region.mapped_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `process.Ext.memory_region.mapped_pe.import_hash` | A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+This is a synonym for imphash. | d41d8cd98f00b204e9800998ecf8427e |
+| `process.Ext.memory_region.mapped_pe.imports` | List of imported element names and types. | None |
+| `process.Ext.memory_region.mapped_pe.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
+| `process.Ext.memory_region.mapped_pe.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
+| `process.Ext.memory_region.mapped_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `process.Ext.memory_region.mapped_pe.pehash` | A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.
+Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. | 73ff189b63cd6be375a7ff25179a38d347651975 |
+| `process.Ext.memory_region.mapped_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `process.Ext.memory_region.mapped_pe.sections` | An array containing an object for each section of the PE file.
+The keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`. | None |
+| `process.Ext.memory_region.mapped_pe.sections.entropy` | Shannon entropy calculation from the section. | None |
+| `process.Ext.memory_region.mapped_pe.sections.name` | PE Section List name. | None |
+| `process.Ext.memory_region.mapped_pe.sections.physical_size` | PE Section List physical size. | None |
+| `process.Ext.memory_region.mapped_pe.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
+| `process.Ext.memory_region.mapped_pe.sections.virtual_size` | PE Section List virtual size. This is always the same as `physical_size`. | None |
+| `process.Ext.memory_region.mapped_pe_detected` | Whether the file at mapped_path is an executable. | False |
+| `process.Ext.memory_region.memory_pe.Ext.dotnet` | Whether this file is a .NET PE | true |
+| `process.Ext.memory_region.memory_pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
+| `process.Ext.memory_region.memory_pe.Ext.sections.hash.md5` | MD5 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1` | SHA1 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384` | SHA384 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512` | SHA512 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep` | SSDEEP hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh` | TLSH hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.sections.name` | The section's name | .reloc |
+| `process.Ext.memory_region.memory_pe.Ext.streams` | The file's streams, if it is a PE | None |
+| `process.Ext.memory_region.memory_pe.Ext.streams.hash.md5` | MD5 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1` | SHA1 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384` | SHA384 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512` | SHA512 hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep` | SSDEEP hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh` | TLSH hash. | None |
+| `process.Ext.memory_region.memory_pe.Ext.streams.name` | The stream's name | .reloc |
+| `process.Ext.memory_region.memory_pe.architecture` | CPU architecture target for the file. | x64 |
+| `process.Ext.memory_region.memory_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `process.Ext.memory_region.memory_pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `process.Ext.memory_region.memory_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `process.Ext.memory_region.memory_pe.go_import_hash` | A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
+| `process.Ext.memory_region.memory_pe.go_imports` | List of imported Go language element names and types. | None |
+| `process.Ext.memory_region.memory_pe.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
+| `process.Ext.memory_region.memory_pe.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
+| `process.Ext.memory_region.memory_pe.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
+| `process.Ext.memory_region.memory_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `process.Ext.memory_region.memory_pe.import_hash` | A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+This is a synonym for imphash. | d41d8cd98f00b204e9800998ecf8427e |
+| `process.Ext.memory_region.memory_pe.imports` | List of imported element names and types. | None |
+| `process.Ext.memory_region.memory_pe.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
+| `process.Ext.memory_region.memory_pe.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
+| `process.Ext.memory_region.memory_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `process.Ext.memory_region.memory_pe.pehash` | A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.
+Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. | 73ff189b63cd6be375a7ff25179a38d347651975 |
+| `process.Ext.memory_region.memory_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `process.Ext.memory_region.memory_pe.sections` | An array containing an object for each section of the PE file.
+The keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`. | None |
+| `process.Ext.memory_region.memory_pe.sections.entropy` | Shannon entropy calculation from the section. | None |
+| `process.Ext.memory_region.memory_pe.sections.name` | PE Section List name. | None |
+| `process.Ext.memory_region.memory_pe.sections.physical_size` | PE Section List physical size. | None |
+| `process.Ext.memory_region.memory_pe.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
+| `process.Ext.memory_region.memory_pe.sections.virtual_size` | PE Section List virtual size. This is always the same as `physical_size`. | None |
+| `process.Ext.memory_region.memory_pe_detected` | Whether an executable file was found in memory. | False |
+| `process.Ext.memory_region.region_base` | Base address of the memory region. | 2431737462784 |
+| `process.Ext.memory_region.region_protection` | Memory protection of the memory region. Example values include "RWX" and "R-X". | RWX |
+| `process.Ext.memory_region.region_size` | Size of the memory region. | 4096 |
+| `process.Ext.memory_region.region_start_bytes` | First 64 bytes at the region base address. | 4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000 |
+| `process.Ext.memory_region.region_state` | State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE". | COMMIT |
+| `process.Ext.memory_region.strings` | Array of strings found within the memory region. | None |
+| `process.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
+| `process.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
+| `process.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `process.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `process.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `process.pid` | Process id. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -42,11 +181,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -54,12 +199,17 @@ Needs example
 ```
 <hr>
 
-### `destination`
+## `destination`
 
-#### Description
+### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `ip` | IP address of the destination (IPv4 or IPv6). | None |
+| `port` | Port of the destination. | None |
+### Example
 
 ```json
 Needs example
@@ -67,16 +217,29 @@ Needs example
 ```
 <hr>
 
-### `dll`
+## `dll`
 
-#### Description
+### Description
 These fields contain information about code libraries dynamically loaded into processes.
 
 Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
 * Dynamic-link library (`.dll`) commonly used on Windows
 * Shared Object (`.so`) commonly used on Unix-like operating systems
 * Dynamic library (`.dylib`) commonly used on macOS
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `hash.sha256` | SHA256 hash. | None |
+| `path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
+### Example
 
 ```json
 Needs example
@@ -84,11 +247,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -96,12 +264,42 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `end` | `event.end` contains the date when the event ended or when the activity was last observed. | None |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `start` | `event.start` contains the date when the event started or when the activity was first observed. | None |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -109,12 +307,41 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+### Example
 
 ```json
 Needs example
@@ -122,12 +349,19 @@ Needs example
 ```
 <hr>
 
-### `network`
+## `network`
 
-#### Description
+### Description
 The network is defined as the communication path over which a host or network event happens.
 The network.* fields should be populated with details about the network activity associated with an event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `transport` | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
+The field value must be normalized to lowercase for querying. | tcp |
+| `type` | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
+The field value must be normalized to lowercase for querying. | ipv4 |
+### Example
 
 ```json
 Needs example
@@ -135,12 +369,321 @@ Needs example
 ```
 <hr>
 
-### `process`
+## `process`
 
-#### Description
+### Description
 These fields contain information about a process.
 These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
+| `Ext.api.behaviors` | A list of observed behaviors.
+  "cross-process" - the observed activity was between two processes
+  "parent-child" - the observed activity was between a parent process and its child
+  "native_api" - a call was made directly to the Native API rather than the Win32 API
+  "direct_syscall" - a syscall instruction originated outside of the Native API layer
+  "proxy_call" - the call stack may indicate of a proxied API call to mask the true source
+  "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API
+  "shellcode" - suspicious executable non-image memory is calling a sensitive API
+  "image_hooked" - an entry in the callstack appears to have been hooked
+  "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function
+  "image_rop" - no call instruction preceded an entry in the call stack
+  "image_rwx" - an entry in the callstack is writable
+  "unbacked_rwx" - an entry in the callstack is non-image and writable
+  "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load
+  "allocate_shellcode" - a region of non-image executable memory allocated more executable memory
+  "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating
+  "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating
+  "hook_api" - a change to the memory protection of a small executable image memory region was made
+  "hollow_image" - a change to the memory protection of a large executable image memory region was made
+  "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made
+  "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made
+  "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD
+  "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS
+  "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control
+  "hardware_breakpoint_set" - a hardware breakpoint was set
+  "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed
+  "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed
+  "pid_spoofing" - The acting process details may have been spoofed to hide the true origin
+  "legacy_api" - a deprecated or superseded API was called | [ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ] |
+| `Ext.api.metadata` | Information related to the API call. | None |
+| `Ext.api.metadata.amsi_filenames` | A list of filenames previously scanned by AMSI. | [ "C:\script.ps1" ] |
+| `Ext.api.metadata.amsi_logs` | Information related to previous AMSI scans. | None |
+| `Ext.api.metadata.amsi_logs.entries` | A subset of the AMSI content buffers scanned prior to this event. | [ "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport("kernel32.dll")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}" ] |
+| `Ext.api.metadata.amsi_logs.type` | The AMSI content type scanned prior to this event. | PowerShell |
+| `Ext.api.metadata.background_callcount` | This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call. | 6021 |
+| `Ext.api.metadata.client_is_local` | Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely. | true |
+| `Ext.api.metadata.client_machine` | Client process's machine name (provided by the client and potentially untrustworthy). | DESKTOP-EXAMPLE |
+| `Ext.api.metadata.client_machine_fqdn` | Client process's machine name FQDN (provided by the client and potentially untrustworthy). | DESKTOP-EXAMPLE.elastic.co |
+| `Ext.api.metadata.client_process_id` | Client process id | 3600 |
+| `Ext.api.metadata.ms_since_last_keyevent` | This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event. | 94 |
+| `Ext.api.metadata.procedure_symbol` | Summary of the hook procedure. | taskbar.dll |
+| `Ext.api.metadata.return_value` | Return value of RegisterRawInputDevices API call. | 1 |
+| `Ext.api.metadata.security_descriptor` | The security descriptor of the device. | O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW) |
+| `Ext.api.metadata.start_address_allocation_protection` | Memory protection attributes associated with the starting address of a thread. | RCX |
+| `Ext.api.metadata.start_address_module` | Name of the module associated with the starting address of a thread. | C:\Windows\System32\DellTPad\ApMsgFwd.exe |
+| `Ext.api.metadata.target_address_name` | The name of the memory region targeted by the API call. | Unbacked |
+| `Ext.api.metadata.target_address_path` | The path of the memory region targeted by the API call. | C:\programdata\example.dll |
+| `Ext.api.metadata.thread_info_flags` | Thread info flags. | 16 |
+| `Ext.api.metadata.visible_windows_count` | Number of visible windows owned by the caller thread. | 0 |
+| `Ext.api.metadata.windows_count` | Number of windows owned by the caller thread. | 2 |
+| `Ext.api.name` | The name of the API, usually the name of the function or system call. | VirtualAlloc |
+| `Ext.api.parameters` | Parameter values passed to the API call. | None |
+| `Ext.api.parameters.address` | The target memory address. | 2431737462784 |
+| `Ext.api.parameters.allocation_type` | The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State` | COMMIT|RESERVE |
+| `Ext.api.parameters.app_name` | The application name requesting the AMSI scan. | PowerShell |
+| `Ext.api.parameters.argument1` | The first argument to the procedure. | 1 |
+| `Ext.api.parameters.argument2` | The second argument to the procedure. | 2 |
+| `Ext.api.parameters.argument3` | The third argument to the procedure. | 3 |
+| `Ext.api.parameters.buffer` | The content associated with an AMSI scan. | [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport("kernel32.dll")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20); |
+| `Ext.api.parameters.consumer_details` | Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name. | None |
+| `Ext.api.parameters.consumer_name` | Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered. | ExampleConsumer |
+| `Ext.api.parameters.consumer_type` | An example list of consumer type.
+  "ActiveScriptEventConsumer" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.
+  "CommandLineEventConsumer" - Launches an arbitrary process in the local system context when an event is delivered to it.
+  "LogFileEventConsumer" - Writes customized strings to a text log file when events are delivered to it.
+  "NTEventLogEventConsumer" - Logs a specific message to the Windows event log when an event is delivered to it.
+  "SMTPEventConsumer" - Sends an email message using SMTP each time an event is delivered to it. | CommandLineEventConsumer |
+| `Ext.api.parameters.content_name` | The content name, typically a filename, associated with an AMSI scan. | C:\script.ps1 |
+| `Ext.api.parameters.context_flags` | The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags` | 1048607 |
+| `Ext.api.parameters.desired_access` | This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`. | None |
+| `Ext.api.parameters.desired_access_numeric` | This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`. | None |
+| `Ext.api.parameters.device` | The name of the device object. | \Device\NPCAP |
+| `Ext.api.parameters.driver` | The name of the driver object. | \Driver\npcap |
+| `Ext.api.parameters.eax` | The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall. | 0 |
+| `Ext.api.parameters.ebp` | The x86 EBP frame pointer register. | 15006644 |
+| `Ext.api.parameters.ebx` | The x86 EBX general purpose register. | 0 |
+| `Ext.api.parameters.ecx` | The x86 ECX general purpose register. First argument in __fastcall and __thiscall. | 0 |
+| `Ext.api.parameters.edi` | The x86 EDI general purpose register. | 0 |
+| `Ext.api.parameters.edx` | The x86 EDX general purpose register. Second argument in a __fastcall. | 0 |
+| `Ext.api.parameters.eip` | The x86 EIP instruction pointer register. | 1472790528 |
+| `Ext.api.parameters.esi` | The x86 ESI general purpose register. | 0 |
+| `Ext.api.parameters.esp` | The x86 ESP stack pointer register. | 15007744 |
+| `Ext.api.parameters.event_filter_details` | Provide an overview of the query that define when an event should be triggered. | None |
+| `Ext.api.parameters.event_filter_name` | Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer. | ExampleFilter |
+| `Ext.api.parameters.flags` | Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure. | INPUTSINK |
+| `Ext.api.parameters.handle_type` | This parameter indicates whether the detected access was attempt against a process or a thread. | process |
+| `Ext.api.parameters.hook_module` | DLL containing the hook procedure. | c:\windows\system32\taskbar.dll |
+| `Ext.api.parameters.hook_type` | Type of hook procedure to be installed. | WH_KEYBOARD_LL |
+| `Ext.api.parameters.io_control_code` | The I/O control code for the requested device operation. | 27365 |
+| `Ext.api.parameters.namespace` | WMI namespace to which the connection is made. | root\Microsoft\Windows\DeviceGuard |
+| `Ext.api.parameters.operation` | Specifies the connection or request to WMI | Win32_Process::Create |
+| `Ext.api.parameters.procedure` | The memory address of the procedure or function. | 2431737462784 |
+| `Ext.api.parameters.protection` | The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | RWX|GUARD |
+| `Ext.api.parameters.protection_old` | The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | RCX |
+| `Ext.api.parameters.r8` | The x64 R8 general purpose register. Third argument in a __fastcall. | 3 |
+| `Ext.api.parameters.r9` | The x64 R9 general purpose register. Fourth argument in a __fastcall. | 4 |
+| `Ext.api.parameters.rax` | The x64 RAX general purpose register. Return value in a __fastcall. | 0 |
+| `Ext.api.parameters.rbp` | The x64 RBP general purpose register. | 0 |
+| `Ext.api.parameters.rbx` | The x64 RBX general purpose register. | 0 |
+| `Ext.api.parameters.rcx` | The x64 RCX general purpose register. First argument in a __fastcall. | 1 |
+| `Ext.api.parameters.rdi` | The x64 RDI general purpose register. | 0 |
+| `Ext.api.parameters.rdx` | The x64 RDX general purpose register. Second argument in a __fastcall. | 2 |
+| `Ext.api.parameters.rip` | The x64 RIP instruction pointer register. | 140706153693184 |
+| `Ext.api.parameters.rsi` | The x64 RSI general purpose register. | 0 |
+| `Ext.api.parameters.rsp` | The x64 RSP stack pointer register. | 2431737462784 |
+| `Ext.api.parameters.size` | The size. | 4096 |
+| `Ext.api.parameters.usage` | This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure. | KEYBOARD |
+| `Ext.api.parameters.usage_page` | This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure. | GENERIC |
+| `Ext.api.summary` | The summary of the API call and its parameters. | VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX ) |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.created_suspended` | A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls. | true |
+| `Ext.memory_region.allocation_base` | Base address of the memory allocation containing the memory region. | 2431737462784 |
+| `Ext.memory_region.allocation_protection` | Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X". | RWX |
+| `Ext.memory_region.allocation_size` | Original memory size requested when the memory was allocated. | 4096 |
+| `Ext.memory_region.allocation_type` | The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE". | PRIVATE |
+| `Ext.memory_region.bytes_address` | The address where bytes_compressed begins. | 2431737462784 |
+| `Ext.memory_region.bytes_allocation_offset` | Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base. | 0 |
+| `Ext.memory_region.bytes_compressed` | Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | eJzzSM3JyVcIzy/KSVEEABxJBD4= |
+| `Ext.memory_region.bytes_compressed_present` | Whether bytes_compressed is present in this event. | False |
+| `Ext.memory_region.hash.sha256` | The sha256 of the memory region. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
+| `Ext.memory_region.malware_signature.all_names` | A sequence of signature names matched. | Windows.EICAR.Not-a-virus |
+| `Ext.memory_region.malware_signature.identifier` | malware signature identifier | None |
+| `Ext.memory_region.malware_signature.primary` | The first matching details. | None |
+| `Ext.memory_region.malware_signature.primary.matches` | The first matching details. | None |
+| `Ext.memory_region.malware_signature.primary.signature.hash` | hash of file matching signature. | None |
+| `Ext.memory_region.malware_signature.primary.signature.hash.sha256` | sha256 hash of file matching signature. | None |
+| `Ext.memory_region.malware_signature.primary.signature.id` | The id of the first yara rule matched. | None |
+| `Ext.memory_region.malware_signature.primary.signature.name` | The name of the first yara rule matched. | None |
+| `Ext.memory_region.malware_signature.secondary` | Additional matching details if available. | None |
+| `Ext.memory_region.malware_signature.secondary.matches` | The second matching details. | None |
+| `Ext.memory_region.malware_signature.secondary.signature.hash` | hash of second file matching signature. | None |
+| `Ext.memory_region.malware_signature.secondary.signature.hash.sha256` | sha256 hash of second file matching signature. | None |
+| `Ext.memory_region.malware_signature.secondary.signature.id` | The id of the second yara rule matched. | None |
+| `Ext.memory_region.malware_signature.secondary.signature.name` | The name of the second yara rule matched. | None |
+| `Ext.memory_region.malware_signature.version` | malware signature version | None |
+| `Ext.memory_region.mapped_path` | If the memory corresponds to a file mapping, this is the file's path. | C:\Windows\System32\mshtml.dll |
+| `Ext.memory_region.mapped_pe.Ext.dotnet` | Whether this file is a .NET PE | true |
+| `Ext.memory_region.mapped_pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
+| `Ext.memory_region.mapped_pe.Ext.sections.hash.md5` | MD5 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.sections.hash.sha1` | SHA1 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.sections.hash.sha384` | SHA384 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.sections.hash.sha512` | SHA512 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep` | SSDEEP hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh` | TLSH hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.sections.name` | The section's name | .reloc |
+| `Ext.memory_region.mapped_pe.Ext.streams` | The file's streams, if it is a PE | None |
+| `Ext.memory_region.mapped_pe.Ext.streams.hash.md5` | MD5 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.streams.hash.sha1` | SHA1 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.streams.hash.sha384` | SHA384 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.streams.hash.sha512` | SHA512 hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep` | SSDEEP hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh` | TLSH hash. | None |
+| `Ext.memory_region.mapped_pe.Ext.streams.name` | The stream's name | .reloc |
+| `Ext.memory_region.mapped_pe.architecture` | CPU architecture target for the file. | x64 |
+| `Ext.memory_region.mapped_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `Ext.memory_region.mapped_pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `Ext.memory_region.mapped_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `Ext.memory_region.mapped_pe.go_import_hash` | A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
+| `Ext.memory_region.mapped_pe.go_imports` | List of imported Go language element names and types. | None |
+| `Ext.memory_region.mapped_pe.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
+| `Ext.memory_region.mapped_pe.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
+| `Ext.memory_region.mapped_pe.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
+| `Ext.memory_region.mapped_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `Ext.memory_region.mapped_pe.import_hash` | A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+This is a synonym for imphash. | d41d8cd98f00b204e9800998ecf8427e |
+| `Ext.memory_region.mapped_pe.imports` | List of imported element names and types. | None |
+| `Ext.memory_region.mapped_pe.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
+| `Ext.memory_region.mapped_pe.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
+| `Ext.memory_region.mapped_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `Ext.memory_region.mapped_pe.pehash` | A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.
+Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. | 73ff189b63cd6be375a7ff25179a38d347651975 |
+| `Ext.memory_region.mapped_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `Ext.memory_region.mapped_pe.sections` | An array containing an object for each section of the PE file.
+The keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`. | None |
+| `Ext.memory_region.mapped_pe.sections.entropy` | Shannon entropy calculation from the section. | None |
+| `Ext.memory_region.mapped_pe.sections.name` | PE Section List name. | None |
+| `Ext.memory_region.mapped_pe.sections.physical_size` | PE Section List physical size. | None |
+| `Ext.memory_region.mapped_pe.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
+| `Ext.memory_region.mapped_pe.sections.virtual_size` | PE Section List virtual size. This is always the same as `physical_size`. | None |
+| `Ext.memory_region.mapped_pe_detected` | Whether the file at mapped_path is an executable. | False |
+| `Ext.memory_region.memory_pe.Ext.dotnet` | Whether this file is a .NET PE | true |
+| `Ext.memory_region.memory_pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
+| `Ext.memory_region.memory_pe.Ext.sections.hash.md5` | MD5 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.sections.hash.sha1` | SHA1 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.sections.hash.sha384` | SHA384 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.sections.hash.sha512` | SHA512 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep` | SSDEEP hash. | None |
+| `Ext.memory_region.memory_pe.Ext.sections.hash.tlsh` | TLSH hash. | None |
+| `Ext.memory_region.memory_pe.Ext.sections.name` | The section's name | .reloc |
+| `Ext.memory_region.memory_pe.Ext.streams` | The file's streams, if it is a PE | None |
+| `Ext.memory_region.memory_pe.Ext.streams.hash.md5` | MD5 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.streams.hash.sha1` | SHA1 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.streams.hash.sha384` | SHA384 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.streams.hash.sha512` | SHA512 hash. | None |
+| `Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep` | SSDEEP hash. | None |
+| `Ext.memory_region.memory_pe.Ext.streams.hash.tlsh` | TLSH hash. | None |
+| `Ext.memory_region.memory_pe.Ext.streams.name` | The stream's name | .reloc |
+| `Ext.memory_region.memory_pe.architecture` | CPU architecture target for the file. | x64 |
+| `Ext.memory_region.memory_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `Ext.memory_region.memory_pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `Ext.memory_region.memory_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `Ext.memory_region.memory_pe.go_import_hash` | A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
+| `Ext.memory_region.memory_pe.go_imports` | List of imported Go language element names and types. | None |
+| `Ext.memory_region.memory_pe.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
+| `Ext.memory_region.memory_pe.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
+| `Ext.memory_region.memory_pe.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
+| `Ext.memory_region.memory_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `Ext.memory_region.memory_pe.import_hash` | A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+This is a synonym for imphash. | d41d8cd98f00b204e9800998ecf8427e |
+| `Ext.memory_region.memory_pe.imports` | List of imported element names and types. | None |
+| `Ext.memory_region.memory_pe.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
+| `Ext.memory_region.memory_pe.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
+| `Ext.memory_region.memory_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `Ext.memory_region.memory_pe.pehash` | A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.
+Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. | 73ff189b63cd6be375a7ff25179a38d347651975 |
+| `Ext.memory_region.memory_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `Ext.memory_region.memory_pe.sections` | An array containing an object for each section of the PE file.
+The keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`. | None |
+| `Ext.memory_region.memory_pe.sections.entropy` | Shannon entropy calculation from the section. | None |
+| `Ext.memory_region.memory_pe.sections.name` | PE Section List name. | None |
+| `Ext.memory_region.memory_pe.sections.physical_size` | PE Section List physical size. | None |
+| `Ext.memory_region.memory_pe.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
+| `Ext.memory_region.memory_pe.sections.virtual_size` | PE Section List virtual size. This is always the same as `physical_size`. | None |
+| `Ext.memory_region.memory_pe_detected` | Whether an executable file was found in memory. | False |
+| `Ext.memory_region.region_base` | Base address of the memory region. | 2431737462784 |
+| `Ext.memory_region.region_protection` | Memory protection of the memory region. Example values include "RWX" and "R-X". | RWX |
+| `Ext.memory_region.region_size` | Size of the memory region. | 4096 |
+| `Ext.memory_region.region_start_bytes` | First 64 bytes at the region base address. | 4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000 |
+| `Ext.memory_region.region_state` | State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE". | COMMIT |
+| `Ext.memory_region.strings` | Array of strings found within the memory region. | None |
+| `Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
+| `Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `pid` | Process id. | 4242 |
+| `thread.Ext` | Object for all custom defined fields to live in. | None |
+| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
+| `thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
+| `thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
+| `thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
+| `thread.Ext.call_stack.instruction_pointer` | The return address of this stack frame. | None |
+| `thread.Ext.call_stack.module_path` | The path to the DLL/module containing `instruction_pointer`. | None |
+| `thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
+| `thread.Ext.call_stack.protection_provenance` | The name of the memory region that last modified the protection of this page.  "Unbacked" can indicate shellcode. | None |
+| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
+| `thread.Ext.call_stack_contains_unbacked` | Indicates whether the creating thread's stack contains frames pointing outside any known executable image. | None |
+| `thread.Ext.call_stack_final_hook_module` | The module that installed the final API hook in the call stack. | None |
+| `thread.Ext.call_stack_final_hook_module.code_signature` | Code signature of the call_stack_final_hook_module. | None |
+| `thread.Ext.call_stack_final_hook_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `thread.Ext.call_stack_final_hook_module.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `thread.Ext.call_stack_final_hook_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `thread.Ext.call_stack_final_hook_module.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `thread.Ext.call_stack_final_hook_module.hash` | Hashes of the call_stack_final_hook_module. | None |
+| `thread.Ext.call_stack_final_hook_module.hash.sha256` | The sha256 of the call_stack_final_hook_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
+| `thread.Ext.call_stack_final_hook_module.path` | The file path of the call_stack_final_hook_module. | C:\Program Files\Example\example.dll |
+| `thread.Ext.call_stack_final_user_module` | The final non-win32 module in the call stack. | None |
+| `thread.Ext.call_stack_final_user_module.allocation_private_bytes` | The number of bytes in this memory region that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
+| `thread.Ext.call_stack_final_user_module.code_signature` | Code signature of the call_stack_final_user_module. | None |
+| `thread.Ext.call_stack_final_user_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `thread.Ext.call_stack_final_user_module.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `thread.Ext.call_stack_final_user_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `thread.Ext.call_stack_final_user_module.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `thread.Ext.call_stack_final_user_module.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `thread.Ext.call_stack_final_user_module.hash` | Hashes of the call_stack_final_user_module. | None |
+| `thread.Ext.call_stack_final_user_module.hash.sha256` | The sha256 of the call_stack_final_user_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
+| `thread.Ext.call_stack_final_user_module.name` | The file name of the call_stack_final_user_module. | example.dll |
+| `thread.Ext.call_stack_final_user_module.path` | The file path of the call_stack_final_user_module. | C:\Program Files\Example\example.dll |
+| `thread.Ext.call_stack_final_user_module.protection` | The memory protection for the acting region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | RWX |
+| `thread.Ext.call_stack_final_user_module.protection_provenance` | The name of the memory region that caused the last modification of the protection of this page. "Unbacked" may indicate shellcode. | third_party_hook.dll |
+| `thread.Ext.call_stack_final_user_module.protection_provenance_path` | The path of the module that caused the last modification the protection of this page. | C:\Program Files\Hook Inc\third_party_hook.dll |
+| `thread.Ext.call_stack_final_user_module.reason` | The unexpected call_stack_summary that led to an "Undetermined" protection_provenance. | ntdll.dll|kernelbase.dll |
+| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
+| `thread.id` | Thread ID. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -148,12 +691,21 @@ Needs example
 ```
 <hr>
 
-### `user`
+## `user`
 
-#### Description
+### Description
 The user fields describe information about the user that is relevant to the event.
 Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `name` | Short name or login of the user. | a.einstein |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/collection.md b/scripts/generate-docs/output/collection.md
index 0a1e47c2d..51a5b1aea 100644
--- a/scripts/generate-docs/output/collection.md
+++ b/scripts/generate-docs/output/collection.md
@@ -1,26 +1,30 @@
 [Back to index](README.md)
 
-# collection
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -28,11 +32,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -40,12 +49,54 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/file.md b/scripts/generate-docs/output/file.md
index f2c501a24..e143a9d16 100644
--- a/scripts/generate-docs/output/file.md
+++ b/scripts/generate-docs/output/file.md
@@ -1,42 +1,47 @@
 [Back to index](README.md)
 
-# file
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `Effective_process`
+## `Effective_process`
 
-#### Description
+### Description
 These fields contain information about an effective process.
 The effective process is the process that requested the a specific action, without directly performing it.
 Processes can have effective parents that differ from their regular parents. For example, on Windows, "wmic process call create notepad" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.
 Events can have effective processes that differ from their regular processes. For example, on Windows, "reg add \\localhost\HKLM\Software\Foo /v Data /t REG_SZ /d 123"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `entity_id` | Unique identifier for the effective process. | c2c455d9f99375d |
+| `executable` | Executable name for the effective process. | C:\Windows\System32\wbem\WMIC.exe |
+| `name` | Process name for the effective process. | WMIC.exe |
+| `pid` | Process ID. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -44,11 +49,20 @@ Needs example
 ```
 <hr>
 
-### `Persistence`
+## `Persistence`
 
-#### Description
+### Description
 These fields contain information about a Persistence event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `args` | Arguments used to execute the persistence item | None |
+| `executable` | The persistence item's executable | None |
+| `keepalive` | Keep alive option boolean | None |
+| `name` | The persistence item's name | None |
+| `path` | The file's path | None |
+| `runatload` | Run at load option boolean | None |
+### Example
 
 ```json
 Needs example
@@ -56,12 +70,20 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -69,11 +91,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -81,12 +109,29 @@ Needs example
 ```
 <hr>
 
-### `destination`
+## `destination`
 
-#### Description
+### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -94,11 +139,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -106,12 +156,57 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.correlation` | Information about event this should be correlated with. | None |
+| `Ext.correlation.id` | ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event | None |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -119,12 +214,94 @@ Needs example
 ```
 <hr>
 
-### `file`
+## `file`
 
-#### Description
+### Description
 A file is defined as a set of information that has been created on, or has existed on a filesystem.
 File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
+| `Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
+| `Ext.device.file_system_type` | Volume device file system type.
+Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
+| `Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
+| `Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
+| `Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
+| `Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
+| `Ext.device.volume_device_type` | Volume device type.
+Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
+| `Ext.entropy` | Entropy calculation of file's header and footer used to check file integrity. | None |
+| `Ext.header_bytes` | First 16 bytes of file used to check file integrity. | None |
+| `Ext.header_data` | First 16 bytes of file used to check file integrity. | None |
+| `Ext.malware_signature` | Nested version of malware_signature fieldset. | None |
+| `Ext.malware_signature.all_names` | The concatenated names of all yara signatures | None |
+| `Ext.malware_signature.identifier` | Malware artifact identifier. | None |
+| `Ext.malware_signature.primary` | Primary malware signature match. | None |
+| `Ext.malware_signature.primary.matches` | An array of bytes representing yara signature matches | None |
+| `Ext.malware_signature.primary.signature` | Primary malware signature match. | None |
+| `Ext.malware_signature.primary.signature.hash` | Primary malware signature hash. | None |
+| `Ext.malware_signature.primary.signature.hash.sha256` | Primary malware signature sha256. | None |
+| `Ext.malware_signature.primary.signature.id` | Primary malware signature id. | None |
+| `Ext.malware_signature.primary.signature.name` | Primary malware signature name. | None |
+| `Ext.malware_signature.secondary` | An array of malware signature matches | None |
+| `Ext.malware_signature.version` | Primary malware signature version. | None |
+| `Ext.monotonic_id` | File event monotonic ID. | None |
+| `Ext.original` | Original file information during a modification event. | None |
+| `Ext.original.extension` | Original file extension prior to a modification event | None |
+| `Ext.original.gid` | Primary group ID (GID) of the file. | 1001 |
+| `Ext.original.group` | Primary group name of the file. | alice |
+| `Ext.original.mode` | Original file mode prior to a modification event | None |
+| `Ext.original.name` | Original file name prior to a modification event | None |
+| `Ext.original.owner` | File owner's username. | alice |
+| `Ext.original.path` | Original file path prior to a modification event | None |
+| `Ext.original.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
+| `Ext.windows` | Platform-specific Windows fields | None |
+| `Ext.windows.zone_identifier` | Windows zone identifier for a file | None |
+| `accessed` | Last time the file was accessed.
+Note that not all filesystems keep track of access time. | None |
+| `attributes` | Array of file attributes.
+Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | ["readonly", "system"] |
+| `created` | File creation time.
+Note that not all filesystems store the creation time. | None |
+| `ctime` | Last time the file attributes or metadata changed.
+Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | None |
+| `device` | Device that is the source of the file. | sda |
+| `directory` | Directory where the file is located. It should include the drive letter, when appropriate. | /home/alice |
+| `drive_letter` | Drive letter where the file is located. This field is only relevant on Windows.
+The value should be uppercase, and not include the colon. | C |
+| `extension` | File extension, excluding the leading dot.
+Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
+| `gid` | Primary group ID (GID) of the file. | 1001 |
+| `group` | Primary group name of the file. | alice |
+| `hash.md5` | MD5 hash. | None |
+| `hash.sha1` | SHA1 hash. | None |
+| `hash.sha256` | SHA256 hash. | None |
+| `hash.sha512` | SHA512 hash. | None |
+| `inode` | Inode representing the file in the filesystem. | 256383 |
+| `mime_type` | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | None |
+| `mode` | Mode of the file in octal representation. | 0640 |
+| `mtime` | Last time the file content was modified. | None |
+| `name` | Name of the file including the extension, without the directory. | example.png |
+| `origin_referrer_url` | The url of the webpage that linked to the file. | None |
+| `origin_url` | The url where the file is hosted. | None |
+| `owner` | File owner's username. | alice |
+| `path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
+| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `size` | File size in bytes.
+Only relevant when `file.type` is "file". | 16384 |
+| `target_path` | Target path for symlinks. | None |
+| `type` | File type (file, dir, or symlink). | file |
+| `uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
+### Example
 
 ```json
 Needs example
@@ -132,11 +309,21 @@ Needs example
 ```
 <hr>
 
-### `group`
+## `group`
 
-#### Description
+### Description
 The group fields are meant to represent groups that are relevant to the event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | Group info prior to any setgid operations. | None |
+| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `Ext.real.name` | Name of the group. | None |
+| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `id` | Unique identifier for the group on the system/platform. | None |
+| `name` | Name of the group. | None |
+### Example
 
 ```json
 Needs example
@@ -144,12 +331,41 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+### Example
 
 ```json
 Needs example
@@ -157,12 +373,77 @@ Needs example
 ```
 <hr>
 
-### `process`
+## `process`
 
-#### Description
+### Description
 These fields contain information about a process.
 These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `group_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `parent.group_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `parent.pid` | Process id. | 4242 |
+| `pid` | Process id. | 4242 |
+| `ppid` | Parent process' pid. | 4241 |
+| `session_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `thread.Ext` | Object for all custom defined fields to live in. | None |
+| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
+| `thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
+| `thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
+| `thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
+| `thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
+| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
+| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
+| `thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
+| `thread.id` | Thread ID. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -170,12 +451,29 @@ Needs example
 ```
 <hr>
 
-### `source`
+## `source`
 
-#### Description
+### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -183,12 +481,34 @@ Needs example
 ```
 <hr>
 
-### `user`
+## `user`
 
-#### Description
+### Description
 The user fields describe information about the user that is relevant to the event.
 Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | User info prior to any setuid operations. | None |
+| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
+| `Ext.real.name` | Short name or login of the user. | None |
+| `domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `email` | User email address. | None |
+| `full_name` | User's full name, if available. | Albert Einstein |
+| `group.Ext` | Object for all custom defined fields to live in. | None |
+| `group.Ext.real` | Group info prior to any setgid operations. | None |
+| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `group.Ext.real.name` | Name of the group. | None |
+| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `group.id` | Unique identifier for the group on the system/platform. | None |
+| `group.name` | Name of the group. | None |
+| `hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `name` | Short name or login of the user. | a.einstein |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/heartbeat.md b/scripts/generate-docs/output/heartbeat.md
index 0ee42aaf0..77f5375af 100644
--- a/scripts/generate-docs/output/heartbeat.md
+++ b/scripts/generate-docs/output/heartbeat.md
@@ -1,26 +1,24 @@
 [Back to index](README.md)
 
-# heartbeat
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `billable`
+## `billable`
 
-#### Description
+### Description
 Whether document should be included in billing calculations
-#### Example
+### Example
 
 ```json
 Needs example
@@ -28,25 +26,30 @@ Needs example
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+### Example
 
 ```json
 Needs example
@@ -54,11 +57,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -66,12 +75,18 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/library.md b/scripts/generate-docs/output/library.md
index 32d553e6c..a7856e7cb 100644
--- a/scripts/generate-docs/output/library.md
+++ b/scripts/generate-docs/output/library.md
@@ -1,42 +1,47 @@
 [Back to index](README.md)
 
-# library
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `Effective_process`
+## `Effective_process`
 
-#### Description
+### Description
 These fields contain information about an effective process.
 The effective process is the process that requested the a specific action, without directly performing it.
 Processes can have effective parents that differ from their regular parents. For example, on Windows, "wmic process call create notepad" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.
 Events can have effective processes that differ from their regular processes. For example, on Windows, "reg add \\localhost\HKLM\Software\Foo /v Data /t REG_SZ /d 123"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `entity_id` | Unique identifier for the effective process. | c2c455d9f99375d |
+| `executable` | Executable name for the effective process. | C:\Windows\System32\wbem\WMIC.exe |
+| `name` | Process name for the effective process. | WMIC.exe |
+| `pid` | Process ID. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -44,12 +49,20 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -57,11 +70,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -69,12 +88,29 @@ Needs example
 ```
 <hr>
 
-### `destination`
+## `destination`
 
-#### Description
+### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -82,16 +118,71 @@ Needs example
 ```
 <hr>
 
-### `dll`
+## `dll`
 
-#### Description
+### Description
 These fields contain information about code libraries dynamically loaded into processes.
 
 Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
 * Dynamic-link library (`.dll`) commonly used on Windows
 * Shared Object (`.so`) commonly used on Unix-like operating systems
 * Dynamic library (`.dylib`) commonly used on macOS
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `Ext.defense_evasions` | List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump. | None |
+| `Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
+| `Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
+| `Ext.device.file_system_type` | Volume device file system type.
+Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
+| `Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
+| `Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
+| `Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
+| `Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
+| `Ext.device.volume_device_type` | Volume device type.
+Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
+| `Ext.load_index` | A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.
+The first load index is 1. | None |
+| `Ext.relative_file_creation_time` | Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future. | None |
+| `Ext.relative_file_name_modify_time` | Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future. | None |
+| `Ext.size` | Size of DLL | None |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `hash.md5` | MD5 hash. | None |
+| `hash.sha1` | SHA1 hash. | None |
+| `hash.sha256` | SHA256 hash. | None |
+| `hash.sha512` | SHA512 hash. | None |
+| `name` | Name of the library.
+This generally maps to the name of the file on disk. | kernel32.dll |
+| `path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
+| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+### Example
 
 ```json
 Needs example
@@ -99,11 +190,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -111,12 +207,54 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -124,12 +262,50 @@ Needs example
 ```
 <hr>
 
-### `file`
+## `file`
 
-#### Description
+### Description
 A file is defined as a set of information that has been created on, or has existed on a filesystem.
 File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `hash.md5` | MD5 hash. | None |
+| `hash.sha1` | SHA1 hash. | None |
+| `hash.sha256` | SHA256 hash. | None |
+| `hash.sha512` | SHA512 hash. | None |
+| `name` | Name of the file including the extension, without the directory. | example.png |
+| `path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
+| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+### Example
 
 ```json
 Needs example
@@ -137,11 +313,21 @@ Needs example
 ```
 <hr>
 
-### `group`
+## `group`
 
-#### Description
+### Description
 The group fields are meant to represent groups that are relevant to the event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | Group info prior to any setgid operations. | None |
+| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `Ext.real.name` | Name of the group. | None |
+| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `id` | Unique identifier for the group on the system/platform. | None |
+| `name` | Name of the group. | None |
+### Example
 
 ```json
 Needs example
@@ -149,12 +335,41 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+### Example
 
 ```json
 Needs example
@@ -162,12 +377,56 @@ Needs example
 ```
 <hr>
 
-### `process`
+## `process`
 
-#### Description
+### Description
 These fields contain information about a process.
 These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `pid` | Process id. | 4242 |
+| `thread.Ext` | Object for all custom defined fields to live in. | None |
+| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
+| `thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
+| `thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
+| `thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
+| `thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
+| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
+| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
+| `thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
+| `thread.id` | Thread ID. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -175,12 +434,29 @@ Needs example
 ```
 <hr>
 
-### `source`
+## `source`
 
-#### Description
+### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -188,12 +464,34 @@ Needs example
 ```
 <hr>
 
-### `user`
+## `user`
 
-#### Description
+### Description
 The user fields describe information about the user that is relevant to the event.
 Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | User info prior to any setuid operations. | None |
+| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
+| `Ext.real.name` | Short name or login of the user. | None |
+| `domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `email` | User email address. | None |
+| `full_name` | User's full name, if available. | Albert Einstein |
+| `group.Ext` | Object for all custom defined fields to live in. | None |
+| `group.Ext.real` | Group info prior to any setgid operations. | None |
+| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `group.Ext.real.name` | Name of the group. | None |
+| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `group.id` | Unique identifier for the group on the system/platform. | None |
+| `group.name` | Name of the group. | None |
+| `hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `name` | Short name or login of the user. | a.einstein |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/metadata.md b/scripts/generate-docs/output/metadata.md
index 79850c5b5..96fef6271 100644
--- a/scripts/generate-docs/output/metadata.md
+++ b/scripts/generate-docs/output/metadata.md
@@ -1,26 +1,38 @@
 [Back to index](README.md)
 
-# metadata
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `Endpoint`
+## `Endpoint`
 
-#### Description
+### Description
 Fields describing the state of the Elastic Endpoint when an event occurs.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `capabilities` | Enabled capabilities | None |
+| `configuration` | Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state | None |
+| `configuration.isolation` | Configuration setting for Host Isolation from the network | None |
+| `policy` | The policy fields are used to hold information about applied policy. | None |
+| `policy.applied` | information about the policy that is applied | None |
+| `policy.applied.id` | the id of the applied policy | None |
+| `policy.applied.name` | the name of this applied policy | None |
+| `policy.applied.status` | the status of the applied policy | None |
+| `state` | Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration) | None |
+| `state.isolation` | Current network isolation state of the host | None |
+| `status` | The current status of the endpoint e.g. enrolled, unenrolled. | None |
+### Example
 
 ```json
 Needs example
@@ -28,12 +40,22 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `name` | Custom name of the agent.
+This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | foo |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -41,11 +63,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -53,11 +81,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -65,11 +98,16 @@ Needs example
 ```
 <hr>
 
-### `elastic`
+## `elastic`
 
-#### Description
+### Description
 Holds fields and properties of data points and concepts in the elastic domain or namespace.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `agent` | The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host. | None |
+| `agent.id` | Unique identifier of this elastic agent (if one exists). | c2a9093e-e289-4c0a-aa44-8c32a414fa7a |
+### Example
 
 ```json
 Needs example
@@ -77,12 +115,54 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -90,12 +170,41 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/metrics.md b/scripts/generate-docs/output/metrics.md
index 7d5cb2b8a..572e09c92 100644
--- a/scripts/generate-docs/output/metrics.md
+++ b/scripts/generate-docs/output/metrics.md
@@ -1,39 +1,157 @@
 [Back to index](README.md)
 
-# metrics
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `Endpoint`
+## `Endpoint`
 
-#### Description
+### Description
 Fields describing the state of the Elastic Endpoint when an event occurs.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `metrics` | Metrics fields hold the endpoint and system's performance metrics | None |
+| `metrics.cpu` | CPU statistics | None |
+| `metrics.cpu.endpoint` | CPU metrics for the endpoint | None |
+| `metrics.cpu.endpoint.histogram` | This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket | None |
+| `metrics.cpu.endpoint.latest` | Average CPU over the last sample interval | None |
+| `metrics.cpu.endpoint.mean` | Average CPU load used by the endpoint | None |
+| `metrics.disks` | An array of disk information for the host | None |
+| `metrics.disks.device` | Device name | None |
+| `metrics.disks.endpoint_drive` | This field will be present and set to true only for the drive that holds the installed endpoint | None |
+| `metrics.disks.free` | The number of bytes marked as free on the disk | None |
+| `metrics.disks.fstype` | The file system type for the drive | None |
+| `metrics.disks.mount` | The disks mount location | None |
+| `metrics.disks.total` | The size of the disk in bytes | None |
+| `metrics.documents_volume` | Statistics about sent documents | None |
+| `metrics.documents_volume.alerts.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.alerts.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.alerts.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.alerts.suppressed_count` | Number of suppressed documents | None |
+| `metrics.documents_volume.api_events.sent_bytes` | Total size of API Event sent documents | None |
+| `metrics.documents_volume.api_events.sent_count` | Number of sent API Event documents | None |
+| `metrics.documents_volume.api_events.sources` | An array of API Event document statistics per source | None |
+| `metrics.documents_volume.api_events.sources.sent_bytes` | Total size of API Event sent documents from source | None |
+| `metrics.documents_volume.api_events.sources.sent_count` | Number of sent API Event documents from source | None |
+| `metrics.documents_volume.api_events.sources.source` | API Event document source name | None |
+| `metrics.documents_volume.api_events.sources.suppressed_bytes` | Total size of suppressed API Event documents from source | None |
+| `metrics.documents_volume.api_events.sources.suppressed_count` | Number of suppressed API Event documents from source | None |
+| `metrics.documents_volume.api_events.suppressed_bytes` | Total size of suppressed API Event documents | None |
+| `metrics.documents_volume.api_events.suppressed_count` | Number of suppressed API Event documents | None |
+| `metrics.documents_volume.diagnostic_alerts.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.diagnostic_alerts.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.diagnostic_alerts.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.diagnostic_alerts.suppressed_count` | Number of suppressed documents | None |
+| `metrics.documents_volume.dns_events.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.dns_events.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.dns_events.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.dns_events.suppressed_count` | Number of suppressed documents | None |
+| `metrics.documents_volume.file_events.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.file_events.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.file_events.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.file_events.suppressed_count` | Number of suppressed documents | None |
+| `metrics.documents_volume.library_events.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.library_events.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.library_events.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.library_events.suppressed_count` | Number of suppressed documents | None |
+| `metrics.documents_volume.network_events.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.network_events.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.network_events.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.network_events.suppressed_count` | Number of suppressed documents | None |
+| `metrics.documents_volume.overall.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.overall.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.overall.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.overall.suppressed_count` | Number of suppressed documents | None |
+| `metrics.documents_volume.process_events.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.process_events.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.process_events.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.process_events.suppressed_count` | Number of suppressed documents | None |
+| `metrics.documents_volume.registry_events.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.registry_events.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.registry_events.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.registry_events.suppressed_count` | Number of suppressed documents | None |
+| `metrics.documents_volume.security_events.sent_bytes` | Total size of sent documents | None |
+| `metrics.documents_volume.security_events.sent_count` | Number of sent documents | None |
+| `metrics.documents_volume.security_events.suppressed_bytes` | Total size of suppressed documents | None |
+| `metrics.documents_volume.security_events.suppressed_count` | Number of suppressed documents | None |
+| `metrics.event_filter.active_global_count` | The number of active global event filters | None |
+| `metrics.event_filter.active_user_count` | The number of active user event filters | None |
+| `metrics.malicious_behavior_rules` | An array of performance information about each malicious behavior rule | None |
+| `metrics.malicious_behavior_rules.endpoint_uptime_percent` | Perfect of Endpoint's update spent running the rule | None |
+| `metrics.malicious_behavior_rules.id` | The rule id | None |
+| `metrics.memory` | Memory statistics | None |
+| `metrics.memory.endpoint` | Endpoint memory utilization | None |
+| `metrics.memory.endpoint.private` | The memory private to the endpoint | None |
+| `metrics.memory.endpoint.private.latest` | The memory usage by the endpoint for the last sample interval | None |
+| `metrics.memory.endpoint.private.mean` | Average memory usage by the endpoint since its start | None |
+| `metrics.system_impact` | An array of system impact information | None |
+| `metrics.system_impact.authentication_events.week_idle_ms` | The total milliseconds spent queueing authentication events for the process over the last week | None |
+| `metrics.system_impact.authentication_events.week_ms` | The total milliseconds spent on authentication events for the process over the last week | None |
+| `metrics.system_impact.dns_events.week_idle_ms` | The total milliseconds spent queueing DNS events for the process over the last week | None |
+| `metrics.system_impact.dns_events.week_ms` | The total milliseconds spent on DNS events for the process over the last week | None |
+| `metrics.system_impact.file_events.week_idle_ms` | The total milliseconds spent queueing file events for the process over the last week | None |
+| `metrics.system_impact.file_events.week_ms` | The total milliseconds spent on file events for the process over the last week | None |
+| `metrics.system_impact.library_load_events.week_idle_ms` | The total milliseconds spent queueing library load events for the process over the last week | None |
+| `metrics.system_impact.library_load_events.week_ms` | The total milliseconds spent on library load events for the process over the last week | None |
+| `metrics.system_impact.malware.week_idle_ms` | The total milliseconds spent queueing malware scanning due to the process over the last week | None |
+| `metrics.system_impact.malware.week_ms` | The total milliseconds spent on malware scanning due to the process over the last week | None |
+| `metrics.system_impact.network_events.week_idle_ms` | The total milliseconds spent queueing network events for the process over the last week | None |
+| `metrics.system_impact.network_events.week_ms` | The total milliseconds spent on network events for the process over the last week | None |
+| `metrics.system_impact.overall.week_idle_ms` | The total milliseconds spent queueing activity for the process over the last week | None |
+| `metrics.system_impact.overall.week_ms` | The total milliseconds spent monitoring the process over the last week | None |
+| `metrics.system_impact.process.code_signature` | Code signature of the process | None |
+| `metrics.system_impact.process.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `metrics.system_impact.process.code_signature.signing_id` | 'The identifier used to sign the binary.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.' | com.apple.xpc.proxy |
+| `metrics.system_impact.process.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `metrics.system_impact.process.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `metrics.system_impact.process.code_signature.team_id` | 'The team identifier used to sign the binary.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.' | EQHXZ8M8AV |
+| `metrics.system_impact.process.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `metrics.system_impact.process.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `metrics.system_impact.process.executable` | Path to the process executable for the impact entry | None |
+| `metrics.system_impact.process_events.week_idle_ms` | The total milliseconds spent queueing process events for the process over the last week | None |
+| `metrics.system_impact.process_events.week_ms` | The total milliseconds spent on process events for the process over the last week | None |
+| `metrics.system_impact.registry_events.week_idle_ms` | The total milliseconds spent queueing registry events for the process over the last week | None |
+| `metrics.system_impact.registry_events.week_ms` | The total milliseconds spent on registry events for the process over the last week | None |
+| `metrics.system_impact.threat_intelligence_events.week_idle_ms` | The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week | None |
+| `metrics.system_impact.threat_intelligence_events.week_ms` | The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week | None |
+| `metrics.system_impact.win32k_events.week_idle_ms` | The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week | None |
+| `metrics.system_impact.win32k_events.week_ms` | The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week | None |
+| `metrics.threads` | Statistics about the individual Endpoint threads (array) | None |
+| `metrics.threads.cpu.mean` | The thread's average CPU use | None |
+| `metrics.threads.name` | The thread name | None |
+| `metrics.uptime` | Number of seconds since boot | None |
+| `metrics.uptime.endpoint` | Number of seconds since the endpoint was started | None |
+| `metrics.uptime.system` | Number of seconds since the system was started | None |
+### Example
 
 ```json
 Needs example
@@ -41,12 +159,20 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -54,11 +180,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -66,11 +198,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -78,12 +215,56 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `end` | `event.end` contains the date when the event ended or when the activity was last observed. | None |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `start` | `event.start` contains the date when the event started or when the activity was first observed. | None |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -91,12 +272,41 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/network.md b/scripts/generate-docs/output/network.md
index 355901e2f..b5f35ce1e 100644
--- a/scripts/generate-docs/output/network.md
+++ b/scripts/generate-docs/output/network.md
@@ -1,40 +1,46 @@
 [Back to index](README.md)
 
-# network
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -42,11 +48,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -54,12 +66,44 @@ Needs example
 ```
 <hr>
 
-### `destination`
+## `destination`
 
-#### Description
+### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `address` | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.
+Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | None |
+| `as.number` | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | 15169 |
+| `as.organization.name` | Organization name. | Google LLC |
+| `bytes` | Bytes sent from the destination to the source. | 184 |
+| `domain` | The domain name of the destination system.
+This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | foo.example.com |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+| `ip` | IP address of the destination (IPv4 or IPv6). | None |
+| `packets` | Packets sent from the destination to the source. | 12 |
+| `port` | Port of the destination. | None |
+| `registered_domain` | The highest registered destination domain, stripped of the subdomain.
+For example, the registered domain for "foo.example.com" is "example.com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
+| `top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
+### Example
 
 ```json
 Needs example
@@ -67,12 +111,30 @@ Needs example
 ```
 <hr>
 
-### `dns`
+## `dns`
 
-#### Description
+### Description
 Fields describing DNS queries and answers.
 DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.options` | DNS options field, uint64, representing as a keyword to avoid overflows in ES | None |
+| `Ext.status` | DNS status field, uint32 | None |
+| `question.name` | The name being queried.
+If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | www.example.com |
+| `question.registered_domain` | The highest registered domain, stripped of the subdomain.
+For example, the registered domain for "foo.example.com" is "example.com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
+| `question.subdomain` | The subdomain is all of the labels under the registered_domain.
+If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | www |
+| `question.top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
+| `question.type` | The type of record being queried. | AAAA |
+| `resolved_ip` | Array containing all IPs seen in `answers.data`.
+The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. | ["10.10.10.10", "10.10.10.11"] |
+### Example
 
 ```json
 Needs example
@@ -80,11 +142,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -92,12 +159,54 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -105,11 +214,21 @@ Needs example
 ```
 <hr>
 
-### `group`
+## `group`
 
-#### Description
+### Description
 The group fields are meant to represent groups that are relevant to the event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | Group info prior to any setgid operations. | None |
+| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `Ext.real.name` | Name of the group. | None |
+| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `id` | Unique identifier for the group on the system/platform. | None |
+| `name` | Name of the group. | None |
+### Example
 
 ```json
 Needs example
@@ -117,12 +236,41 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+### Example
 
 ```json
 Needs example
@@ -130,11 +278,23 @@ Needs example
 ```
 <hr>
 
-### `http`
+## `http`
 
-#### Description
+### Description
 Fields related to HTTP activity. Use the `url` field set to store the url of the request.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `request.body.bytes` | Size in bytes of the request body. | 887 |
+| `request.body.content` | The full HTTP request body. | Hello world |
+| `request.bytes` | Total size in bytes of the request (body and headers). | 1437 |
+| `response.Ext` | Object for all custom defined fields to live in. | None |
+| `response.Ext.version` | HTTP version | None |
+| `response.body.bytes` | Size in bytes of the response body. | 887 |
+| `response.body.content` | The full HTTP response body. | Hello world |
+| `response.bytes` | Total size in bytes of the response (body and headers). | 1437 |
+| `response.status_code` | HTTP response status code. | 404 |
+### Example
 
 ```json
 Needs example
@@ -142,12 +302,32 @@ Needs example
 ```
 <hr>
 
-### `network`
+## `network`
 
-#### Description
+### Description
 The network is defined as the communication path over which a host or network event happens.
 The network.* fields should be populated with details about the network activity associated with an event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `bytes` | Total bytes transferred in both directions.
+If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | 368 |
+| `community_id` | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.
+Learn more at https://github.com/corelight/community-id-spec. | 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0= |
+| `direction` | Direction of the network traffic.
+When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".
+When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".
+Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | inbound |
+| `iana_number` | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | 6 |
+| `packets` | Total packets transferred in both directions.
+If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | 24 |
+| `protocol` | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.
+The field value must be normalized to lowercase for querying. | http |
+| `transport` | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
+The field value must be normalized to lowercase for querying. | tcp |
+| `type` | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
+The field value must be normalized to lowercase for querying. | ipv4 |
+### Example
 
 ```json
 Needs example
@@ -155,12 +335,64 @@ Needs example
 ```
 <hr>
 
-### `process`
+## `process`
 
-#### Description
+### Description
 These fields contain information about a process.
 These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `group_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `parent.group_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `pid` | Process id. | 4242 |
+| `session_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `thread.id` | Thread ID. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -168,12 +400,44 @@ Needs example
 ```
 <hr>
 
-### `source`
+## `source`
 
-#### Description
+### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `address` | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.
+Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | None |
+| `as.number` | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | 15169 |
+| `as.organization.name` | Organization name. | Google LLC |
+| `bytes` | Bytes sent from the source to the destination. | 184 |
+| `domain` | The domain name of the source system.
+This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | foo.example.com |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+| `ip` | IP address of the source (IPv4 or IPv6). | None |
+| `packets` | Packets sent from the source to the destination. | 12 |
+| `port` | Port of the source. | None |
+| `registered_domain` | The highest registered source domain, stripped of the subdomain.
+For example, the registered domain for "foo.example.com" is "example.com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
+| `top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
+This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
+### Example
 
 ```json
 Needs example
@@ -181,12 +445,34 @@ Needs example
 ```
 <hr>
 
-### `user`
+## `user`
 
-#### Description
+### Description
 The user fields describe information about the user that is relevant to the event.
 Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | User info prior to any setuid operations. | None |
+| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
+| `Ext.real.name` | Short name or login of the user. | None |
+| `domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `email` | User email address. | None |
+| `full_name` | User's full name, if available. | Albert Einstein |
+| `group.Ext` | Object for all custom defined fields to live in. | None |
+| `group.Ext.real` | Group info prior to any setgid operations. | None |
+| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `group.Ext.real.name` | Name of the group. | None |
+| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `group.id` | Unique identifier for the group on the system/platform. | None |
+| `group.name` | Name of the group. | None |
+| `hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `name` | Short name or login of the user. | a.einstein |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/policy.md b/scripts/generate-docs/output/policy.md
index c95d7f197..59e713971 100644
--- a/scripts/generate-docs/output/policy.md
+++ b/scripts/generate-docs/output/policy.md
@@ -1,39 +1,110 @@
 [Back to index](README.md)
 
-# policy
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `Endpoint`
+## `Endpoint`
 
-#### Description
+### Description
 Fields describing the state of the Elastic Endpoint when an event occurs.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `configuration` | Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state | None |
+| `configuration.isolation` | Configuration setting for Host Isolation from the network | None |
+| `policy` | The policy fields are used to hold information about applied policy. | None |
+| `policy.applied` | information about the policy that is applied | None |
+| `policy.applied.actions` | actions applied during the application of the policy | None |
+| `policy.applied.actions.message` | message about the application of the action to further qualify the status of the action | None |
+| `policy.applied.actions.name` | name of the action that was applied | None |
+| `policy.applied.actions.status` | the status of the action | None |
+| `policy.applied.artifacts` | information about protection artifacts applied. | None |
+| `policy.applied.artifacts.global` | information about global protection artifacts applied. | None |
+| `policy.applied.artifacts.global.channel` | global artifacts rollout channel | None |
+| `policy.applied.artifacts.global.identifiers` | the identifiers of global artifacts applied. | None |
+| `policy.applied.artifacts.global.identifiers.name` | the name of global artifact applied. | None |
+| `policy.applied.artifacts.global.identifiers.sha256` | the sha256 of global artifacts applied. | None |
+| `policy.applied.artifacts.global.snapshot` | the snapshot date of applied global artifacts or 'latest' | None |
+| `policy.applied.artifacts.global.update_age` | number of days since global artifacts were made up-to-date | None |
+| `policy.applied.artifacts.global.version` | the version of global artifacts applied. | None |
+| `policy.applied.artifacts.user` | information about user protection artifacts applied. | None |
+| `policy.applied.artifacts.user.identifiers` | the identifiers of user artifacts applied. | None |
+| `policy.applied.artifacts.user.identifiers.name` | the name of user artifact applied. | None |
+| `policy.applied.artifacts.user.identifiers.sha256` | the sha256 of user artifacts applied. | None |
+| `policy.applied.artifacts.user.version` | the version of user artifacts applied. | None |
+| `policy.applied.endpoint_policy_version` | the version of this applied policy | None |
+| `policy.applied.id` | the id of the applied policy | None |
+| `policy.applied.name` | the name of this applied policy | None |
+| `policy.applied.response` | the response of actions that failed in the applied policy | None |
+| `policy.applied.response.configurations` | the configurations of the applied policy | None |
+| `policy.applied.response.configurations.antivirus_registration` | overall antivirus registration configuration and status of the applied policy | None |
+| `policy.applied.response.configurations.antivirus_registration.concerned_actions` | all actions that were taken for antivirus registration | None |
+| `policy.applied.response.configurations.antivirus_registration.status` | the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions | None |
+| `policy.applied.response.configurations.attack_surface_reduction.concerned_actions` | all actions that were taken for attack surface reduction | None |
+| `policy.applied.response.configurations.attack_surface_reduction.status` | the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions | None |
+| `policy.applied.response.configurations.behavior_protection.concerned_actions` | all actions that were taken for behavior_protection | None |
+| `policy.applied.response.configurations.behavior_protection.status` | the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
+| `policy.applied.response.configurations.events` | overall event collection configuration and status of the applied policy | None |
+| `policy.applied.response.configurations.events.concerned_actions` | all actions that were taken for event collection | None |
+| `policy.applied.response.configurations.events.status` | the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
+| `policy.applied.response.configurations.host_isolation.concerned_actions` | all actions that were taken for host isolation | None |
+| `policy.applied.response.configurations.host_isolation.status` | the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
+| `policy.applied.response.configurations.logging` | overall logging configuration and status of the applied policy | None |
+| `policy.applied.response.configurations.logging.concerned_actions` | all actions that were taken for logging | None |
+| `policy.applied.response.configurations.logging.status` | the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions | None |
+| `policy.applied.response.configurations.malware` | overall malware configuration and status of the applied policy | None |
+| `policy.applied.response.configurations.malware.concerned_actions` | all actions that were taken for malware | None |
+| `policy.applied.response.configurations.malware.status` | the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
+| `policy.applied.response.configurations.memory_protection` | overall memory_protection configuration and status of the applied policy | None |
+| `policy.applied.response.configurations.memory_protection.concerned_actions` | all actions that were taken for memory_protection | None |
+| `policy.applied.response.configurations.memory_protection.status` | the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions | None |
+| `policy.applied.response.configurations.ransomware.concerned_actions` | all actions that were taken for ransomware | None |
+| `policy.applied.response.configurations.ransomware.status` | the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
+| `policy.applied.response.configurations.streaming` | overall data streaming configuration and status of the applied policy | None |
+| `policy.applied.response.configurations.streaming.concerned_actions` | all actions that were taken for data streaming | None |
+| `policy.applied.response.configurations.streaming.status` | the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
+| `policy.applied.response.diagnostic` | the diagnostic configurations of the applied policy | None |
+| `policy.applied.response.diagnostic.behavior_protection.concerned_actions` | all actions that were taken for the diagnostic configuration of behavior protection | None |
+| `policy.applied.response.diagnostic.behavior_protection.status` | the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
+| `policy.applied.response.diagnostic.credential_protection.concerned_actions` | all actions that were taken for the diagnostic configuration of credential protection | None |
+| `policy.applied.response.diagnostic.credential_protection.status` | the overall status of the diagnostic configuration of credential protection, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
+| `policy.applied.response.diagnostic.malware.concerned_actions` | all actions that were taken for the diagnostic configuration of malware | None |
+| `policy.applied.response.diagnostic.malware.status` | the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
+| `policy.applied.response.diagnostic.memory_protection.concerned_actions` | all actions that were taken for the diagnostic configuration of memory protection | None |
+| `policy.applied.response.diagnostic.memory_protection.status` | the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
+| `policy.applied.response.diagnostic.memory_scan.concerned_actions` | all actions that were taken for the diagnostic configuration of memory scan | None |
+| `policy.applied.response.diagnostic.memory_scan.status` | the overall status of the diagnostic configuration of memory scan, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
+| `policy.applied.response.diagnostic.ransomware.concerned_actions` | all actions that were taken for the diagnostic configuration of ransomware | None |
+| `policy.applied.response.diagnostic.ransomware.status` | the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
+| `policy.applied.status` | the status of the applied policy | None |
+| `policy.applied.version` | the version of this applied policy | None |
+| `state` | Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration) | None |
+| `state.isolation` | Current network isolation state of the host | None |
+### Example
 
 ```json
 Needs example
@@ -41,12 +112,22 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `build.original` | Extended build information for the agent.
+This field is intended to contain any build information that a data source may provide, no specific formatting is required. | metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC] |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -54,11 +135,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -66,11 +153,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -78,12 +170,54 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -91,12 +225,36 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/process.md b/scripts/generate-docs/output/process.md
index f01e42637..23d190a3d 100644
--- a/scripts/generate-docs/output/process.md
+++ b/scripts/generate-docs/output/process.md
@@ -1,40 +1,50 @@
 [Back to index](README.md)
 
-# process
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `ephemeral_id` | Ephemeral identifier of this agent (if one exists).
+This id normally changes across restarts, but `agent.id` does not. | 8a4f500f |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `name` | Custom name of the agent.
+This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | foo |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -42,11 +52,21 @@ Needs example
 ```
 <hr>
 
-### `cloud`
+## `cloud`
 
-#### Description
+### Description
 Fields related to the cloud or infrastructure the events are coming from.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `account.id` | The cloud account or organization id used to identify different entities in a multi-tenant environment.
+Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | 666777888999 |
+| `instance.name` | Instance name of the host machine. | None |
+| `project.id` | The cloud project identifier.
+Examples: Google Cloud Project id, Azure Project id. | my-project |
+| `provider` | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | aws |
+| `region` | Region in which this host, resource, or service is located. | us-east-1 |
+### Example
 
 ```json
 Needs example
@@ -54,12 +74,20 @@ Needs example
 ```
 <hr>
 
-### `container`
+## `container`
 
-#### Description
+### Description
 Container fields are used for meta information about the specific container that is the source of information.
 These fields help correlate data based containers from any runtime.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique container id. | None |
+| `image.hash.all` | An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set. | [sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26] |
+| `image.name` | Name of the image the container was built on. | None |
+| `image.tag` | Container image tags. | None |
+| `name` | Container name. | None |
+### Example
 
 ```json
 Needs example
@@ -67,11 +95,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -79,12 +113,29 @@ Needs example
 ```
 <hr>
 
-### `destination`
+## `destination`
 
-#### Description
+### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -92,11 +143,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -104,12 +160,54 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -117,11 +215,21 @@ Needs example
 ```
 <hr>
 
-### `group`
+## `group`
 
-#### Description
+### Description
 The group fields are meant to represent groups that are relevant to the event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | Group info prior to any setgid operations. | None |
+| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `Ext.real.name` | Name of the group. | None |
+| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `id` | Unique identifier for the group on the system/platform. | None |
+| `name` | Name of the group. | None |
+### Example
 
 ```json
 Needs example
@@ -129,12 +237,43 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `boot.id` | Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container. | 88a1f0ed-5ae5-41ee-af6b-41921c311872 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `pid_ns_ino` | This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. | 256383 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+### Example
 
 ```json
 Needs example
@@ -142,11 +281,21 @@ Needs example
 ```
 <hr>
 
-### `orchestrator`
+## `orchestrator`
 
-#### Description
+### Description
 Fields that describe the resources which container orchestrators manage or act upon.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `cluster.id` | Unique ID of the cluster. | None |
+| `cluster.name` | Name of the cluster. | None |
+| `namespace` | Namespace in which the action is taking place. | kube-system |
+| `resource.ip` | IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running). | None |
+| `resource.name` | Name of the resource being acted upon. | test-pod-cdcws |
+| `resource.parent.type` | Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet). | DaemonSet |
+| `resource.type` | Type of resource being acted upon. | service |
+### Example
 
 ```json
 Needs example
@@ -154,11 +303,15 @@ Needs example
 ```
 <hr>
 
-### `package`
+## `package`
 
-#### Description
+### Description
 These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `name` | Package name | go |
+### Example
 
 ```json
 Needs example
@@ -166,12 +319,417 @@ Needs example
 ```
 <hr>
 
-### `process`
+## `process`
 
-#### Description
+### Description
 These fields contain information about a process.
 These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
+| `Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
+| `Ext.authentication_id` | Process authentication ID | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `Ext.created_suspended` | A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls. | true |
+| `Ext.defense_evasions` | List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping. | None |
+| `Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
+| `Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
+| `Ext.device.file_system_type` | Volume device file system type.
+Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
+| `Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
+| `Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
+| `Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
+| `Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
+| `Ext.device.volume_device_type` | Volume device type.
+Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
+| `Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
+| `Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
+| `Ext.dll.name` | Name of the library.
+This generally maps to the name of the file on disk. | kernel32.dll |
+| `Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
+| `Ext.effective_parent.entity_id` | Unique identifier for the effective process. | c2c455d9f99375d |
+| `Ext.effective_parent.executable` | Executable name for the effective process. | C:\Windows\System32\wbem\WMIC.exe |
+| `Ext.effective_parent.name` | Process name for the effective process. | WMIC.exe |
+| `Ext.effective_parent.pid` | Process ID. | 4242 |
+| `Ext.memfd` | Object for memfd events. | None |
+| `Ext.memfd.flag_allow_seal` | Allow sealing operations on this file. | false |
+| `Ext.memfd.flag_cloexec` | Sets the the close-on-exec flag on the new file descriptor. | false |
+| `Ext.memfd.flag_exec` | Exec flag is set for file. | false |
+| `Ext.memfd.flag_hugetlb` | The anonymous file will be created in the hugetlbfs filesystem using huge pages. | false |
+| `Ext.memfd.flag_noexec_seal` | Sets both NOEXEC and MFD_ALLOW_SEALING. | false |
+| `Ext.memfd.flags` | Flags passed to the memfd operation. | 2 |
+| `Ext.memfd.name` | Filename for the created file. Appears in /proc/self/fd. | anon.txt |
+| `Ext.mitigation_policies` | Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled | None |
+| `Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
+| `Ext.ptrace` | Object for ptrace events. | None |
+| `Ext.ptrace.child_pid` | PID of the ptrace target. | None |
+| `Ext.ptrace.request` | ptrace request. | None |
+| `Ext.relative_file_creation_time` | Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future. | None |
+| `Ext.relative_file_name_modify_time` | Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future. | None |
+| `Ext.session` | Session information for the current process | None |
+| `Ext.session_info.authentication_package` | Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP | None |
+| `Ext.session_info.client_address` | Client's IPv4 or IPv6 address as a string, if available. | None |
+| `Ext.session_info.id` | Session ID | None |
+| `Ext.session_info.logon_type` | Session logon type.  Examples include Interactive, Network, and Service. | None |
+| `Ext.session_info.relative_logon_time` | Process creation time, relative to logon time, in seconds. | None |
+| `Ext.session_info.relative_password_age` | Process creation time, relative to the last time the password was changed, in seconds. | None |
+| `Ext.session_info.user_flags` | List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON. | None |
+| `Ext.shmget` | Object for shmget events. | None |
+| `Ext.shmget.flags` | flags passed to shmget. | None |
+| `Ext.shmget.key` | Key passed to the shmget request. | None |
+| `Ext.shmget.size` | Requested size. | None |
+| `Ext.token.elevation` | Whether the token is elevated or not | None |
+| `Ext.token.elevation_level` | What level of elevation the token has | one of "default", "full", "limited" |
+| `Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
+| `Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
+| `Ext.token.security_attributes` | Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class. | TSA://ProcUnique, LUA://DecHdAutoAp |
+| `Ext.trusted` | Whether or not the process is a trusted application | None |
+| `Ext.trusted_descendant` | Whether or not the process is a descendent of a trusted application | None |
+| `args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `end` | The time the process ended. | 2016-05-23T08:05:34.853Z |
+| `entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `entry_leader.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `entry_leader.attested_groups.name` | Name of the group. | None |
+| `entry_leader.attested_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `entry_leader.attested_user.name` | Short name or login of the user. | a.einstein |
+| `entry_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `entry_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.entry_meta.source.ip` | IP address of the source (IPv4 or IPv6). | None |
+| `entry_leader.entry_meta.type` | The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console
+Note: This field is only set on process.session_leader. | None |
+| `entry_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `entry_leader.group.id` | Unique identifier for the group on the system/platform. | None |
+| `entry_leader.group.name` | Name of the group. | None |
+| `entry_leader.interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `entry_leader.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `entry_leader.parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.parent.pid` | Process id. | 4242 |
+| `entry_leader.parent.session_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `entry_leader.parent.session_leader.pid` | Process id. | 4242 |
+| `entry_leader.parent.session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `entry_leader.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `entry_leader.pid` | Process id. | 4242 |
+| `entry_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `entry_leader.real_group.name` | Name of the group. | None |
+| `entry_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `entry_leader.real_user.name` | Short name or login of the user. | a.einstein |
+| `entry_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
+For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
+This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
+Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
+Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
+| `entry_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `entry_leader.saved_group.name` | Name of the group. | None |
+| `entry_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `entry_leader.saved_user.name` | Short name or login of the user. | a.einstein |
+| `entry_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `entry_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `entry_leader.supplemental_groups.name` | Name of the group. | None |
+| `entry_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `entry_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `entry_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `entry_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `entry_leader.user.name` | Short name or login of the user. | a.einstein |
+| `entry_leader.working_directory` | The working directory of the process. | /home/alice |
+| `env_vars` | Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.
+May be filtered to protect sensitive information. | ["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"] |
+| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `exit_code` | The exit code of the process, if this is a termination event.
+The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
+| `group.id` | Unique identifier for the group on the system/platform. | None |
+| `group.name` | Name of the group. | None |
+| `group_leader.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `group_leader.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `group_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `group_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `group_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `group_leader.group.id` | Unique identifier for the group on the system/platform. | None |
+| `group_leader.group.name` | Name of the group. | None |
+| `group_leader.interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `group_leader.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `group_leader.pid` | Process id. | 4242 |
+| `group_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `group_leader.real_group.name` | Name of the group. | None |
+| `group_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `group_leader.real_user.name` | Short name or login of the user. | a.einstein |
+| `group_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
+For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
+This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
+Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
+Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
+| `group_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `group_leader.saved_group.name` | Name of the group. | None |
+| `group_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `group_leader.saved_user.name` | Short name or login of the user. | a.einstein |
+| `group_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `group_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `group_leader.supplemental_groups.name` | Name of the group. | None |
+| `group_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `group_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `group_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `group_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `group_leader.user.name` | Short name or login of the user. | a.einstein |
+| `group_leader.working_directory` | The working directory of the process. | /home/alice |
+| `hash.md5` | MD5 hash. | None |
+| `hash.sha1` | SHA1 hash. | None |
+| `hash.sha256` | SHA256 hash. | None |
+| `hash.sha512` | SHA512 hash. | None |
+| `interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `io` | A chunk of input or output (IO) from a single process.
+This field only appears on the top level process object, which is the process that wrote the output or read the input. | None |
+| `io.max_bytes_per_process_exceeded` | If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting. | None |
+| `io.text` | A chunk of output or input sanitized to UTF-8.
+Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word. | None |
+| `io.total_bytes_captured` | The total number of bytes captured in this event. | None |
+| `io.total_bytes_skipped` | The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero | None |
+| `name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `parent.Ext` | Object for all custom defined fields to live in. | None |
+| `parent.Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
+| `parent.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `parent.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `parent.Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `parent.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `parent.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `parent.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `parent.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
+| `parent.Ext.real` | The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent. | None |
+| `parent.Ext.real.pid` | For process.parent this will be the ppid of the process that actually spawned the current process. | None |
+| `parent.Ext.user` | User associated with the running process. | None |
+| `parent.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `parent.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `parent.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `parent.code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `parent.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `parent.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `parent.code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `parent.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `parent.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `parent.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `parent.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `parent.exit_code` | The exit code of the process, if this is a termination event.
+The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
+| `parent.group.id` | Unique identifier for the group on the system/platform. | None |
+| `parent.group.name` | Name of the group. | None |
+| `parent.group_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `parent.group_leader.pid` | Process id. | 4242 |
+| `parent.group_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `parent.hash.md5` | MD5 hash. | None |
+| `parent.hash.sha1` | SHA1 hash. | None |
+| `parent.hash.sha256` | SHA256 hash. | None |
+| `parent.hash.sha512` | SHA512 hash. | None |
+| `parent.interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `parent.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `parent.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `parent.pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `parent.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `parent.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `parent.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `parent.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `parent.pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
+Identifier of the group of processes the process belongs to. | None |
+| `parent.pid` | Process id. | 4242 |
+| `parent.ppid` | Parent process' pid. | 4241 |
+| `parent.real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `parent.real_group.name` | Name of the group. | None |
+| `parent.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `parent.real_user.name` | Short name or login of the user. | a.einstein |
+| `parent.saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `parent.saved_group.name` | Name of the group. | None |
+| `parent.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `parent.saved_user.name` | Short name or login of the user. | a.einstein |
+| `parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `parent.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `parent.supplemental_groups.name` | Name of the group. | None |
+| `parent.thread.Ext` | Object for all custom defined fields to live in. | None |
+| `parent.thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
+| `parent.thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
+| `parent.thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
+| `parent.thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
+| `parent.thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
+| `parent.thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
+| `parent.thread.Ext.call_stack_contains_unbacked` | Indicates whether the creating thread's stack contains frames pointing outside any known executable image. | None |
+| `parent.thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
+| `parent.thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
+| `parent.thread.id` | Thread ID. | 4242 |
+| `parent.thread.name` | Thread name. | thread-0 |
+| `parent.title` | Process title.
+The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
+| `parent.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `parent.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `parent.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `parent.uptime` | Seconds the process has been up. | 1325 |
+| `parent.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `parent.user.name` | Short name or login of the user. | a.einstein |
+| `parent.working_directory` | The working directory of the process. | /home/alice |
+| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
+| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
+| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
+| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
+Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
+| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
+| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
+| `pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
+Identifier of the group of processes the process belongs to. | None |
+| `pid` | Process id. | 4242 |
+| `ppid` | Parent process' pid. | 4241 |
+| `previous.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `previous.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `previous.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `real_group.name` | Name of the group. | None |
+| `real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `real_user.name` | Short name or login of the user. | a.einstein |
+| `saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `saved_group.name` | Name of the group. | None |
+| `saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `saved_user.name` | Short name or login of the user. | a.einstein |
+| `session_leader.args` | Array of process arguments, starting with the absolute path to the executable.
+May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
+| `session_leader.args_count` | Length of the process.args array.
+This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
+| `session_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
+Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
+| `session_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `session_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `session_leader.group.id` | Unique identifier for the group on the system/platform. | None |
+| `session_leader.group.name` | Name of the group. | None |
+| `session_leader.interactive` | Whether the process is connected to an interactive shell.
+Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
+Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
+| `session_leader.name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `session_leader.parent.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `session_leader.parent.pid` | Process id. | 4242 |
+| `session_leader.parent.session_leader.entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `session_leader.parent.session_leader.pid` | Process id. | 4242 |
+| `session_leader.parent.session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `session_leader.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `session_leader.pid` | Process id. | 4242 |
+| `session_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
+| `session_leader.real_group.name` | Name of the group. | None |
+| `session_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `session_leader.real_user.name` | Short name or login of the user. | a.einstein |
+| `session_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
+For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
+This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
+Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
+Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
+| `session_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
+| `session_leader.saved_group.name` | Name of the group. | None |
+| `session_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `session_leader.saved_user.name` | Short name or login of the user. | a.einstein |
+| `session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `session_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `session_leader.supplemental_groups.name` | Name of the group. | None |
+| `session_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `session_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `session_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `session_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `session_leader.user.name` | Short name or login of the user. | a.einstein |
+| `session_leader.working_directory` | The working directory of the process. | /home/alice |
+| `start` | The time the process started. | 2016-05-23T08:05:34.853Z |
+| `supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
+| `supplemental_groups.name` | Name of the group. | None |
+| `thread.capabilities.effective` | This is the set of capabilities used by the kernel to perform permission checks for the thread. | ["CAP_BPF", "CAP_SYS_ADMIN"] |
+| `thread.capabilities.permitted` | This is a limiting superset for the effective capabilities that the thread may assume. | ["CAP_BPF", "CAP_SYS_ADMIN"] |
+| `thread.id` | Thread ID. | 4242 |
+| `thread.name` | Thread name. | thread-0 |
+| `title` | Process title.
+The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
+| `tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
+| `tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
+| `tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
+| `tty.columns` | The number of character columns per line. e.g terminal width
+Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output' | 80 |
+| `tty.rows` | The number of character rows in the terminal. e.g terminal height
+Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output' | 24 |
+| `uptime` | Seconds the process has been up. | 1325 |
+| `user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `user.name` | Short name or login of the user. | a.einstein |
+| `working_directory` | The working directory of the process. | /home/alice |
+### Example
 
 ```json
 Needs example
@@ -179,12 +737,29 @@ Needs example
 ```
 <hr>
 
-### `source`
+## `source`
 
-#### Description
+### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -192,12 +767,34 @@ Needs example
 ```
 <hr>
 
-### `user`
+## `user`
 
-#### Description
+### Description
 The user fields describe information about the user that is relevant to the event.
 Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | User info prior to any setuid operations. | None |
+| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
+| `Ext.real.name` | Short name or login of the user. | None |
+| `domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `email` | User email address. | None |
+| `full_name` | User's full name, if available. | Albert Einstein |
+| `group.Ext` | Object for all custom defined fields to live in. | None |
+| `group.Ext.real` | Group info prior to any setgid operations. | None |
+| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `group.Ext.real.name` | Name of the group. | None |
+| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `group.id` | Unique identifier for the group on the system/platform. | None |
+| `group.name` | Name of the group. | None |
+| `hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `name` | Short name or login of the user. | a.einstein |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/registry.md b/scripts/generate-docs/output/registry.md
index b750e28c3..46e88f1b7 100644
--- a/scripts/generate-docs/output/registry.md
+++ b/scripts/generate-docs/output/registry.md
@@ -1,42 +1,47 @@
 [Back to index](README.md)
 
-# registry
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `Effective_process`
+## `Effective_process`
 
-#### Description
+### Description
 These fields contain information about an effective process.
 The effective process is the process that requested the a specific action, without directly performing it.
 Processes can have effective parents that differ from their regular parents. For example, on Windows, "wmic process call create notepad" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.
 Events can have effective processes that differ from their regular processes. For example, on Windows, "reg add \\localhost\HKLM\Software\Foo /v Data /t REG_SZ /d 123"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `entity_id` | Unique identifier for the effective process. | c2c455d9f99375d |
+| `executable` | Executable name for the effective process. | C:\Windows\System32\wbem\WMIC.exe |
+| `name` | Process name for the effective process. | WMIC.exe |
+| `pid` | Process ID. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -44,12 +49,20 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -57,11 +70,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -69,12 +88,29 @@ Needs example
 ```
 <hr>
 
-### `destination`
+## `destination`
 
-#### Description
+### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -82,11 +118,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -94,12 +135,54 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -107,11 +190,21 @@ Needs example
 ```
 <hr>
 
-### `group`
+## `group`
 
-#### Description
+### Description
 The group fields are meant to represent groups that are relevant to the event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | Group info prior to any setgid operations. | None |
+| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `Ext.real.name` | Name of the group. | None |
+| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `id` | Unique identifier for the group on the system/platform. | None |
+| `name` | Name of the group. | None |
+### Example
 
 ```json
 Needs example
@@ -119,12 +212,41 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+### Example
 
 ```json
 Needs example
@@ -132,12 +254,55 @@ Needs example
 ```
 <hr>
 
-### `process`
+## `process`
 
-#### Description
+### Description
 These fields contain information about a process.
 These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `pid` | Process id. | 4242 |
+| `thread.Ext` | Object for all custom defined fields to live in. | None |
+| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
+| `thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
+| `thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
+| `thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
+| `thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
+| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
+| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
+| `thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
+| `thread.id` | Thread ID. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -145,11 +310,23 @@ Needs example
 ```
 <hr>
 
-### `registry`
+## `registry`
 
-#### Description
+### Description
 Fields related to Windows Registry operations.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `data.bytes` | Original bytes written with base64 encoding.
+For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. | ZQBuAC0AVQBTAAAAZQBuAAAAAAA= |
+| `data.strings` | Content when writing string types.
+Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | ["C:\rta\red_ttp\bin\myapp.exe"] |
+| `data.type` | Standard registry type for encoding contents | REG_SZ |
+| `hive` | Abbreviated name for the hive. | HKLM |
+| `key` | Hive-relative path of keys. | SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe |
+| `path` | Full path, including hive, key and value | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger |
+| `value` | Name of the value written. | Debugger |
+### Example
 
 ```json
 Needs example
@@ -157,12 +334,29 @@ Needs example
 ```
 <hr>
 
-### `source`
+## `source`
 
-#### Description
+### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -170,12 +364,34 @@ Needs example
 ```
 <hr>
 
-### `user`
+## `user`
 
-#### Description
+### Description
 The user fields describe information about the user that is relevant to the event.
 Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | User info prior to any setuid operations. | None |
+| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
+| `Ext.real.name` | Short name or login of the user. | None |
+| `domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `email` | User email address. | None |
+| `full_name` | User's full name, if available. | Albert Einstein |
+| `group.Ext` | Object for all custom defined fields to live in. | None |
+| `group.Ext.real` | Group info prior to any setgid operations. | None |
+| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `group.Ext.real.name` | Name of the group. | None |
+| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `group.id` | Unique identifier for the group on the system/platform. | None |
+| `group.name` | Name of the group. | None |
+| `hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `name` | Short name or login of the user. | a.einstein |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/output/security.md b/scripts/generate-docs/output/security.md
index 363350db9..064380e89 100644
--- a/scripts/generate-docs/output/security.md
+++ b/scripts/generate-docs/output/security.md
@@ -1,40 +1,43 @@
 [Back to index](README.md)
 
-# security
+## `@timestamp`
 
-### `@timestamp`
-
-#### Description
+### Description
 Date/time when the event originated.
 This is the date/time extracted from the event, typically representing when the event was generated by the source.
 If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
 Required field for all events.
-#### Example
+### Example
 
 ```json
 "2016-05-23T08:05:34.853Z"
 ```
 <hr>
 
-### `message`
+## `message`
 
-#### Description
+### Description
 For log events the message field contains the log message, optimized for viewing in a log viewer.
 For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
 If multiple messages exist, they can be combined into one message.
-#### Example
+### Example
 
 ```json
 "Hello World"
 ```
 <hr>
 
-### `Target`
+## `Target`
 
-#### Description
+### Description
 These fields contain information about a target.
 These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `process.Ext` | Object for all custom defined fields to live in. | None |
+| `process.Ext.authentication_id` | Process authentication ID | None |
+### Example
 
 ```json
 Needs example
@@ -42,12 +45,20 @@ Needs example
 ```
 <hr>
 
-### `agent`
+## `agent`
 
-#### Description
+### Description
 The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
 Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `id` | Unique identifier of this agent (if one exists).
+Example: For Beats this would be beat.id. | 8a4f500d |
+| `type` | Type of the agent.
+The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
+| `version` | Version of the agent. | 6.0.0-rc2 |
+### Example
 
 ```json
 Needs example
@@ -55,11 +66,17 @@ Needs example
 ```
 <hr>
 
-### `data_stream`
+## `data_stream`
 
-#### Description
+### Description
 Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `dataset` | Data stream dataset name. | nginx.access |
+| `namespace` | Data stream namespace. | production |
+| `type` | Data stream type. | logs |
+### Example
 
 ```json
 Needs example
@@ -67,12 +84,29 @@ Needs example
 ```
 <hr>
 
-### `destination`
+## `destination`
 
-#### Description
+### Description
 Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -80,11 +114,16 @@ Needs example
 ```
 <hr>
 
-### `ecs`
+## `ecs`
 
-#### Description
+### Description
 Meta-information specific to ECS.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
+When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
+### Example
 
 ```json
 Needs example
@@ -92,12 +131,54 @@ Needs example
 ```
 <hr>
 
-### `event`
+## `event`
 
-#### Description
+### Description
 The event fields are used for context information about the log or metric event itself.
 A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `action` | The action captured by the event.
+This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
+| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
+`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
+This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
+| `code` | Identification code for this event, if one exists.
+Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
+| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
+This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
+In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
+In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
+| `dataset` | Name of the dataset.
+If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
+It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
+| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
+| `id` | Unique ID to describe the event. | 8a4f500d |
+| `ingested` | Timestamp when an event arrived in the central data store.
+This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
+In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
+| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
+`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
+The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
+| `module` | Name of the module this data is coming from.
+If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
+| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
+`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
+Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
+Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
+Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
+| `provider` | Source of the event.
+Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
+| `sequence` | Sequence number of the event.
+The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
+| `severity` | The numeric severity of the event according to your event source.
+What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
+The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
+| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
+`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
+This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
+### Example
 
 ```json
 Needs example
@@ -105,12 +186,20 @@ Needs example
 ```
 <hr>
 
-### `file`
+## `file`
 
-#### Description
+### Description
 A file is defined as a set of information that has been created on, or has existed on a filesystem.
 File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
+### Example
 
 ```json
 Needs example
@@ -118,11 +207,21 @@ Needs example
 ```
 <hr>
 
-### `group`
+## `group`
 
-#### Description
+### Description
 The group fields are meant to represent groups that are relevant to the event.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | Group info prior to any setgid operations. | None |
+| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `Ext.real.name` | Name of the group. | None |
+| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `id` | Unique identifier for the group on the system/platform. | None |
+| `name` | Name of the group. | None |
+### Example
 
 ```json
 Needs example
@@ -130,12 +229,41 @@ Needs example
 ```
 <hr>
 
-### `host`
+## `host`
 
-#### Description
+### Description
 A host is defined as a general computing instance.
 ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `architecture` | Operating system architecture. | x86_64 |
+| `domain` | Name of the domain of which the host is a member.
+For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
+| `hostname` | Hostname of the host.
+It normally contains what the `hostname` command returns on the host machine. | None |
+| `id` | Unique host id.
+As hostname is not always unique, use values that are meaningful in your environment.
+Example: The current usage of `beat.name`. | None |
+| `ip` | Host ip addresses. | None |
+| `mac` | Host MAC addresses.
+The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
+| `name` | Name of the host.
+It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
+| `os.Ext` | Object for all custom defined fields to live in. | None |
+| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
+| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
+| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
+| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
+| `os.name` | Operating system name, without the version. | Mac OS X |
+| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
+| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
+If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
+| `os.version` | Operating system version as a raw string. | 10.14.1 |
+| `type` | Type of host.
+For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
+| `uptime` | Seconds the host has been up. | 1325 |
+### Example
 
 ```json
 Needs example
@@ -143,12 +271,47 @@ Needs example
 ```
 <hr>
 
-### `process`
+## `process`
 
-#### Description
+### Description
 These fields contain information about a process.
 These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
+| `Ext.authentication_id` | Process authentication ID | None |
+| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
+| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `Ext.code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `code_signature.exists` | Boolean to capture if a signature is present. | true |
+| `code_signature.signing_id` | The identifier used to sign the process.
+This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
+| `code_signature.status` | Additional information about the certificate status.
+This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
+| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
+| `code_signature.team_id` | The team identifier used to sign the process.
+This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
+| `code_signature.trusted` | Stores the trust status of the certificate chain.
+Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
+| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
+Leave unpopulated if a certificate was unchecked. | true |
+| `entity_id` | Unique identifier for the process.
+The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
+Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
+| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
+| `name` | Process name.
+Sometimes called program name or similar. | ssh |
+| `pid` | Process id. | 4242 |
+| `thread.id` | Thread ID. | 4242 |
+### Example
 
 ```json
 Needs example
@@ -156,12 +319,29 @@ Needs example
 ```
 <hr>
 
-### `source`
+## `source`
 
-#### Description
+### Description
 Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
 Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `geo.city_name` | City name. | Montreal |
+| `geo.continent_code` | Two-letter code representing continent's name. | NA |
+| `geo.continent_name` | Name of the continent. | North America |
+| `geo.country_iso_code` | Country ISO code. | CA |
+| `geo.country_name` | Country name. | Canada |
+| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
+| `geo.name` | User-defined description of a location, at the level of granularity they care about.
+Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
+Not typically used in automated geolocation. | boston-dc |
+| `geo.postal_code` | Postal code associated with the location.
+Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
+| `geo.region_iso_code` | Region ISO code. | CA-QC |
+| `geo.region_name` | Region name. | Quebec |
+| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
+### Example
 
 ```json
 Needs example
@@ -169,12 +349,42 @@ Needs example
 ```
 <hr>
 
-### `user`
+## `user`
 
-#### Description
+### Description
 The user fields describe information about the user that is relevant to the event.
 Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `Ext` | Object for all custom defined fields to live in. | None |
+| `Ext.real` | User info prior to any setuid operations. | None |
+| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
+| `Ext.real.name` | Short name or login of the user. | None |
+| `domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `effective.domain` | Name of the directory the user is a member of.
+For example, an LDAP or Active Directory domain name. | None |
+| `effective.email` | User email address. | None |
+| `effective.full_name` | User's full name, if available. | Albert Einstein |
+| `effective.hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `effective.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `effective.name` | Short name or login of the user. | a.einstein |
+| `email` | User email address. | None |
+| `full_name` | User's full name, if available. | Albert Einstein |
+| `group.Ext` | Object for all custom defined fields to live in. | None |
+| `group.Ext.real` | Group info prior to any setgid operations. | None |
+| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
+| `group.Ext.real.name` | Name of the group. | None |
+| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
+| `group.id` | Unique identifier for the group on the system/platform. | None |
+| `group.name` | Name of the group. | None |
+| `hash` | Unique user hash to correlate information for a user in anonymized form.
+Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
+| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
+| `name` | Short name or login of the user. | a.einstein |
+### Example
 
 ```json
 Needs example
@@ -182,11 +392,16 @@ Needs example
 ```
 <hr>
 
-### `winlog`
+## `winlog`
 
-#### Description
+### Description
 These fields provide detailed information regarding events logged in the Windows Event Log. The Windows Event Log is a centralized system used by Windows to record events related to system, application, and security activities. Each event log entry is categorized by a specific event type, and contains relevant metadata that can include the event source, event ID, timestamp, user details, and other associated data.
-#### Example
+### Sub-fields
+| Field | Description | Example |
+| --- | --- | --- |
+| `event_data` | The event-specific data. This is a non-exhaustive list of parameters that are used in Windows events. | None |
+| `event_data.PrivilegeList` | An array of sensitive privileges, assigned to the new logon. | SeTcbPrivilege, SeSecurityPrivilege |
+### Example
 
 ```json
 Needs example
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index ea678db22..8519048fc 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -2,6 +2,14 @@
 from .models import Package, PackageList
 import json
 
+def ensure_valid_output_directory(output_directory: pathlib.Path):
+    """
+    Ensure that the output directory is valid
+    """
+    if not output_directory.exists():
+        output_directory.mkdir(parents=True)
+    if not output_directory.is_dir():
+        raise FileExistsError(f"output_directory {output_directory} is not a directory")
 
 def generate_package_markdown(package: Package):
     """
@@ -14,12 +22,17 @@ def generate_package_markdown(package: Package):
         markdown string
     """
     markdown = f"[Back to index](README.md)\n\n"
-    markdown += f"# {package.name}\n\n"
     for field in package.fields:
-        markdown += f"### `{field.name}`\n\n"
-        markdown += f"#### Description\n"
+        markdown += f"## `{field.name}`\n\n"
+        markdown += f"### Description\n"
         markdown += f"{field.description}\n"
-        markdown += f"#### Example\n\n"
+        if field.fields:
+            markdown += f"### Sub-fields\n"
+            markdown += "| Field | Description | Example |\n"
+            markdown += "| --- | --- | --- |\n"
+            for sub_field in field.fields:
+                markdown += f"| `{sub_field.name}` | {sub_field.description} | {sub_field.example} |\n"
+        markdown += f"### Example\n\n"
         markdown += f"```json\n"
         if not field.example:
             markdown += "Needs example\n"
@@ -28,30 +41,49 @@ def generate_package_markdown(package: Package):
         markdown += "\n```\n<hr>\n\n"
     return markdown
 
-
-def generate_package_list_markdown(package_list: PackageList, output_directory: pathlib.Path):
+def generate_readme_markdown(package_list: PackageList, output_directory: pathlib.Path):
     """
-    Generate markdown for a list of packages
+    Generates the top level readme markdown file
+    """
+    ensure_valid_output_directory(output_directory)
+    readme_path = output_directory / "README.md"
 
-    Args:
-        package_list: the package list to generate markdown for
+    #
+    # This file will list each package, its top level fields, and a link to the package's markdown file
+    # if the package has a sample event, it will be included in a details tag
+    #
+    with readme_path.open("w") as f:
+        for package in package_list.packages:
+            f.write(f"# {package.name}\n")
+            if package.sample_event:
+                f.write("### Sample Event\n")
+                f.write("<details>\n")
+                f.write("<summary>\nClick to expand\n</summary>\n\n")
+                f.write("```json\n")
+                f.write(json.dumps(package.sample_event, indent=4))
+                f.write("\n```\n")
+                f.write("</details>\n\n")
+            f.write(f"### [Fields]({package.name}.md)\n")
+            for field in package.fields:
+                f.write(f"- [{field.name}]({package.name}.md#{field.name})\n")
 
-    Returns:
-        markdown string
+def generate_package_list_markdown(package_list: PackageList, output_directory: pathlib.Path) -> None:
     """
-    if not output_directory.exists():
-        output_directory.mkdir(parents=True)
-    if not output_directory.is_dir():
-        raise ValueError(f"output_directory {output_directory} is not a directory")
+    Generate markdown files for a list of packages
+    """
+    ensure_valid_output_directory(output_directory)
+
+    #
+    # Create a top level Readme.md file
+    #
+    generate_readme_markdown(package_list, output_directory)
 
+    #
+    # Walk the list of packages and create a markdown file for each
+    #
     for package in package_list.packages:
         path = output_directory / f"{package.name}.md"
         with path.open("w") as f:
             f.write(generate_package_markdown(package))
 
-    readme_path = output_directory / "README.md"
-    with readme_path.open("w") as f:
-        f.write("# Packages\n\n")
-        for package in package_list.packages:
-            f.write(f"- [{package.name}]({package.name}.md)\n")
     return f"Generated {len(package_list.packages)} packages to {output_directory}"

From b6f7372d32eb3260c9736909a24e098dcc59a3b0 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 21 Mar 2025 18:54:22 +0000
Subject: [PATCH 07/25] stashing

---
 scripts/generate-docs/fields.txt              | 7975 +++++++++++++++++
 scripts/generate-docs/pydocgen/__main__.py    |   87 +-
 .../pydocgen/custom_documentation.py          |   69 +
 scripts/generate-docs/pydocgen/models.py      |   21 +-
 4 files changed, 8131 insertions(+), 21 deletions(-)
 create mode 100644 scripts/generate-docs/fields.txt
 create mode 100644 scripts/generate-docs/pydocgen/custom_documentation.py

diff --git a/scripts/generate-docs/fields.txt b/scripts/generate-docs/fields.txt
new file mode 100644
index 000000000..06e8e27cc
--- /dev/null
+++ b/scripts/generate-docs/fields.txt
@@ -0,0 +1,7975 @@
+{
+    "@timestamp": [
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
+        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events."
+    ],
+    "Events": [
+        "events array"
+    ],
+    "message": [
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
+        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message."
+    ],
+    "Endpoint.policy": [
+        "The policy fields are used to hold information about applied policy.",
+        "The policy fields are used to hold information about applied policy.",
+        "The policy fields are used to hold information about applied policy."
+    ],
+    "Endpoint.policy.applied": [
+        "information about the policy that is applied",
+        "information about the policy that is applied",
+        "information about the policy that is applied"
+    ],
+    "Endpoint.policy.applied.artifacts": [
+        "information about protection artifacts applied.",
+        "information about protection artifacts applied."
+    ],
+    "Endpoint.policy.applied.artifacts.global": [
+        "information about global protection artifacts applied.",
+        "information about global protection artifacts applied."
+    ],
+    "Endpoint.policy.applied.artifacts.global.channel": [
+        "global artifacts rollout channel",
+        "global artifacts rollout channel"
+    ],
+    "Endpoint.policy.applied.artifacts.global.identifiers": [
+        "the identifiers of global artifacts applied.",
+        "the identifiers of global artifacts applied."
+    ],
+    "Endpoint.policy.applied.artifacts.global.identifiers.name": [
+        "the name of global artifact applied.",
+        "the name of global artifact applied."
+    ],
+    "Endpoint.policy.applied.artifacts.global.identifiers.sha256": [
+        "the sha256 of global artifacts applied.",
+        "the sha256 of global artifacts applied."
+    ],
+    "Endpoint.policy.applied.artifacts.global.snapshot": [
+        "the snapshot date of applied global artifacts or 'latest'",
+        "the snapshot date of applied global artifacts or 'latest'"
+    ],
+    "Endpoint.policy.applied.artifacts.global.update_age": [
+        "number of days since global artifacts were made up-to-date",
+        "number of days since global artifacts were made up-to-date"
+    ],
+    "Endpoint.policy.applied.artifacts.global.version": [
+        "the version of global artifacts applied.",
+        "the version of global artifacts applied."
+    ],
+    "Endpoint.policy.applied.artifacts.user": [
+        "information about user protection artifacts applied.",
+        "information about user protection artifacts applied."
+    ],
+    "Endpoint.policy.applied.artifacts.user.identifiers": [
+        "the identifiers of user artifacts applied.",
+        "the identifiers of user artifacts applied."
+    ],
+    "Endpoint.policy.applied.artifacts.user.identifiers.name": [
+        "the name of user artifact applied.",
+        "the name of user artifact applied."
+    ],
+    "Endpoint.policy.applied.artifacts.user.identifiers.sha256": [
+        "the sha256 of user artifacts applied.",
+        "the sha256 of user artifacts applied."
+    ],
+    "Endpoint.policy.applied.artifacts.user.version": [
+        "the version of user artifacts applied.",
+        "the version of user artifacts applied."
+    ],
+    "Endpoint.policy.applied.id": [
+        "the id of the applied policy",
+        "the id of the applied policy",
+        "the id of the applied policy"
+    ],
+    "Endpoint.policy.applied.name": [
+        "the name of this applied policy",
+        "the name of this applied policy",
+        "the name of this applied policy"
+    ],
+    "Endpoint.policy.applied.status": [
+        "the status of the applied policy",
+        "the status of the applied policy",
+        "the status of the applied policy"
+    ],
+    "Endpoint.policy.applied.version": [
+        "the version of this applied policy",
+        "the version of this applied policy"
+    ],
+    "Memory_protection.cross_session": [
+        "Is this process injecting across operating system sessions?"
+    ],
+    "Memory_protection.feature": [
+        "Memory Protection feature which triggered the alert."
+    ],
+    "Memory_protection.parent_to_child": [
+        "Is this process injecting into its child?"
+    ],
+    "Memory_protection.self_injection": [
+        "Is this alert about a process injecting into itself?"
+    ],
+    "Memory_protection.thread_count": [
+        "The number of threads that this alert applies to. If several alerts occur in a short period of time, they can be combined into a single alert with thread_count > 1."
+    ],
+    "Memory_protection.unique_key_v1": [
+        "A unique key created by hashing several characteristics of this alert."
+    ],
+    "Memory_protection.unique_key_v2": [
+        "A unique key created by hashing several characteristics of this alert."
+    ],
+    "Ransomware.child_processes.executable": [
+        "Absolute path to the process executable."
+    ],
+    "Ransomware.child_processes.feature": [
+        "Ransomware feature which triggered the alert."
+    ],
+    "Ransomware.child_processes.files": [
+        "Information about each file event attributed to the ransomware. Expected to be an array."
+    ],
+    "Ransomware.child_processes.files.data": [
+        "File header or MBR bytes."
+    ],
+    "Ransomware.child_processes.files.entropy": [
+        "Entropy of file contents."
+    ],
+    "Ransomware.child_processes.files.extension": [
+        "File extension, excluding the leading dot."
+    ],
+    "Ransomware.child_processes.files.metrics": [
+        "Suspicious ransomware behaviours associated with the file event."
+    ],
+    "Ransomware.child_processes.files.operation": [
+        "Operation applied to file."
+    ],
+    "Ransomware.child_processes.files.original.extension": [
+        "Original file extension prior to the file event."
+    ],
+    "Ransomware.child_processes.files.original.path": [
+        "Original file path prior to the file event."
+    ],
+    "Ransomware.child_processes.files.path": [
+        "Full path to the file, including the file name."
+    ],
+    "Ransomware.child_processes.files.score": [
+        "Ransomware score for this particular file event."
+    ],
+    "Ransomware.child_processes.pid": [
+        "Process id."
+    ],
+    "Ransomware.child_processes.score": [
+        "Total ransomware score for aggregated file events."
+    ],
+    "Ransomware.child_processes.version": [
+        "Ransomware artifact version."
+    ],
+    "Ransomware.executable": [
+        "Absolute path to the process executable."
+    ],
+    "Ransomware.feature": [
+        "Ransomware feature which triggered the alert."
+    ],
+    "Ransomware.files": [
+        "Information about each file event attributed to the ransomware. Expected to be an array."
+    ],
+    "Ransomware.files.data": [
+        "File header or MBR bytes."
+    ],
+    "Ransomware.files.entropy": [
+        "Entropy of file contents."
+    ],
+    "Ransomware.files.extension": [
+        "File extension, excluding the leading dot."
+    ],
+    "Ransomware.files.metrics": [
+        "Suspicious ransomware behaviours associated with the file event."
+    ],
+    "Ransomware.files.operation": [
+        "Operation applied to file."
+    ],
+    "Ransomware.files.original.extension": [
+        "Original file extension prior to the file event."
+    ],
+    "Ransomware.files.original.path": [
+        "Original file path prior to the file event."
+    ],
+    "Ransomware.files.path": [
+        "Full path to the file, including the file name."
+    ],
+    "Ransomware.files.score": [
+        "Ransomware score for this particular file event."
+    ],
+    "Ransomware.pid": [
+        "Process id."
+    ],
+    "Ransomware.score": [
+        "Total ransomware score for aggregated file events."
+    ],
+    "Ransomware.version": [
+        "Ransomware artifact version."
+    ],
+    "Responses.@timestamp": [
+        "Timestamp in which action was taken"
+    ],
+    "Responses.action": [
+        "Dictionary representing requested response action"
+    ],
+    "Responses.action.action": [
+        "Response action name"
+    ],
+    "Responses.action.field": [
+        "Field in the triggering event to use as input for action"
+    ],
+    "Responses.action.file.attributes": [
+        "Destination file attributes"
+    ],
+    "Responses.action.file.path": [
+        "Destination file path"
+    ],
+    "Responses.action.file.reason": [
+        "Combined USN file modification reason"
+    ],
+    "Responses.action.key.actions": [
+        "Actions taken by Registry Rollback for key"
+    ],
+    "Responses.action.key.path": [
+        "NT path of registry key recovered by Rollback"
+    ],
+    "Responses.action.key.values": [
+        "Values modified"
+    ],
+    "Responses.action.key.values.actions": [
+        "Actions taken by Registry Rollback for value"
+    ],
+    "Responses.action.key.values.name": [
+        "Value name recovered by Rollback"
+    ],
+    "Responses.action.process.message": [
+        "Status message for Process Rollback"
+    ],
+    "Responses.action.process.path": [
+        "Path of process killed by Process Rollback"
+    ],
+    "Responses.action.process.result": [
+        "Result code for Process Rollback"
+    ],
+    "Responses.action.source.attributes": [
+        "Source file attributes"
+    ],
+    "Responses.action.source.path": [
+        "Source file path"
+    ],
+    "Responses.action.state": [
+        "Index of event in events array to use for field lookup"
+    ],
+    "Responses.action.tree": [
+        "Indicates whether or not an action was taken against an entire process tree"
+    ],
+    "Responses.message": [
+        "Result message"
+    ],
+    "Responses.process": [
+        "Dictionary representing process information"
+    ],
+    "Responses.process.entity_id": [
+        "Entity id of actionable process"
+    ],
+    "Responses.process.name": [
+        "Name of actionable process"
+    ],
+    "Responses.process.pid": [
+        "pid of actionable process"
+    ],
+    "Responses.result": [
+        "Response action result code"
+    ],
+    "Target.dll.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "Target.dll.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "Target.dll.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.dll.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.dll.Ext.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.dll.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.dll.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.dll.Ext.compile_time": [
+        "Timestamp from when the module was compiled."
+    ],
+    "Target.dll.Ext.malware_classification.features": [
+        "Intermediate field included by adding option with subset"
+    ],
+    "Target.dll.Ext.malware_classification.features.data.buffer": [
+        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+    ],
+    "Target.dll.Ext.malware_classification.features.data.decompressed_size": [
+        "The decompressed size of buffer."
+    ],
+    "Target.dll.Ext.malware_classification.features.data.encoding": [
+        "The encoding of buffer (e.g. zlib)."
+    ],
+    "Target.dll.Ext.malware_classification.identifier": [
+        "The model's unique identifier."
+    ],
+    "Target.dll.Ext.malware_classification.score": [
+        "The score produced by the classification model."
+    ],
+    "Target.dll.Ext.malware_classification.threshold": [
+        "The score threshold for the model.  Files that score above this threshold are considered malicious."
+    ],
+    "Target.dll.Ext.malware_classification.upx_packed": [
+        "Whether UPX packing was detected."
+    ],
+    "Target.dll.Ext.malware_classification.version": [
+        "The version of the model used."
+    ],
+    "Target.dll.Ext.mapped_address": [
+        "The base address where this module is loaded."
+    ],
+    "Target.dll.Ext.mapped_size": [
+        "The size of this module's memory mapping, in bytes."
+    ],
+    "Target.dll.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.dll.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "Target.dll.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.dll.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.dll.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "Target.dll.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.dll.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.dll.hash.md5": [
+        "MD5 hash."
+    ],
+    "Target.dll.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "Target.dll.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "Target.dll.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "Target.dll.name": [
+        "Name of the library.\nThis generally maps to the name of the file on disk."
+    ],
+    "Target.dll.path": [
+        "Full file path of the library."
+    ],
+    "Target.dll.pe.company": [
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "Target.dll.pe.description": [
+        "Internal description of the file, provided at compile-time."
+    ],
+    "Target.dll.pe.file_version": [
+        "Internal version of the file, provided at compile-time."
+    ],
+    "Target.dll.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "Target.dll.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time."
+    ],
+    "Target.dll.pe.product": [
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "Target.process.Ext.ancestry": [
+        "An array of entity_ids indicating the ancestors for this event"
+    ],
+    "Target.process.Ext.architecture": [
+        "Process architecture.  It can differ from host architecture."
+    ],
+    "Target.process.Ext.authentication_id": [
+        "Process authentication ID",
+        "Process authentication ID"
+    ],
+    "Target.process.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "Target.process.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.process.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.process.Ext.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.process.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.process.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.process.Ext.dll.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "Target.process.Ext.dll.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "Target.process.Ext.dll.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.process.Ext.dll.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.process.Ext.dll.Ext.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.process.Ext.dll.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.process.Ext.dll.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.process.Ext.dll.Ext.compile_time": [
+        "Timestamp from when the module was compiled."
+    ],
+    "Target.process.Ext.dll.Ext.mapped_address": [
+        "The base address where this module is loaded."
+    ],
+    "Target.process.Ext.dll.Ext.mapped_size": [
+        "The size of this module's memory mapping, in bytes."
+    ],
+    "Target.process.Ext.dll.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.process.Ext.dll.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "Target.process.Ext.dll.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.process.Ext.dll.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.process.Ext.dll.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "Target.process.Ext.dll.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.process.Ext.dll.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.process.Ext.dll.hash.md5": [
+        "MD5 hash."
+    ],
+    "Target.process.Ext.dll.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "Target.process.Ext.dll.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "Target.process.Ext.dll.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "Target.process.Ext.dll.name": [
+        "Name of the library.\nThis generally maps to the name of the file on disk."
+    ],
+    "Target.process.Ext.dll.path": [
+        "Full file path of the library."
+    ],
+    "Target.process.Ext.dll.pe.company": [
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.dll.pe.description": [
+        "Internal description of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.dll.pe.file_version": [
+        "Internal version of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.dll.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "Target.process.Ext.dll.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.dll.pe.product": [
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.malware_classification.features": [
+        "Intermediate field included by adding option with subset"
+    ],
+    "Target.process.Ext.malware_classification.features.data.buffer": [
+        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+    ],
+    "Target.process.Ext.malware_classification.features.data.decompressed_size": [
+        "The decompressed size of buffer."
+    ],
+    "Target.process.Ext.malware_classification.features.data.encoding": [
+        "The encoding of buffer (e.g. zlib)."
+    ],
+    "Target.process.Ext.malware_classification.identifier": [
+        "The model's unique identifier."
+    ],
+    "Target.process.Ext.malware_classification.score": [
+        "The score produced by the classification model."
+    ],
+    "Target.process.Ext.malware_classification.threshold": [
+        "The score threshold for the model.  Files that score above this threshold are considered malicious."
+    ],
+    "Target.process.Ext.malware_classification.upx_packed": [
+        "Whether UPX packing was detected."
+    ],
+    "Target.process.Ext.malware_classification.version": [
+        "The version of the model used."
+    ],
+    "Target.process.Ext.memory_region.allocation_base": [
+        "Base address of the memory allocation containing the memory region.",
+        "Base address of the memory allocation containing the memory region."
+    ],
+    "Target.process.Ext.memory_region.allocation_protection": [
+        "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+        "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\"."
+    ],
+    "Target.process.Ext.memory_region.allocation_size": [
+        "Original memory size requested when the memory was allocated.",
+        "Original memory size requested when the memory was allocated."
+    ],
+    "Target.process.Ext.memory_region.allocation_type": [
+        "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+        "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\"."
+    ],
+    "Target.process.Ext.memory_region.bytes_address": [
+        "The address where bytes_compressed begins.",
+        "The address where bytes_compressed begins."
+    ],
+    "Target.process.Ext.memory_region.bytes_allocation_offset": [
+        "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+        "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base."
+    ],
+    "Target.process.Ext.memory_region.bytes_compressed": [
+        "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+        "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times."
+    ],
+    "Target.process.Ext.memory_region.bytes_compressed_present": [
+        "Whether bytes_compressed is present in this event.",
+        "Whether bytes_compressed is present in this event."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.all_names": [
+        "A sequence of signature names matched.",
+        "A sequence of signature names matched."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.identifier": [
+        "malware signature identifier",
+        "malware signature identifier"
+    ],
+    "Target.process.Ext.memory_region.malware_signature.primary": [
+        "The first matching details.",
+        "The first matching details."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.primary.matches": [
+        "The first matching details.",
+        "The first matching details."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.primary.signature.hash": [
+        "hash of file matching signature.",
+        "hash of file matching signature."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.primary.signature.hash.sha256": [
+        "sha256 hash of file matching signature.",
+        "sha256 hash of file matching signature."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.primary.signature.id": [
+        "The id of the first yara rule matched.",
+        "The id of the first yara rule matched."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.primary.signature.name": [
+        "The name of the first yara rule matched.",
+        "The name of the first yara rule matched."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.version": [
+        "malware signature version",
+        "malware signature version"
+    ],
+    "Target.process.Ext.memory_region.mapped_path": [
+        "If the memory corresponds to a file mapping, this is the file's path.",
+        "If the memory corresponds to a file mapping, this is the file's path."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.company": [
+        "Internal company name of the file, provided at compile-time.",
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.description": [
+        "Internal description of the file, provided at compile-time.",
+        "Internal description of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.file_version": [
+        "Internal version of the file, provided at compile-time.",
+        "Internal version of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.original_file_name": [
+        "Internal name of the file, provided at compile-time.",
+        "Internal name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.product": [
+        "Internal product name of the file, provided at compile-time.",
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe_detected": [
+        "Whether the file at mapped_path is an executable.",
+        "Whether the file at mapped_path is an executable."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.company": [
+        "Internal company name of the file, provided at compile-time.",
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.description": [
+        "Internal description of the file, provided at compile-time.",
+        "Internal description of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.file_version": [
+        "Internal version of the file, provided at compile-time.",
+        "Internal version of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.original_file_name": [
+        "Internal name of the file, provided at compile-time.",
+        "Internal name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.product": [
+        "Internal product name of the file, provided at compile-time.",
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "Target.process.Ext.memory_region.memory_pe_detected": [
+        "Whether an executable file was found in memory.",
+        "Whether an executable file was found in memory."
+    ],
+    "Target.process.Ext.memory_region.region_base": [
+        "Base address of the memory region.",
+        "Base address of the memory region."
+    ],
+    "Target.process.Ext.memory_region.region_protection": [
+        "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+        "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\"."
+    ],
+    "Target.process.Ext.memory_region.region_size": [
+        "Size of the memory region.",
+        "Size of the memory region."
+    ],
+    "Target.process.Ext.memory_region.region_start_bytes": [
+        "First 64 bytes at the region base address.",
+        "First 64 bytes at the region base address."
+    ],
+    "Target.process.Ext.memory_region.region_state": [
+        "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+        "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\"."
+    ],
+    "Target.process.Ext.memory_region.strings": [
+        "Array of strings found within the memory region.",
+        "Array of strings found within the memory region."
+    ],
+    "Target.process.Ext.protection": [
+        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
+        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+    ],
+    "Target.process.Ext.services": [
+        "Services running in this process."
+    ],
+    "Target.process.Ext.session": [
+        "Session information for the current process"
+    ],
+    "Target.process.Ext.token.domain": [
+        "Domain of token user."
+    ],
+    "Target.process.Ext.token.elevation": [
+        "Whether the token is elevated or not"
+    ],
+    "Target.process.Ext.token.elevation_type": [
+        "What level of elevation the token has"
+    ],
+    "Target.process.Ext.token.impersonation_level": [
+        "Impersonation level. Only valid for impersonation tokens."
+    ],
+    "Target.process.Ext.token.integrity_level": [
+        "Numeric integrity level."
+    ],
+    "Target.process.Ext.token.integrity_level_name": [
+        "Human readable integrity level.",
+        "Human readable integrity level."
+    ],
+    "Target.process.Ext.token.is_appcontainer": [
+        "Whether or not this is an appcontainer token."
+    ],
+    "Target.process.Ext.token.privileges": [
+        "Array describing the privileges associated with the token."
+    ],
+    "Target.process.Ext.token.privileges.description": [
+        "Description of the privilege."
+    ],
+    "Target.process.Ext.token.privileges.enabled": [
+        "Whether or not the privilege is enabled."
+    ],
+    "Target.process.Ext.token.privileges.name": [
+        "Name of the privilege."
+    ],
+    "Target.process.Ext.token.sid": [
+        "Token user's Security Identifier (SID)."
+    ],
+    "Target.process.Ext.token.type": [
+        "Type of the token, either primary or impersonation."
+    ],
+    "Target.process.Ext.token.user": [
+        "Username of token owner."
+    ],
+    "Target.process.Ext.user": [
+        "User associated with the running process."
+    ],
+    "Target.process.args": [
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
+    ],
+    "Target.process.args_count": [
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
+    ],
+    "Target.process.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.process.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "Target.process.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.process.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.process.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "Target.process.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.process.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.process.command_line": [
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
+    ],
+    "Target.process.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "Target.process.executable": [
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable."
+    ],
+    "Target.process.exit_code": [
+        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start)."
+    ],
+    "Target.process.hash.md5": [
+        "MD5 hash."
+    ],
+    "Target.process.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "Target.process.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "Target.process.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "Target.process.name": [
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar."
+    ],
+    "Target.process.parent.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "Target.process.parent.Ext.architecture": [
+        "Process architecture.  It can differ from host architecture."
+    ],
+    "Target.process.parent.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "Target.process.parent.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.process.parent.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.process.parent.Ext.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.process.parent.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.process.parent.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.process.parent.Ext.dll.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "Target.process.parent.Ext.dll.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "Target.process.parent.Ext.dll.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.process.parent.Ext.dll.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.process.parent.Ext.dll.Ext.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.process.parent.Ext.dll.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.process.parent.Ext.dll.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.process.parent.Ext.dll.Ext.compile_time": [
+        "Timestamp from when the module was compiled."
+    ],
+    "Target.process.parent.Ext.dll.Ext.mapped_address": [
+        "The base address where this module is loaded."
+    ],
+    "Target.process.parent.Ext.dll.Ext.mapped_size": [
+        "The size of this module's memory mapping, in bytes."
+    ],
+    "Target.process.parent.Ext.dll.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.process.parent.Ext.dll.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "Target.process.parent.Ext.dll.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.process.parent.Ext.dll.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.process.parent.Ext.dll.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "Target.process.parent.Ext.dll.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.process.parent.Ext.dll.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.process.parent.Ext.dll.hash.md5": [
+        "MD5 hash."
+    ],
+    "Target.process.parent.Ext.dll.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "Target.process.parent.Ext.dll.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "Target.process.parent.Ext.dll.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "Target.process.parent.Ext.dll.name": [
+        "Name of the library.\nThis generally maps to the name of the file on disk."
+    ],
+    "Target.process.parent.Ext.dll.path": [
+        "Full file path of the library."
+    ],
+    "Target.process.parent.Ext.dll.pe.company": [
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "Target.process.parent.Ext.dll.pe.description": [
+        "Internal description of the file, provided at compile-time."
+    ],
+    "Target.process.parent.Ext.dll.pe.file_version": [
+        "Internal version of the file, provided at compile-time."
+    ],
+    "Target.process.parent.Ext.dll.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "Target.process.parent.Ext.dll.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time."
+    ],
+    "Target.process.parent.Ext.dll.pe.product": [
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "Target.process.parent.Ext.protection": [
+        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+    ],
+    "Target.process.parent.Ext.real": [
+        "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
+    ],
+    "Target.process.parent.Ext.real.pid": [
+        "For process.parent this will be the ppid of the process that actually spawned the current process."
+    ],
+    "Target.process.parent.Ext.token.domain": [
+        "Domain of token user."
+    ],
+    "Target.process.parent.Ext.token.elevation": [
+        "Whether the token is elevated or not"
+    ],
+    "Target.process.parent.Ext.token.elevation_type": [
+        "What level of elevation the token has"
+    ],
+    "Target.process.parent.Ext.token.impersonation_level": [
+        "Impersonation level. Only valid for impersonation tokens."
+    ],
+    "Target.process.parent.Ext.token.integrity_level": [
+        "Numeric integrity level."
+    ],
+    "Target.process.parent.Ext.token.integrity_level_name": [
+        "Human readable integrity level."
+    ],
+    "Target.process.parent.Ext.token.is_appcontainer": [
+        "Whether or not this is an appcontainer token."
+    ],
+    "Target.process.parent.Ext.token.privileges": [
+        "Array describing the privileges associated with the token."
+    ],
+    "Target.process.parent.Ext.token.privileges.description": [
+        "Description of the privilege."
+    ],
+    "Target.process.parent.Ext.token.privileges.enabled": [
+        "Whether or not the privilege is enabled."
+    ],
+    "Target.process.parent.Ext.token.privileges.name": [
+        "Name of the privilege."
+    ],
+    "Target.process.parent.Ext.token.sid": [
+        "Token user's Security Identifier (SID)."
+    ],
+    "Target.process.parent.Ext.token.type": [
+        "Type of the token, either primary or impersonation."
+    ],
+    "Target.process.parent.Ext.token.user": [
+        "Username of token owner."
+    ],
+    "Target.process.parent.Ext.user": [
+        "User associated with the running process."
+    ],
+    "Target.process.parent.args": [
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
+    ],
+    "Target.process.parent.args_count": [
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
+    ],
+    "Target.process.parent.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.process.parent.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "Target.process.parent.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.process.parent.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.process.parent.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "Target.process.parent.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.process.parent.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.process.parent.command_line": [
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
+    ],
+    "Target.process.parent.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "Target.process.parent.executable": [
+        "Absolute path to the process executable."
+    ],
+    "Target.process.parent.exit_code": [
+        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start)."
+    ],
+    "Target.process.parent.hash.md5": [
+        "MD5 hash."
+    ],
+    "Target.process.parent.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "Target.process.parent.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "Target.process.parent.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "Target.process.parent.name": [
+        "Process name.\nSometimes called program name or similar."
+    ],
+    "Target.process.parent.pe.company": [
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "Target.process.parent.pe.description": [
+        "Internal description of the file, provided at compile-time."
+    ],
+    "Target.process.parent.pe.file_version": [
+        "Internal version of the file, provided at compile-time."
+    ],
+    "Target.process.parent.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "Target.process.parent.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time."
+    ],
+    "Target.process.parent.pe.product": [
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "Target.process.parent.pgid": [
+        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to."
+    ],
+    "Target.process.parent.pid": [
+        "Process id."
+    ],
+    "Target.process.parent.ppid": [
+        "Parent process' pid."
+    ],
+    "Target.process.parent.start": [
+        "The time the process started."
+    ],
+    "Target.process.parent.thread.id": [
+        "Thread ID."
+    ],
+    "Target.process.parent.thread.name": [
+        "Thread name."
+    ],
+    "Target.process.parent.title": [
+        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened."
+    ],
+    "Target.process.parent.uptime": [
+        "Seconds the process has been up."
+    ],
+    "Target.process.parent.working_directory": [
+        "The working directory of the process."
+    ],
+    "Target.process.pe.company": [
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "Target.process.pe.description": [
+        "Internal description of the file, provided at compile-time."
+    ],
+    "Target.process.pe.file_version": [
+        "Internal version of the file, provided at compile-time."
+    ],
+    "Target.process.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "Target.process.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time."
+    ],
+    "Target.process.pe.product": [
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "Target.process.pgid": [
+        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to."
+    ],
+    "Target.process.pid": [
+        "Process id.",
+        "Process id."
+    ],
+    "Target.process.ppid": [
+        "Parent process' pid."
+    ],
+    "Target.process.start": [
+        "The time the process started."
+    ],
+    "Target.process.thread.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "Target.process.thread.Ext.call_stack": [
+        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame."
+    ],
+    "Target.process.thread.Ext.call_stack.instruction_pointer": [
+        "The return address of this stack frame."
+    ],
+    "Target.process.thread.Ext.call_stack.memory_section.memory_address": [
+        "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`"
+    ],
+    "Target.process.thread.Ext.call_stack.memory_section.memory_size": [
+        "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`"
+    ],
+    "Target.process.thread.Ext.call_stack.memory_section.protection": [
+        "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
+    ],
+    "Target.process.thread.Ext.call_stack.module_name": [
+        "The name of the DLL/module containing `instruction_pointer`."
+    ],
+    "Target.process.thread.Ext.call_stack.module_path": [
+        "The path to the DLL/module containing `instruction_pointer`."
+    ],
+    "Target.process.thread.Ext.call_stack.rva": [
+        "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
+    ],
+    "Target.process.thread.Ext.call_stack.symbol_info": [
+        "The nearest symbol for `instruction_pointer`."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module": [
+        "The final non-win32 module in the call stack."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.code_signature": [
+        "Code signature of the call_stack_final_user_module."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.hash": [
+        "Hashes of the call_stack_final_user_module."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.hash.sha256": [
+        "The sha256 of the call_stack_final_user_module."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.name": [
+        "The file name of the call_stack_final_user_module."
+    ],
+    "Target.process.thread.Ext.call_stack_final_user_module.path": [
+        "The file path of the call_stack_final_user_module."
+    ],
+    "Target.process.thread.Ext.call_stack_summary": [
+        "Concatentation of the non-repeated modules in the call stack."
+    ],
+    "Target.process.thread.Ext.hardware_breakpoint_set": [
+        "Whether a hardware breakpoint was set for the thread. This field is omitted if false."
+    ],
+    "Target.process.thread.Ext.original_start_address": [
+        "When a trampoline was detected, this indicates the original content for the thread start address in memory."
+    ],
+    "Target.process.thread.Ext.original_start_address_allocation_offset": [
+        "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base."
+    ],
+    "Target.process.thread.Ext.original_start_address_bytes": [
+        "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address."
+    ],
+    "Target.process.thread.Ext.original_start_address_bytes_disasm": [
+        "When a trampoline was detected, this holds the disassembled code at the original thread start address."
+    ],
+    "Target.process.thread.Ext.original_start_address_bytes_disasm_hash": [
+        "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed."
+    ],
+    "Target.process.thread.Ext.original_start_address_module": [
+        "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution."
+    ],
+    "Target.process.thread.Ext.parameter": [
+        "When a thread is created, this is the raw numerical value of its parameter."
+    ],
+    "Target.process.thread.Ext.parameter_bytes_compressed": [
+        "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times."
+    ],
+    "Target.process.thread.Ext.parameter_bytes_compressed_present": [
+        "Whether parameter_bytes_compressed is present in this event."
+    ],
+    "Target.process.thread.Ext.service": [
+        "Service associated with the thread."
+    ],
+    "Target.process.thread.Ext.start": [
+        "The time the thread started."
+    ],
+    "Target.process.thread.Ext.start_address": [
+        "Memory address where the thread began execution."
+    ],
+    "Target.process.thread.Ext.start_address_allocation_offset": [
+        "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base."
+    ],
+    "Target.process.thread.Ext.start_address_bytes": [
+        "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded."
+    ],
+    "Target.process.thread.Ext.start_address_bytes_disasm": [
+        "The bytes at the thread start address, disassembled into human-readable assembly code."
+    ],
+    "Target.process.thread.Ext.start_address_bytes_disasm_hash": [
+        "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed."
+    ],
+    "Target.process.thread.Ext.start_address_module": [
+        "The dll/module where the thread began execution."
+    ],
+    "Target.process.thread.Ext.token.domain": [
+        "Domain of token user."
+    ],
+    "Target.process.thread.Ext.token.elevation": [
+        "Whether the token is elevated or not"
+    ],
+    "Target.process.thread.Ext.token.elevation_type": [
+        "What level of elevation the token has"
+    ],
+    "Target.process.thread.Ext.token.impersonation_level": [
+        "Impersonation level. Only valid for impersonation tokens."
+    ],
+    "Target.process.thread.Ext.token.integrity_level": [
+        "Numeric integrity level."
+    ],
+    "Target.process.thread.Ext.token.integrity_level_name": [
+        "Human readable integrity level."
+    ],
+    "Target.process.thread.Ext.token.is_appcontainer": [
+        "Whether or not this is an appcontainer token."
+    ],
+    "Target.process.thread.Ext.token.privileges": [
+        "Array describing the privileges associated with the token."
+    ],
+    "Target.process.thread.Ext.token.privileges.description": [
+        "Description of the privilege."
+    ],
+    "Target.process.thread.Ext.token.privileges.enabled": [
+        "Whether or not the privilege is enabled."
+    ],
+    "Target.process.thread.Ext.token.privileges.name": [
+        "Name of the privilege."
+    ],
+    "Target.process.thread.Ext.token.sid": [
+        "Token user's Security Identifier (SID)."
+    ],
+    "Target.process.thread.Ext.token.type": [
+        "Type of the token, either primary or impersonation."
+    ],
+    "Target.process.thread.Ext.token.user": [
+        "Username of token owner."
+    ],
+    "Target.process.thread.Ext.uptime": [
+        "Seconds since thread started."
+    ],
+    "Target.process.thread.id": [
+        "Thread ID."
+    ],
+    "Target.process.thread.name": [
+        "Thread name."
+    ],
+    "Target.process.title": [
+        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened."
+    ],
+    "Target.process.uptime": [
+        "Seconds the process has been up."
+    ],
+    "Target.process.working_directory": [
+        "The working directory of the process."
+    ],
+    "agent.ephemeral_id": [
+        "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
+        "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not."
+    ],
+    "agent.id": [
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
+        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id."
+    ],
+    "agent.name": [
+        "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
+        "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
+        "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from."
+    ],
+    "agent.type": [
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
+        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine."
+    ],
+    "agent.version": [
+        "Version of the agent.",
+        "Version of the agent.",
+        "Version of the agent.",
+        "Version of the agent.",
+        "Version of the agent.",
+        "Version of the agent.",
+        "Version of the agent.",
+        "Version of the agent.",
+        "Version of the agent.",
+        "Version of the agent."
+    ],
+    "cloud.account.id": [
+        "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
+        "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier."
+    ],
+    "cloud.instance.name": [
+        "Instance name of the host machine.",
+        "Instance name of the host machine."
+    ],
+    "cloud.project.id": [
+        "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
+        "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id."
+    ],
+    "cloud.provider": [
+        "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
+        "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean."
+    ],
+    "cloud.region": [
+        "Region in which this host, resource, or service is located.",
+        "Region in which this host, resource, or service is located."
+    ],
+    "container.id": [
+        "Unique container id.",
+        "Unique container id."
+    ],
+    "container.image.name": [
+        "Name of the image the container was built on.",
+        "Name of the image the container was built on."
+    ],
+    "container.image.tag": [
+        "Container image tags.",
+        "Container image tags."
+    ],
+    "container.name": [
+        "Container name.",
+        "Container name."
+    ],
+    "data_stream.dataset": [
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name.",
+        "Data stream dataset name."
+    ],
+    "data_stream.namespace": [
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace.",
+        "Data stream namespace."
+    ],
+    "data_stream.type": [
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type.",
+        "Data stream type."
+    ],
+    "destination.geo.city_name": [
+        "City name.",
+        "City name.",
+        "City name.",
+        "City name.",
+        "City name.",
+        "City name.",
+        "City name."
+    ],
+    "destination.geo.continent_code": [
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name."
+    ],
+    "destination.geo.continent_name": [
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent."
+    ],
+    "destination.geo.country_iso_code": [
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code."
+    ],
+    "destination.geo.country_name": [
+        "Country name.",
+        "Country name.",
+        "Country name.",
+        "Country name.",
+        "Country name.",
+        "Country name.",
+        "Country name."
+    ],
+    "destination.geo.location": [
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude."
+    ],
+    "destination.geo.name": [
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
+    ],
+    "destination.geo.postal_code": [
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
+    ],
+    "destination.geo.region_iso_code": [
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code."
+    ],
+    "destination.geo.region_name": [
+        "Region name.",
+        "Region name.",
+        "Region name.",
+        "Region name.",
+        "Region name.",
+        "Region name.",
+        "Region name."
+    ],
+    "destination.geo.timezone": [
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name."
+    ],
+    "destination.ip": [
+        "IP address of the destination (IPv4 or IPv6).",
+        "IP address of the destination (IPv4 or IPv6).",
+        "IP address of the destination (IPv4 or IPv6)."
+    ],
+    "dll.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "dll.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "dll.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "dll.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "dll.Ext.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "dll.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "dll.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "dll.Ext.compile_time": [
+        "Timestamp from when the module was compiled."
+    ],
+    "dll.Ext.malware_classification.features": [
+        "Intermediate field included by adding option with subset"
+    ],
+    "dll.Ext.malware_classification.features.data.buffer": [
+        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+    ],
+    "dll.Ext.malware_classification.features.data.decompressed_size": [
+        "The decompressed size of buffer."
+    ],
+    "dll.Ext.malware_classification.features.data.encoding": [
+        "The encoding of buffer (e.g. zlib)."
+    ],
+    "dll.Ext.malware_classification.identifier": [
+        "The model's unique identifier."
+    ],
+    "dll.Ext.malware_classification.score": [
+        "The score produced by the classification model."
+    ],
+    "dll.Ext.malware_classification.threshold": [
+        "The score threshold for the model.  Files that score above this threshold are considered malicious."
+    ],
+    "dll.Ext.malware_classification.upx_packed": [
+        "Whether UPX packing was detected."
+    ],
+    "dll.Ext.malware_classification.version": [
+        "The version of the model used."
+    ],
+    "dll.Ext.mapped_address": [
+        "The base address where this module is loaded."
+    ],
+    "dll.Ext.mapped_size": [
+        "The size of this module's memory mapping, in bytes."
+    ],
+    "dll.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "dll.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "dll.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "dll.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "dll.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "dll.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "dll.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "dll.hash.md5": [
+        "MD5 hash.",
+        "MD5 hash."
+    ],
+    "dll.hash.sha1": [
+        "SHA1 hash.",
+        "SHA1 hash."
+    ],
+    "dll.hash.sha256": [
+        "SHA256 hash.",
+        "SHA256 hash.",
+        "SHA256 hash."
+    ],
+    "dll.hash.sha512": [
+        "SHA512 hash.",
+        "SHA512 hash."
+    ],
+    "dll.name": [
+        "Name of the library.\nThis generally maps to the name of the file on disk.",
+        "Name of the library.\nThis generally maps to the name of the file on disk."
+    ],
+    "dll.path": [
+        "Full file path of the library.",
+        "Full file path of the library.",
+        "Full file path of the library."
+    ],
+    "dll.pe.company": [
+        "Internal company name of the file, provided at compile-time.",
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "dll.pe.description": [
+        "Internal description of the file, provided at compile-time.",
+        "Internal description of the file, provided at compile-time."
+    ],
+    "dll.pe.file_version": [
+        "Internal version of the file, provided at compile-time.",
+        "Internal version of the file, provided at compile-time."
+    ],
+    "dll.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "dll.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time.",
+        "Internal name of the file, provided at compile-time."
+    ],
+    "dll.pe.product": [
+        "Internal product name of the file, provided at compile-time.",
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "dns.question.name": [
+        "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
+        "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively."
+    ],
+    "dns.question.type": [
+        "The type of record being queried.",
+        "The type of record being queried."
+    ],
+    "ecs.version": [
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
+        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events."
+    ],
+    "elastic.agent": [
+        "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host.",
+        "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
+    ],
+    "elastic.agent.id": [
+        "Unique identifier of this elastic agent (if one exists).",
+        "Unique identifier of this elastic agent (if one exists)."
+    ],
+    "event.action": [
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
+        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer."
+    ],
+    "event.category": [
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
+        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories."
+    ],
+    "event.code": [
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
+        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID."
+    ],
+    "event.created": [
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
+        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used."
+    ],
+    "event.dataset": [
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
+        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name."
+    ],
+    "event.hash": [
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
+        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity."
+    ],
+    "event.id": [
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event.",
+        "Unique ID to describe the event."
+    ],
+    "event.ingested": [
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
+        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`."
+    ],
+    "event.kind": [
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
+        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not."
+    ],
+    "event.module": [
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
+        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module."
+    ],
+    "event.outcome": [
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
+        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense."
+    ],
+    "event.provider": [
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
+        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing)."
+    ],
+    "event.risk_score": [
+        "Risk score or priority of the event (e.g. security solutions). Use your system's original value here."
+    ],
+    "event.sequence": [
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
+        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision."
+    ],
+    "event.severity": [
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
+        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`."
+    ],
+    "event.type": [
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
+        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
+    ],
+    "file.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "file.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "file.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "file.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "file.Ext.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "file.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "file.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "file.Ext.entry_modified": [
+        "Time of last status change.  See `st_ctim` member of `struct stat`."
+    ],
+    "file.Ext.macro.code_page": [
+        "Identifies the character encoding used for this macro.  https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers"
+    ],
+    "file.Ext.macro.collection": [
+        "Object containing hashes for the macro collection."
+    ],
+    "file.Ext.macro.collection.hash.md5": [
+        "MD5 hash."
+    ],
+    "file.Ext.macro.collection.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "file.Ext.macro.collection.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "file.Ext.macro.collection.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "file.Ext.macro.errors": [
+        "Errors that occurred when parsing this document file."
+    ],
+    "file.Ext.macro.errors.count": [
+        "Number of times this error that occurred."
+    ],
+    "file.Ext.macro.errors.error_type": [
+        "The type of parsing error that occurred."
+    ],
+    "file.Ext.macro.file_extension": [
+        "The extension of the file containing this macro (e.g. .docm)"
+    ],
+    "file.Ext.macro.project_file": [
+        "Metadata about the corresponding VBA project file"
+    ],
+    "file.Ext.macro.project_file.hash.md5": [
+        "MD5 hash."
+    ],
+    "file.Ext.macro.project_file.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "file.Ext.macro.project_file.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "file.Ext.macro.project_file.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "file.Ext.macro.stream": [
+        "Streams associated with the document."
+    ],
+    "file.Ext.macro.stream.hash.md5": [
+        "MD5 hash."
+    ],
+    "file.Ext.macro.stream.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "file.Ext.macro.stream.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "file.Ext.macro.stream.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "file.Ext.macro.stream.name": [
+        "Name of the stream."
+    ],
+    "file.Ext.macro.stream.raw_code": [
+        "First 100KB of raw stream binary.  Can be useful to analyze false positives and malicious payloads."
+    ],
+    "file.Ext.macro.stream.raw_code_size": [
+        "The original stream size.  Indicates whether stream.raw_code was truncated."
+    ],
+    "file.Ext.malware_classification.features": [
+        "Intermediate field included by adding option with subset"
+    ],
+    "file.Ext.malware_classification.features.data.buffer": [
+        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+    ],
+    "file.Ext.malware_classification.features.data.decompressed_size": [
+        "The decompressed size of buffer."
+    ],
+    "file.Ext.malware_classification.features.data.encoding": [
+        "The encoding of buffer (e.g. zlib)."
+    ],
+    "file.Ext.malware_classification.identifier": [
+        "The model's unique identifier."
+    ],
+    "file.Ext.malware_classification.score": [
+        "The score produced by the classification model."
+    ],
+    "file.Ext.malware_classification.threshold": [
+        "The score threshold for the model.  Files that score above this threshold are considered malicious."
+    ],
+    "file.Ext.malware_classification.upx_packed": [
+        "Whether UPX packing was detected."
+    ],
+    "file.Ext.malware_classification.version": [
+        "The version of the model used."
+    ],
+    "file.Ext.original": [
+        "Original file information during a modification event.",
+        "Original file information during a modification event."
+    ],
+    "file.Ext.original.gid": [
+        "Primary group ID (GID) of the file.",
+        "Primary group ID (GID) of the file."
+    ],
+    "file.Ext.original.group": [
+        "Primary group name of the file.",
+        "Primary group name of the file."
+    ],
+    "file.Ext.original.mode": [
+        "Original file mode prior to a modification event",
+        "Original file mode prior to a modification event"
+    ],
+    "file.Ext.original.name": [
+        "Original file name prior to a modification event",
+        "Original file name prior to a modification event"
+    ],
+    "file.Ext.original.owner": [
+        "File owner's username.",
+        "File owner's username."
+    ],
+    "file.Ext.original.path": [
+        "Original file path prior to a modification event",
+        "Original file path prior to a modification event"
+    ],
+    "file.Ext.original.uid": [
+        "The user ID (UID) or security identifier (SID) of the file owner.",
+        "The user ID (UID) or security identifier (SID) of the file owner."
+    ],
+    "file.Ext.quarantine_message": [
+        "Message describing quarantine results."
+    ],
+    "file.Ext.quarantine_path": [
+        "Path on endpoint the quarantined file was originally."
+    ],
+    "file.Ext.quarantine_result": [
+        "Boolean representing whether or not file quarantine succeeded."
+    ],
+    "file.Ext.temp_file_path": [
+        "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
+    ],
+    "file.Ext.windows": [
+        "Platform-specific Windows fields",
+        "Platform-specific Windows fields"
+    ],
+    "file.Ext.windows.zone_identifier": [
+        "Windows zone identifier for a file",
+        "Windows zone identifier for a file"
+    ],
+    "file.accessed": [
+        "Last time the file was accessed.\nNote that not all filesystems keep track of access time.",
+        "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+    ],
+    "file.attributes": [
+        "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
+        "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write."
+    ],
+    "file.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "file.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "file.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "file.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "file.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "file.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "file.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "file.created": [
+        "File creation time.\nNote that not all filesystems store the creation time.",
+        "File creation time.\nNote that not all filesystems store the creation time."
+    ],
+    "file.ctime": [
+        "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.",
+        "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+    ],
+    "file.device": [
+        "Device that is the source of the file.",
+        "Device that is the source of the file."
+    ],
+    "file.directory": [
+        "Directory where the file is located. It should include the drive letter, when appropriate.",
+        "Directory where the file is located. It should include the drive letter, when appropriate."
+    ],
+    "file.drive_letter": [
+        "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
+        "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon."
+    ],
+    "file.extension": [
+        "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
+        "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
+    ],
+    "file.gid": [
+        "Primary group ID (GID) of the file.",
+        "Primary group ID (GID) of the file."
+    ],
+    "file.group": [
+        "Primary group name of the file.",
+        "Primary group name of the file."
+    ],
+    "file.hash.md5": [
+        "MD5 hash.",
+        "MD5 hash.",
+        "MD5 hash."
+    ],
+    "file.hash.sha1": [
+        "SHA1 hash.",
+        "SHA1 hash.",
+        "SHA1 hash."
+    ],
+    "file.hash.sha256": [
+        "SHA256 hash.",
+        "SHA256 hash.",
+        "SHA256 hash."
+    ],
+    "file.hash.sha512": [
+        "SHA512 hash.",
+        "SHA512 hash.",
+        "SHA512 hash."
+    ],
+    "file.inode": [
+        "Inode representing the file in the filesystem.",
+        "Inode representing the file in the filesystem."
+    ],
+    "file.mime_type": [
+        "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.",
+        "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+    ],
+    "file.mode": [
+        "Mode of the file in octal representation.",
+        "Mode of the file in octal representation."
+    ],
+    "file.mtime": [
+        "Last time the file content was modified.",
+        "Last time the file content was modified."
+    ],
+    "file.name": [
+        "Name of the file including the extension, without the directory.",
+        "Name of the file including the extension, without the directory.",
+        "Name of the file including the extension, without the directory."
+    ],
+    "file.owner": [
+        "File owner's username.",
+        "File owner's username."
+    ],
+    "file.path": [
+        "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+        "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+        "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
+        "Full path to the file, including the file name. It should include the drive letter, when appropriate."
+    ],
+    "file.pe.Ext.dotnet": [
+        "Whether this file is a .NET PE"
+    ],
+    "file.pe.Ext.sections": [
+        "The file's relevant sections, if it is a PE"
+    ],
+    "file.pe.Ext.sections.hash.md5": [
+        "MD5 hash."
+    ],
+    "file.pe.Ext.sections.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "file.pe.Ext.sections.name": [
+        "The section's name"
+    ],
+    "file.pe.Ext.streams": [
+        "The file's streams, if it is a PE"
+    ],
+    "file.pe.Ext.streams.hash.md5": [
+        "MD5 hash."
+    ],
+    "file.pe.Ext.streams.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "file.pe.Ext.streams.name": [
+        "The stream's name"
+    ],
+    "file.pe.company": [
+        "Internal company name of the file, provided at compile-time.",
+        "Internal company name of the file, provided at compile-time.",
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "file.pe.description": [
+        "Internal description of the file, provided at compile-time.",
+        "Internal description of the file, provided at compile-time.",
+        "Internal description of the file, provided at compile-time."
+    ],
+    "file.pe.file_version": [
+        "Internal version of the file, provided at compile-time.",
+        "Internal version of the file, provided at compile-time.",
+        "Internal version of the file, provided at compile-time."
+    ],
+    "file.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "file.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time.",
+        "Internal name of the file, provided at compile-time.",
+        "Internal name of the file, provided at compile-time."
+    ],
+    "file.pe.product": [
+        "Internal product name of the file, provided at compile-time.",
+        "Internal product name of the file, provided at compile-time.",
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "file.size": [
+        "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
+        "File size in bytes.\nOnly relevant when `file.type` is \"file\"."
+    ],
+    "file.target_path": [
+        "Target path for symlinks.",
+        "Target path for symlinks."
+    ],
+    "file.type": [
+        "File type (file, dir, or symlink).",
+        "File type (file, dir, or symlink)."
+    ],
+    "file.uid": [
+        "The user ID (UID) or security identifier (SID) of the file owner.",
+        "The user ID (UID) or security identifier (SID) of the file owner."
+    ],
+    "group.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "group.Ext.real": [
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations."
+    ],
+    "group.Ext.real.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "group.Ext.real.name": [
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "group.domain": [
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+    ],
+    "group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "group.name": [
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "host.architecture": [
+        "Operating system architecture.",
+        "Operating system architecture.",
+        "Operating system architecture.",
+        "Operating system architecture.",
+        "Operating system architecture.",
+        "Operating system architecture.",
+        "Operating system architecture.",
+        "Operating system architecture.",
+        "Operating system architecture.",
+        "Operating system architecture.",
+        "Operating system architecture."
+    ],
+    "host.boot.id": [
+        "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
+        "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container."
+    ],
+    "host.domain": [
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
+        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider."
+    ],
+    "host.geo.city_name": [
+        "City name."
+    ],
+    "host.geo.continent_code": [
+        "Two-letter code representing continent's name."
+    ],
+    "host.geo.continent_name": [
+        "Name of the continent."
+    ],
+    "host.geo.country_iso_code": [
+        "Country ISO code."
+    ],
+    "host.geo.country_name": [
+        "Country name."
+    ],
+    "host.geo.location": [
+        "Longitude and latitude."
+    ],
+    "host.geo.name": [
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
+    ],
+    "host.geo.postal_code": [
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
+    ],
+    "host.geo.region_iso_code": [
+        "Region ISO code."
+    ],
+    "host.geo.region_name": [
+        "Region name."
+    ],
+    "host.geo.timezone": [
+        "The time zone of the location, such as IANA time zone name."
+    ],
+    "host.hostname": [
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
+        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
+    ],
+    "host.id": [
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
+        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
+    ],
+    "host.ip": [
+        "Host ip addresses.",
+        "Host ip addresses.",
+        "Host ip addresses.",
+        "Host ip addresses.",
+        "Host ip addresses.",
+        "Host ip addresses.",
+        "Host ip addresses.",
+        "Host ip addresses.",
+        "Host ip addresses.",
+        "Host ip addresses.",
+        "Host ip addresses."
+    ],
+    "host.mac": [
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
+        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen."
+    ],
+    "host.name": [
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
+        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
+    ],
+    "host.os.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "host.os.Ext.variant": [
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
+        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field."
+    ],
+    "host.os.family": [
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows).",
+        "OS family (such as redhat, debian, freebsd, windows)."
+    ],
+    "host.os.full": [
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name.",
+        "Operating system name, including the version or code name."
+    ],
+    "host.os.kernel": [
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string.",
+        "Operating system kernel version as a raw string."
+    ],
+    "host.os.name": [
+        "Operating system name, without the version.",
+        "Operating system name, without the version.",
+        "Operating system name, without the version.",
+        "Operating system name, without the version.",
+        "Operating system name, without the version.",
+        "Operating system name, without the version.",
+        "Operating system name, without the version.",
+        "Operating system name, without the version.",
+        "Operating system name, without the version.",
+        "Operating system name, without the version.",
+        "Operating system name, without the version."
+    ],
+    "host.os.platform": [
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows).",
+        "Operating system platform (such centos, ubuntu, windows)."
+    ],
+    "host.os.type": [
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
+        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition."
+    ],
+    "host.os.version": [
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string.",
+        "Operating system version as a raw string."
+    ],
+    "host.pid_ns_ino": [
+        "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
+        "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h."
+    ],
+    "host.type": [
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
+        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
+    ],
+    "host.uptime": [
+        "Seconds the host has been up.",
+        "Seconds the host has been up.",
+        "Seconds the host has been up.",
+        "Seconds the host has been up.",
+        "Seconds the host has been up.",
+        "Seconds the host has been up.",
+        "Seconds the host has been up.",
+        "Seconds the host has been up.",
+        "Seconds the host has been up.",
+        "Seconds the host has been up."
+    ],
+    "host.user.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "host.user.Ext.real": [
+        "User info prior to any setuid operations."
+    ],
+    "host.user.Ext.real.id": [
+        "One or multiple unique identifiers of the user."
+    ],
+    "host.user.Ext.real.name": [
+        "Short name or login of the user."
+    ],
+    "host.user.domain": [
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+    ],
+    "host.user.email": [
+        "User email address."
+    ],
+    "host.user.full_name": [
+        "User's full name, if available."
+    ],
+    "host.user.group.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "host.user.group.Ext.real": [
+        "Group info prior to any setgid operations."
+    ],
+    "host.user.group.Ext.real.id": [
+        "Unique identifier for the group on the system/platform."
+    ],
+    "host.user.group.Ext.real.name": [
+        "Name of the group."
+    ],
+    "host.user.group.domain": [
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+    ],
+    "host.user.group.id": [
+        "Unique identifier for the group on the system/platform."
+    ],
+    "host.user.group.name": [
+        "Name of the group."
+    ],
+    "host.user.hash": [
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+    ],
+    "host.user.id": [
+        "Unique identifier of the user."
+    ],
+    "host.user.name": [
+        "Short name or login of the user."
+    ],
+    "orchestrator.cluster.name": [
+        "Name of the cluster.",
+        "Name of the cluster."
+    ],
+    "orchestrator.namespace": [
+        "Namespace in which the action is taking place.",
+        "Namespace in which the action is taking place."
+    ],
+    "orchestrator.resource.name": [
+        "Name of the resource being acted upon.",
+        "Name of the resource being acted upon."
+    ],
+    "orchestrator.resource.type": [
+        "Type of resource being acted upon.",
+        "Type of resource being acted upon."
+    ],
+    "process.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "process.Ext.ancestry": [
+        "An array of entity_ids indicating the ancestors for this event",
+        "An array of entity_ids indicating the ancestors for this event",
+        "An array of entity_ids indicating the ancestors for this event",
+        "An array of entity_ids indicating the ancestors for this event",
+        "An array of entity_ids indicating the ancestors for this event",
+        "An array of entity_ids indicating the ancestors for this event",
+        "An array of entity_ids indicating the ancestors for this event",
+        "An array of entity_ids indicating the ancestors for this event"
+    ],
+    "process.Ext.api.behaviors": [
+        "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
+        "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called"
+    ],
+    "process.Ext.api.name": [
+        "The name of the API, usually the name of the function or system call.",
+        "The name of the API, usually the name of the function or system call."
+    ],
+    "process.Ext.api.summary": [
+        "The summary of the API call and its parameters.",
+        "The summary of the API call and its parameters."
+    ],
+    "process.Ext.architecture": [
+        "Process architecture.  It can differ from host architecture.",
+        "Process architecture.  It can differ from host architecture."
+    ],
+    "process.Ext.authentication_id": [
+        "Process authentication ID",
+        "Process authentication ID",
+        "Process authentication ID"
+    ],
+    "process.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "process.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "process.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.Ext.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "process.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "process.Ext.created_suspended": [
+        "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+        "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
+        "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls."
+    ],
+    "process.Ext.dll.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "process.Ext.dll.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "process.Ext.dll.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "process.Ext.dll.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.Ext.dll.Ext.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "process.Ext.dll.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.Ext.dll.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "process.Ext.dll.Ext.compile_time": [
+        "Timestamp from when the module was compiled."
+    ],
+    "process.Ext.dll.Ext.mapped_address": [
+        "The base address where this module is loaded.",
+        "The base address where this module is loaded."
+    ],
+    "process.Ext.dll.Ext.mapped_size": [
+        "The size of this module's memory mapping, in bytes.",
+        "The size of this module's memory mapping, in bytes."
+    ],
+    "process.Ext.dll.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "process.Ext.dll.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "process.Ext.dll.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.Ext.dll.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "process.Ext.dll.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "process.Ext.dll.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.Ext.dll.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "process.Ext.dll.hash.md5": [
+        "MD5 hash."
+    ],
+    "process.Ext.dll.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "process.Ext.dll.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "process.Ext.dll.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "process.Ext.dll.name": [
+        "Name of the library.\nThis generally maps to the name of the file on disk.",
+        "Name of the library.\nThis generally maps to the name of the file on disk."
+    ],
+    "process.Ext.dll.path": [
+        "Full file path of the library.",
+        "Full file path of the library."
+    ],
+    "process.Ext.dll.pe.company": [
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "process.Ext.dll.pe.description": [
+        "Internal description of the file, provided at compile-time."
+    ],
+    "process.Ext.dll.pe.file_version": [
+        "Internal version of the file, provided at compile-time."
+    ],
+    "process.Ext.dll.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "process.Ext.dll.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time."
+    ],
+    "process.Ext.dll.pe.product": [
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "process.Ext.malware_classification.features": [
+        "Intermediate field included by adding option with subset"
+    ],
+    "process.Ext.malware_classification.features.data.buffer": [
+        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+    ],
+    "process.Ext.malware_classification.features.data.decompressed_size": [
+        "The decompressed size of buffer."
+    ],
+    "process.Ext.malware_classification.features.data.encoding": [
+        "The encoding of buffer (e.g. zlib)."
+    ],
+    "process.Ext.malware_classification.identifier": [
+        "The model's unique identifier."
+    ],
+    "process.Ext.malware_classification.score": [
+        "The score produced by the classification model."
+    ],
+    "process.Ext.malware_classification.threshold": [
+        "The score threshold for the model.  Files that score above this threshold are considered malicious."
+    ],
+    "process.Ext.malware_classification.upx_packed": [
+        "Whether UPX packing was detected."
+    ],
+    "process.Ext.malware_classification.version": [
+        "The version of the model used."
+    ],
+    "process.Ext.memory_region.allocation_base": [
+        "Base address of the memory allocation containing the memory region.",
+        "Base address of the memory allocation containing the memory region."
+    ],
+    "process.Ext.memory_region.allocation_protection": [
+        "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
+        "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\"."
+    ],
+    "process.Ext.memory_region.allocation_size": [
+        "Original memory size requested when the memory was allocated.",
+        "Original memory size requested when the memory was allocated."
+    ],
+    "process.Ext.memory_region.allocation_type": [
+        "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
+        "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\"."
+    ],
+    "process.Ext.memory_region.bytes_address": [
+        "The address where bytes_compressed begins.",
+        "The address where bytes_compressed begins."
+    ],
+    "process.Ext.memory_region.bytes_allocation_offset": [
+        "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
+        "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base."
+    ],
+    "process.Ext.memory_region.bytes_compressed": [
+        "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
+        "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times."
+    ],
+    "process.Ext.memory_region.bytes_compressed_present": [
+        "Whether bytes_compressed is present in this event.",
+        "Whether bytes_compressed is present in this event."
+    ],
+    "process.Ext.memory_region.malware_signature.all_names": [
+        "A sequence of signature names matched.",
+        "A sequence of signature names matched."
+    ],
+    "process.Ext.memory_region.malware_signature.identifier": [
+        "malware signature identifier",
+        "malware signature identifier"
+    ],
+    "process.Ext.memory_region.malware_signature.primary": [
+        "The first matching details.",
+        "The first matching details."
+    ],
+    "process.Ext.memory_region.malware_signature.primary.matches": [
+        "The first matching details.",
+        "The first matching details."
+    ],
+    "process.Ext.memory_region.malware_signature.primary.signature.hash": [
+        "hash of file matching signature.",
+        "hash of file matching signature."
+    ],
+    "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256": [
+        "sha256 hash of file matching signature.",
+        "sha256 hash of file matching signature."
+    ],
+    "process.Ext.memory_region.malware_signature.primary.signature.id": [
+        "The id of the first yara rule matched.",
+        "The id of the first yara rule matched."
+    ],
+    "process.Ext.memory_region.malware_signature.primary.signature.name": [
+        "The name of the first yara rule matched.",
+        "The name of the first yara rule matched."
+    ],
+    "process.Ext.memory_region.malware_signature.version": [
+        "malware signature version",
+        "malware signature version"
+    ],
+    "process.Ext.memory_region.mapped_path": [
+        "If the memory corresponds to a file mapping, this is the file's path.",
+        "If the memory corresponds to a file mapping, this is the file's path."
+    ],
+    "process.Ext.memory_region.mapped_pe.company": [
+        "Internal company name of the file, provided at compile-time.",
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.mapped_pe.description": [
+        "Internal description of the file, provided at compile-time.",
+        "Internal description of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.mapped_pe.file_version": [
+        "Internal version of the file, provided at compile-time.",
+        "Internal version of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.mapped_pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "process.Ext.memory_region.mapped_pe.original_file_name": [
+        "Internal name of the file, provided at compile-time.",
+        "Internal name of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.mapped_pe.product": [
+        "Internal product name of the file, provided at compile-time.",
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.mapped_pe_detected": [
+        "Whether the file at mapped_path is an executable.",
+        "Whether the file at mapped_path is an executable."
+    ],
+    "process.Ext.memory_region.memory_pe.company": [
+        "Internal company name of the file, provided at compile-time.",
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.memory_pe.description": [
+        "Internal description of the file, provided at compile-time.",
+        "Internal description of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.memory_pe.file_version": [
+        "Internal version of the file, provided at compile-time.",
+        "Internal version of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.memory_pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "process.Ext.memory_region.memory_pe.original_file_name": [
+        "Internal name of the file, provided at compile-time.",
+        "Internal name of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.memory_pe.product": [
+        "Internal product name of the file, provided at compile-time.",
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "process.Ext.memory_region.memory_pe_detected": [
+        "Whether an executable file was found in memory.",
+        "Whether an executable file was found in memory."
+    ],
+    "process.Ext.memory_region.region_base": [
+        "Base address of the memory region.",
+        "Base address of the memory region."
+    ],
+    "process.Ext.memory_region.region_protection": [
+        "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
+        "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\"."
+    ],
+    "process.Ext.memory_region.region_size": [
+        "Size of the memory region.",
+        "Size of the memory region."
+    ],
+    "process.Ext.memory_region.region_start_bytes": [
+        "First 64 bytes at the region base address.",
+        "First 64 bytes at the region base address."
+    ],
+    "process.Ext.memory_region.region_state": [
+        "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
+        "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\"."
+    ],
+    "process.Ext.memory_region.strings": [
+        "Array of strings found within the memory region.",
+        "Array of strings found within the memory region."
+    ],
+    "process.Ext.protection": [
+        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
+        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
+        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
+        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+    ],
+    "process.Ext.services": [
+        "Services running in this process."
+    ],
+    "process.Ext.session": [
+        "Session information for the current process",
+        "Session information for the current process"
+    ],
+    "process.Ext.token.domain": [
+        "Domain of token user."
+    ],
+    "process.Ext.token.elevation": [
+        "Whether the token is elevated or not",
+        "Whether the token is elevated or not"
+    ],
+    "process.Ext.token.elevation_type": [
+        "What level of elevation the token has",
+        "What level of elevation the token has"
+    ],
+    "process.Ext.token.impersonation_level": [
+        "Impersonation level. Only valid for impersonation tokens."
+    ],
+    "process.Ext.token.integrity_level": [
+        "Numeric integrity level."
+    ],
+    "process.Ext.token.integrity_level_name": [
+        "Human readable integrity level.",
+        "Human readable integrity level.",
+        "Human readable integrity level."
+    ],
+    "process.Ext.token.is_appcontainer": [
+        "Whether or not this is an appcontainer token."
+    ],
+    "process.Ext.token.privileges": [
+        "Array describing the privileges associated with the token."
+    ],
+    "process.Ext.token.privileges.description": [
+        "Description of the privilege."
+    ],
+    "process.Ext.token.privileges.enabled": [
+        "Whether or not the privilege is enabled."
+    ],
+    "process.Ext.token.privileges.name": [
+        "Name of the privilege."
+    ],
+    "process.Ext.token.sid": [
+        "Token user's Security Identifier (SID)."
+    ],
+    "process.Ext.token.type": [
+        "Type of the token, either primary or impersonation."
+    ],
+    "process.Ext.token.user": [
+        "Username of token owner."
+    ],
+    "process.Ext.user": [
+        "User associated with the running process."
+    ],
+    "process.args": [
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
+    ],
+    "process.args_count": [
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
+    ],
+    "process.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "process.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "process.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "process.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "process.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "process.command_line": [
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
+    ],
+    "process.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.entry_leader.args": [
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
+    ],
+    "process.entry_leader.args_count": [
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
+    ],
+    "process.entry_leader.command_line": [
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
+    ],
+    "process.entry_leader.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.entry_leader.entry_meta.source.ip": [
+        "IP address of the source (IPv4 or IPv6).",
+        "IP address of the source (IPv4 or IPv6)."
+    ],
+    "process.entry_leader.entry_meta.type": [
+        "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader.",
+        "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
+    ],
+    "process.entry_leader.executable": [
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable."
+    ],
+    "process.entry_leader.group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.entry_leader.group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.entry_leader.interactive": [
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
+    ],
+    "process.entry_leader.name": [
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar."
+    ],
+    "process.entry_leader.parent.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.entry_leader.parent.pid": [
+        "Process id.",
+        "Process id."
+    ],
+    "process.entry_leader.parent.session_leader.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.entry_leader.parent.session_leader.pid": [
+        "Process id.",
+        "Process id."
+    ],
+    "process.entry_leader.parent.session_leader.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.entry_leader.parent.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.entry_leader.pid": [
+        "Process id.",
+        "Process id."
+    ],
+    "process.entry_leader.real_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.entry_leader.real_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.entry_leader.real_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.entry_leader.real_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.entry_leader.same_as_process": [
+        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`."
+    ],
+    "process.entry_leader.saved_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.entry_leader.saved_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.entry_leader.saved_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.entry_leader.saved_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.entry_leader.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.entry_leader.supplemental_groups.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.entry_leader.supplemental_groups.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.entry_leader.tty": [
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+    ],
+    "process.entry_leader.tty.char_device.major": [
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
+    ],
+    "process.entry_leader.tty.char_device.minor": [
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
+    ],
+    "process.entry_leader.user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.entry_leader.user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.entry_leader.working_directory": [
+        "The working directory of the process.",
+        "The working directory of the process."
+    ],
+    "process.env_vars": [
+        "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
+        "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information."
+    ],
+    "process.executable": [
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable."
+    ],
+    "process.exit_code": [
+        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start)."
+    ],
+    "process.group_leader.args": [
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
+    ],
+    "process.group_leader.args_count": [
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
+    ],
+    "process.group_leader.command_line": [
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
+    ],
+    "process.group_leader.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.group_leader.executable": [
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable."
+    ],
+    "process.group_leader.group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.group_leader.group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.group_leader.interactive": [
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
+    ],
+    "process.group_leader.name": [
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar."
+    ],
+    "process.group_leader.pid": [
+        "Process id.",
+        "Process id."
+    ],
+    "process.group_leader.real_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.group_leader.real_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.group_leader.real_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.group_leader.real_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.group_leader.same_as_process": [
+        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`."
+    ],
+    "process.group_leader.saved_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.group_leader.saved_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.group_leader.saved_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.group_leader.saved_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.group_leader.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.group_leader.supplemental_groups.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.group_leader.supplemental_groups.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.group_leader.tty": [
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+    ],
+    "process.group_leader.tty.char_device.major": [
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
+    ],
+    "process.group_leader.tty.char_device.minor": [
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
+    ],
+    "process.group_leader.user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.group_leader.user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.group_leader.working_directory": [
+        "The working directory of the process.",
+        "The working directory of the process."
+    ],
+    "process.hash.md5": [
+        "MD5 hash.",
+        "MD5 hash."
+    ],
+    "process.hash.sha1": [
+        "SHA1 hash.",
+        "SHA1 hash."
+    ],
+    "process.hash.sha256": [
+        "SHA256 hash.",
+        "SHA256 hash."
+    ],
+    "process.hash.sha512": [
+        "SHA512 hash.",
+        "SHA512 hash."
+    ],
+    "process.interactive": [
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
+    ],
+    "process.name": [
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar."
+    ],
+    "process.parent.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "process.parent.Ext.architecture": [
+        "Process architecture.  It can differ from host architecture.",
+        "Process architecture.  It can differ from host architecture."
+    ],
+    "process.parent.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset.",
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "process.parent.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "process.parent.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.parent.Ext.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "process.parent.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.parent.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "process.parent.Ext.dll.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "process.parent.Ext.dll.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "process.parent.Ext.dll.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "process.parent.Ext.dll.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.parent.Ext.dll.Ext.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "process.parent.Ext.dll.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.parent.Ext.dll.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "process.parent.Ext.dll.Ext.compile_time": [
+        "Timestamp from when the module was compiled."
+    ],
+    "process.parent.Ext.dll.Ext.mapped_address": [
+        "The base address where this module is loaded."
+    ],
+    "process.parent.Ext.dll.Ext.mapped_size": [
+        "The size of this module's memory mapping, in bytes."
+    ],
+    "process.parent.Ext.dll.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "process.parent.Ext.dll.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "process.parent.Ext.dll.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.parent.Ext.dll.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "process.parent.Ext.dll.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "process.parent.Ext.dll.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.parent.Ext.dll.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "process.parent.Ext.dll.hash.md5": [
+        "MD5 hash."
+    ],
+    "process.parent.Ext.dll.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "process.parent.Ext.dll.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "process.parent.Ext.dll.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "process.parent.Ext.dll.name": [
+        "Name of the library.\nThis generally maps to the name of the file on disk."
+    ],
+    "process.parent.Ext.dll.path": [
+        "Full file path of the library."
+    ],
+    "process.parent.Ext.dll.pe.company": [
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "process.parent.Ext.dll.pe.description": [
+        "Internal description of the file, provided at compile-time."
+    ],
+    "process.parent.Ext.dll.pe.file_version": [
+        "Internal version of the file, provided at compile-time."
+    ],
+    "process.parent.Ext.dll.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "process.parent.Ext.dll.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time."
+    ],
+    "process.parent.Ext.dll.pe.product": [
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "process.parent.Ext.protection": [
+        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
+        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
+    ],
+    "process.parent.Ext.real": [
+        "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent.",
+        "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
+    ],
+    "process.parent.Ext.real.pid": [
+        "For process.parent this will be the ppid of the process that actually spawned the current process.",
+        "For process.parent this will be the ppid of the process that actually spawned the current process."
+    ],
+    "process.parent.Ext.token.domain": [
+        "Domain of token user."
+    ],
+    "process.parent.Ext.token.elevation": [
+        "Whether the token is elevated or not"
+    ],
+    "process.parent.Ext.token.elevation_type": [
+        "What level of elevation the token has"
+    ],
+    "process.parent.Ext.token.impersonation_level": [
+        "Impersonation level. Only valid for impersonation tokens."
+    ],
+    "process.parent.Ext.token.integrity_level": [
+        "Numeric integrity level."
+    ],
+    "process.parent.Ext.token.integrity_level_name": [
+        "Human readable integrity level."
+    ],
+    "process.parent.Ext.token.is_appcontainer": [
+        "Whether or not this is an appcontainer token."
+    ],
+    "process.parent.Ext.token.privileges": [
+        "Array describing the privileges associated with the token."
+    ],
+    "process.parent.Ext.token.privileges.description": [
+        "Description of the privilege."
+    ],
+    "process.parent.Ext.token.privileges.enabled": [
+        "Whether or not the privilege is enabled."
+    ],
+    "process.parent.Ext.token.privileges.name": [
+        "Name of the privilege."
+    ],
+    "process.parent.Ext.token.sid": [
+        "Token user's Security Identifier (SID)."
+    ],
+    "process.parent.Ext.token.type": [
+        "Type of the token, either primary or impersonation."
+    ],
+    "process.parent.Ext.token.user": [
+        "Username of token owner."
+    ],
+    "process.parent.Ext.user": [
+        "User associated with the running process.",
+        "User associated with the running process."
+    ],
+    "process.parent.args": [
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
+    ],
+    "process.parent.args_count": [
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
+    ],
+    "process.parent.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "process.parent.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "process.parent.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.parent.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "process.parent.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "process.parent.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.parent.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "process.parent.command_line": [
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
+    ],
+    "process.parent.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.parent.executable": [
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable."
+    ],
+    "process.parent.exit_code": [
+        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
+        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start)."
+    ],
+    "process.parent.group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.parent.group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.parent.group_leader.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.parent.group_leader.pid": [
+        "Process id.",
+        "Process id."
+    ],
+    "process.parent.group_leader.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.parent.hash.md5": [
+        "MD5 hash.",
+        "MD5 hash."
+    ],
+    "process.parent.hash.sha1": [
+        "SHA1 hash.",
+        "SHA1 hash."
+    ],
+    "process.parent.hash.sha256": [
+        "SHA256 hash.",
+        "SHA256 hash."
+    ],
+    "process.parent.hash.sha512": [
+        "SHA512 hash.",
+        "SHA512 hash."
+    ],
+    "process.parent.interactive": [
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
+    ],
+    "process.parent.name": [
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar."
+    ],
+    "process.parent.pe.company": [
+        "Internal company name of the file, provided at compile-time.",
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "process.parent.pe.description": [
+        "Internal description of the file, provided at compile-time.",
+        "Internal description of the file, provided at compile-time."
+    ],
+    "process.parent.pe.file_version": [
+        "Internal version of the file, provided at compile-time.",
+        "Internal version of the file, provided at compile-time."
+    ],
+    "process.parent.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "process.parent.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time.",
+        "Internal name of the file, provided at compile-time."
+    ],
+    "process.parent.pe.product": [
+        "Internal product name of the file, provided at compile-time.",
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "process.parent.pgid": [
+        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to."
+    ],
+    "process.parent.pid": [
+        "Process id.",
+        "Process id.",
+        "Process id."
+    ],
+    "process.parent.ppid": [
+        "Parent process' pid.",
+        "Parent process' pid."
+    ],
+    "process.parent.real_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.parent.real_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.parent.real_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.parent.real_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.parent.saved_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.parent.saved_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.parent.saved_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.parent.saved_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.parent.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.parent.supplemental_groups.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.parent.supplemental_groups.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.parent.thread.id": [
+        "Thread ID.",
+        "Thread ID."
+    ],
+    "process.parent.thread.name": [
+        "Thread name.",
+        "Thread name."
+    ],
+    "process.parent.title": [
+        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened."
+    ],
+    "process.parent.tty": [
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+    ],
+    "process.parent.tty.char_device.major": [
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
+    ],
+    "process.parent.tty.char_device.minor": [
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
+    ],
+    "process.parent.uptime": [
+        "Seconds the process has been up.",
+        "Seconds the process has been up."
+    ],
+    "process.parent.user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.parent.user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.parent.working_directory": [
+        "The working directory of the process.",
+        "The working directory of the process."
+    ],
+    "process.pe.company": [
+        "Internal company name of the file, provided at compile-time.",
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "process.pe.description": [
+        "Internal description of the file, provided at compile-time.",
+        "Internal description of the file, provided at compile-time."
+    ],
+    "process.pe.file_version": [
+        "Internal version of the file, provided at compile-time.",
+        "Internal version of the file, provided at compile-time."
+    ],
+    "process.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "process.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time.",
+        "Internal name of the file, provided at compile-time."
+    ],
+    "process.pe.product": [
+        "Internal product name of the file, provided at compile-time.",
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "process.pgid": [
+        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
+        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to."
+    ],
+    "process.pid": [
+        "Process id.",
+        "Process id.",
+        "Process id.",
+        "Process id.",
+        "Process id.",
+        "Process id.",
+        "Process id.",
+        "Process id."
+    ],
+    "process.ppid": [
+        "Parent process' pid.",
+        "Parent process' pid.",
+        "Parent process' pid."
+    ],
+    "process.previous.args": [
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
+    ],
+    "process.previous.args_count": [
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
+    ],
+    "process.previous.executable": [
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable."
+    ],
+    "process.real_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.real_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.real_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.real_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.saved_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.saved_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.saved_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.saved_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.session_leader.args": [
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
+        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
+    ],
+    "process.session_leader.args_count": [
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
+        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
+    ],
+    "process.session_leader.command_line": [
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
+        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
+    ],
+    "process.session_leader.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.session_leader.executable": [
+        "Absolute path to the process executable.",
+        "Absolute path to the process executable."
+    ],
+    "process.session_leader.group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.session_leader.group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.session_leader.interactive": [
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
+        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
+    ],
+    "process.session_leader.name": [
+        "Process name.\nSometimes called program name or similar.",
+        "Process name.\nSometimes called program name or similar."
+    ],
+    "process.session_leader.parent.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.session_leader.parent.pid": [
+        "Process id.",
+        "Process id."
+    ],
+    "process.session_leader.parent.session_leader.entity_id": [
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
+        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
+    ],
+    "process.session_leader.parent.session_leader.pid": [
+        "Process id.",
+        "Process id."
+    ],
+    "process.session_leader.parent.session_leader.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.session_leader.parent.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.session_leader.pid": [
+        "Process id.",
+        "Process id."
+    ],
+    "process.session_leader.real_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.session_leader.real_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.session_leader.real_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.session_leader.real_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.session_leader.same_as_process": [
+        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
+        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`."
+    ],
+    "process.session_leader.saved_group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.session_leader.saved_group.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.session_leader.saved_user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.session_leader.saved_user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.session_leader.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.session_leader.supplemental_groups.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.session_leader.supplemental_groups.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.session_leader.tty": [
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+    ],
+    "process.session_leader.tty.char_device.major": [
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
+    ],
+    "process.session_leader.tty.char_device.minor": [
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
+    ],
+    "process.session_leader.user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.session_leader.user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.session_leader.working_directory": [
+        "The working directory of the process.",
+        "The working directory of the process."
+    ],
+    "process.start": [
+        "The time the process started.",
+        "The time the process started."
+    ],
+    "process.supplemental_groups.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.supplemental_groups.name": [
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "process.thread.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "process.thread.Ext.call_stack": [
+        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
+        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame."
+    ],
+    "process.thread.Ext.call_stack.instruction_pointer": [
+        "The return address of this stack frame.",
+        "The return address of this stack frame."
+    ],
+    "process.thread.Ext.call_stack.memory_section.memory_address": [
+        "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`"
+    ],
+    "process.thread.Ext.call_stack.memory_section.memory_size": [
+        "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`"
+    ],
+    "process.thread.Ext.call_stack.memory_section.protection": [
+        "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
+    ],
+    "process.thread.Ext.call_stack.module_name": [
+        "The name of the DLL/module containing `instruction_pointer`."
+    ],
+    "process.thread.Ext.call_stack.module_path": [
+        "The path to the DLL/module containing `instruction_pointer`.",
+        "The path to the DLL/module containing `instruction_pointer`."
+    ],
+    "process.thread.Ext.call_stack.rva": [
+        "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
+    ],
+    "process.thread.Ext.call_stack.symbol_info": [
+        "The nearest symbol for `instruction_pointer`.",
+        "The nearest symbol for `instruction_pointer`.",
+        "The nearest symbol for `instruction_pointer`.",
+        "The nearest symbol for `instruction_pointer`.",
+        "The nearest symbol for `instruction_pointer`."
+    ],
+    "process.thread.Ext.call_stack_final_hook_module": [
+        "The module that installed the final API hook in the call stack.",
+        "The module that installed the final API hook in the call stack."
+    ],
+    "process.thread.Ext.call_stack_final_hook_module.code_signature": [
+        "Code signature of the call_stack_final_hook_module.",
+        "Code signature of the call_stack_final_hook_module."
+    ],
+    "process.thread.Ext.call_stack_final_hook_module.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "process.thread.Ext.call_stack_final_hook_module.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.thread.Ext.call_stack_final_hook_module.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "process.thread.Ext.call_stack_final_hook_module.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.thread.Ext.call_stack_final_hook_module.hash": [
+        "Hashes of the call_stack_final_hook_module.",
+        "Hashes of the call_stack_final_hook_module."
+    ],
+    "process.thread.Ext.call_stack_final_hook_module.hash.sha256": [
+        "The sha256 of the call_stack_final_hook_module.",
+        "The sha256 of the call_stack_final_hook_module."
+    ],
+    "process.thread.Ext.call_stack_final_hook_module.path": [
+        "The file path of the call_stack_final_hook_module.",
+        "The file path of the call_stack_final_hook_module."
+    ],
+    "process.thread.Ext.call_stack_final_user_module": [
+        "The final non-win32 module in the call stack.",
+        "The final non-win32 module in the call stack."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.code_signature": [
+        "Code signature of the call_stack_final_user_module.",
+        "Code signature of the call_stack_final_user_module."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.code_signature.exists": [
+        "Boolean to capture if a signature is present.",
+        "Boolean to capture if a signature is present."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.code_signature.subject_name": [
+        "Subject name of the code signer",
+        "Subject name of the code signer"
+    ],
+    "process.thread.Ext.call_stack_final_user_module.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.hash": [
+        "Hashes of the call_stack_final_user_module.",
+        "Hashes of the call_stack_final_user_module."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.hash.sha256": [
+        "The sha256 of the call_stack_final_user_module.",
+        "The sha256 of the call_stack_final_user_module."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.name": [
+        "The file name of the call_stack_final_user_module.",
+        "The file name of the call_stack_final_user_module."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.path": [
+        "The file path of the call_stack_final_user_module.",
+        "The file path of the call_stack_final_user_module."
+    ],
+    "process.thread.Ext.call_stack_summary": [
+        "Concatentation of the non-repeated modules in the call stack.",
+        "Concatentation of the non-repeated modules in the call stack.",
+        "Concatentation of the non-repeated modules in the call stack.",
+        "Concatentation of the non-repeated modules in the call stack.",
+        "Concatentation of the non-repeated modules in the call stack."
+    ],
+    "process.thread.Ext.hardware_breakpoint_set": [
+        "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+        "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+        "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
+        "Whether a hardware breakpoint was set for the thread. This field is omitted if false."
+    ],
+    "process.thread.Ext.original_start_address": [
+        "When a trampoline was detected, this indicates the original content for the thread start address in memory."
+    ],
+    "process.thread.Ext.original_start_address_allocation_offset": [
+        "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base."
+    ],
+    "process.thread.Ext.original_start_address_bytes": [
+        "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address."
+    ],
+    "process.thread.Ext.original_start_address_bytes_disasm": [
+        "When a trampoline was detected, this holds the disassembled code at the original thread start address."
+    ],
+    "process.thread.Ext.original_start_address_bytes_disasm_hash": [
+        "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed."
+    ],
+    "process.thread.Ext.original_start_address_module": [
+        "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution."
+    ],
+    "process.thread.Ext.parameter": [
+        "When a thread is created, this is the raw numerical value of its parameter."
+    ],
+    "process.thread.Ext.parameter_bytes_compressed": [
+        "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times."
+    ],
+    "process.thread.Ext.parameter_bytes_compressed_present": [
+        "Whether parameter_bytes_compressed is present in this event."
+    ],
+    "process.thread.Ext.service": [
+        "Service associated with the thread."
+    ],
+    "process.thread.Ext.start": [
+        "The time the thread started."
+    ],
+    "process.thread.Ext.start_address": [
+        "Memory address where the thread began execution."
+    ],
+    "process.thread.Ext.start_address_allocation_offset": [
+        "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base."
+    ],
+    "process.thread.Ext.start_address_bytes": [
+        "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded."
+    ],
+    "process.thread.Ext.start_address_bytes_disasm": [
+        "The bytes at the thread start address, disassembled into human-readable assembly code."
+    ],
+    "process.thread.Ext.start_address_bytes_disasm_hash": [
+        "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed."
+    ],
+    "process.thread.Ext.start_address_module": [
+        "The dll/module where the thread began execution."
+    ],
+    "process.thread.Ext.token.domain": [
+        "Domain of token user."
+    ],
+    "process.thread.Ext.token.elevation": [
+        "Whether the token is elevated or not"
+    ],
+    "process.thread.Ext.token.elevation_type": [
+        "What level of elevation the token has"
+    ],
+    "process.thread.Ext.token.impersonation_level": [
+        "Impersonation level. Only valid for impersonation tokens."
+    ],
+    "process.thread.Ext.token.integrity_level": [
+        "Numeric integrity level."
+    ],
+    "process.thread.Ext.token.integrity_level_name": [
+        "Human readable integrity level."
+    ],
+    "process.thread.Ext.token.is_appcontainer": [
+        "Whether or not this is an appcontainer token."
+    ],
+    "process.thread.Ext.token.privileges": [
+        "Array describing the privileges associated with the token."
+    ],
+    "process.thread.Ext.token.privileges.description": [
+        "Description of the privilege."
+    ],
+    "process.thread.Ext.token.privileges.enabled": [
+        "Whether or not the privilege is enabled."
+    ],
+    "process.thread.Ext.token.privileges.name": [
+        "Name of the privilege."
+    ],
+    "process.thread.Ext.token.sid": [
+        "Token user's Security Identifier (SID)."
+    ],
+    "process.thread.Ext.token.type": [
+        "Type of the token, either primary or impersonation."
+    ],
+    "process.thread.Ext.token.user": [
+        "Username of token owner."
+    ],
+    "process.thread.Ext.uptime": [
+        "Seconds since thread started."
+    ],
+    "process.thread.id": [
+        "Thread ID.",
+        "Thread ID.",
+        "Thread ID.",
+        "Thread ID.",
+        "Thread ID.",
+        "Thread ID.",
+        "Thread ID.",
+        "Thread ID."
+    ],
+    "process.thread.name": [
+        "Thread name.",
+        "Thread name."
+    ],
+    "process.title": [
+        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
+        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened."
+    ],
+    "process.tty": [
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
+        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
+    ],
+    "process.tty.char_device.major": [
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
+        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
+    ],
+    "process.tty.char_device.minor": [
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
+        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
+    ],
+    "process.uptime": [
+        "Seconds the process has been up.",
+        "Seconds the process has been up."
+    ],
+    "process.user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "process.user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "process.working_directory": [
+        "The working directory of the process.",
+        "The working directory of the process."
+    ],
+    "registry.data.strings": [
+        "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
+        "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`)."
+    ],
+    "registry.path": [
+        "Full path, including hive, key and value",
+        "Full path, including hive, key and value"
+    ],
+    "registry.value": [
+        "Name of the value written.",
+        "Name of the value written."
+    ],
+    "rule.author": [
+        "Name, organization, or pseudonym of the author or authors who created the rule used to generate this event."
+    ],
+    "rule.category": [
+        "A categorization value keyword used by the entity using the rule for detection of this event."
+    ],
+    "rule.description": [
+        "The description of the rule generating the event."
+    ],
+    "rule.id": [
+        "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
+        "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event."
+    ],
+    "rule.license": [
+        "Name of the license under which the rule used to generate this event is made available."
+    ],
+    "rule.name": [
+        "The name of the rule or signature generating the event.",
+        "The name of the rule or signature generating the event."
+    ],
+    "rule.reference": [
+        "Reference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert."
+    ],
+    "rule.ruleset": [
+        "Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member."
+    ],
+    "rule.uuid": [
+        "A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event."
+    ],
+    "rule.version": [
+        "The version / revision of the rule being used for analysis."
+    ],
+    "source.geo.city_name": [
+        "City name.",
+        "City name.",
+        "City name.",
+        "City name.",
+        "City name.",
+        "City name.",
+        "City name."
+    ],
+    "source.geo.continent_code": [
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name.",
+        "Two-letter code representing continent's name."
+    ],
+    "source.geo.continent_name": [
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent.",
+        "Name of the continent."
+    ],
+    "source.geo.country_iso_code": [
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code.",
+        "Country ISO code."
+    ],
+    "source.geo.country_name": [
+        "Country name.",
+        "Country name.",
+        "Country name.",
+        "Country name.",
+        "Country name.",
+        "Country name.",
+        "Country name."
+    ],
+    "source.geo.location": [
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude.",
+        "Longitude and latitude."
+    ],
+    "source.geo.name": [
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
+    ],
+    "source.geo.postal_code": [
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
+    ],
+    "source.geo.region_iso_code": [
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code.",
+        "Region ISO code."
+    ],
+    "source.geo.region_name": [
+        "Region name.",
+        "Region name.",
+        "Region name.",
+        "Region name.",
+        "Region name.",
+        "Region name.",
+        "Region name."
+    ],
+    "source.geo.timezone": [
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name.",
+        "The time zone of the location, such as IANA time zone name."
+    ],
+    "source.ip": [
+        "IP address of the source (IPv4 or IPv6).",
+        "IP address of the source (IPv4 or IPv6)."
+    ],
+    "threat.enrichments": [
+        "A list of associated indicators objects enriching the event, and the context of that association/enrichment."
+    ],
+    "threat.enrichments.indicator": [
+        "Object containing associated indicators enriching the event."
+    ],
+    "threat.enrichments.indicator.file.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "threat.enrichments.indicator.file.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "threat.enrichments.indicator.file.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "threat.enrichments.indicator.file.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "threat.enrichments.indicator.file.Ext.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "threat.enrichments.indicator.file.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "threat.enrichments.indicator.file.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "threat.enrichments.indicator.file.Ext.device.bus_type": [
+        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+    ],
+    "threat.enrichments.indicator.file.Ext.device.dos_name": [
+        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+    ],
+    "threat.enrichments.indicator.file.Ext.device.file_system_type": [
+        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+    ],
+    "threat.enrichments.indicator.file.Ext.device.nt_name": [
+        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+    ],
+    "threat.enrichments.indicator.file.Ext.device.product_id": [
+        "ProductID of the device. It is provided by the vendor of the device if any."
+    ],
+    "threat.enrichments.indicator.file.Ext.device.serial_number": [
+        "Serial Number of the device. It is provided by the vendor of the device if any."
+    ],
+    "threat.enrichments.indicator.file.Ext.device.vendor_id": [
+        "VendorID of the device. It is provided by the vendor of the device."
+    ],
+    "threat.enrichments.indicator.file.Ext.device.volume_device_type": [
+        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+    ],
+    "threat.enrichments.indicator.file.Ext.entropy": [
+        "Entropy calculation of file's header and footer used to check file integrity."
+    ],
+    "threat.enrichments.indicator.file.Ext.entry_modified": [
+        "Time of last status change.  See `st_ctim` member of `struct stat`."
+    ],
+    "threat.enrichments.indicator.file.Ext.header_bytes": [
+        "First 16 bytes of file used to check file integrity."
+    ],
+    "threat.enrichments.indicator.file.Ext.header_data": [
+        "First 16 bytes of file used to check file integrity."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_classification.features.data.buffer": [
+        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_classification.features.data.decompressed_size": [
+        "The decompressed size of buffer."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_classification.features.data.encoding": [
+        "The encoding of buffer (e.g. zlib)."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_classification.identifier": [
+        "The model's unique identifier."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_classification.score": [
+        "The score produced by the classification model."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_classification.threshold": [
+        "The score threshold for the model.  Files that score above this threshold are considered malicious."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_classification.upx_packed": [
+        "Whether UPX packing was detected."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_classification.version": [
+        "The version of the model used."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature": [
+        "Nested version of malware_signature fieldset."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.all_names": [
+        "The concatenated names of all yara signatures"
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.identifier": [
+        "Malware artifact identifier."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.primary": [
+        "Primary malware signature match."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.primary.matches": [
+        "An array of bytes representing yara signature matches"
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature": [
+        "Primary malware signature match."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature.hash": [
+        "Primary malware signature hash."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature.hash.sha256": [
+        "Primary malware signature sha256."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature.id": [
+        "Primary malware signature id."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature.name": [
+        "Primary malware signature name."
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.secondary": [
+        "An array of malware signature matches"
+    ],
+    "threat.enrichments.indicator.file.Ext.malware_signature.version": [
+        "Primary malware signature version."
+    ],
+    "threat.enrichments.indicator.file.Ext.monotonic_id": [
+        "File event monotonic ID."
+    ],
+    "threat.enrichments.indicator.file.Ext.original": [
+        "Original file information during a modification event."
+    ],
+    "threat.enrichments.indicator.file.Ext.original.gid": [
+        "Primary group ID (GID) of the file."
+    ],
+    "threat.enrichments.indicator.file.Ext.original.group": [
+        "Primary group name of the file."
+    ],
+    "threat.enrichments.indicator.file.Ext.original.mode": [
+        "Original file mode prior to a modification event"
+    ],
+    "threat.enrichments.indicator.file.Ext.original.name": [
+        "Original file name prior to a modification event"
+    ],
+    "threat.enrichments.indicator.file.Ext.original.owner": [
+        "File owner's username."
+    ],
+    "threat.enrichments.indicator.file.Ext.original.path": [
+        "Original file path prior to a modification event"
+    ],
+    "threat.enrichments.indicator.file.Ext.original.uid": [
+        "The user ID (UID) or security identifier (SID) of the file owner."
+    ],
+    "threat.enrichments.indicator.file.Ext.quarantine_message": [
+        "Message describing quarantine results."
+    ],
+    "threat.enrichments.indicator.file.Ext.quarantine_path": [
+        "Path on endpoint the quarantined file was originally."
+    ],
+    "threat.enrichments.indicator.file.Ext.quarantine_result": [
+        "Boolean representing whether or not file quarantine succeeded."
+    ],
+    "threat.enrichments.indicator.file.Ext.temp_file_path": [
+        "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
+    ],
+    "threat.enrichments.indicator.file.Ext.windows": [
+        "Platform-specific Windows fields"
+    ],
+    "threat.enrichments.indicator.file.Ext.windows.zone_identifier": [
+        "Windows zone identifier for a file"
+    ],
+    "threat.enrichments.indicator.file.accessed": [
+        "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+    ],
+    "threat.enrichments.indicator.file.attributes": [
+        "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write."
+    ],
+    "threat.enrichments.indicator.file.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "threat.enrichments.indicator.file.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "threat.enrichments.indicator.file.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "threat.enrichments.indicator.file.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "threat.enrichments.indicator.file.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "threat.enrichments.indicator.file.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "threat.enrichments.indicator.file.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "threat.enrichments.indicator.file.created": [
+        "File creation time.\nNote that not all filesystems store the creation time."
+    ],
+    "threat.enrichments.indicator.file.ctime": [
+        "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+    ],
+    "threat.enrichments.indicator.file.device": [
+        "Device that is the source of the file."
+    ],
+    "threat.enrichments.indicator.file.directory": [
+        "Directory where the file is located. It should include the drive letter, when appropriate."
+    ],
+    "threat.enrichments.indicator.file.drive_letter": [
+        "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon."
+    ],
+    "threat.enrichments.indicator.file.elf.architecture": [
+        "Machine architecture of the ELF file."
+    ],
+    "threat.enrichments.indicator.file.elf.byte_order": [
+        "Byte sequence of ELF file."
+    ],
+    "threat.enrichments.indicator.file.elf.cpu_type": [
+        "CPU type of the ELF file."
+    ],
+    "threat.enrichments.indicator.file.elf.creation_date": [
+        "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
+    ],
+    "threat.enrichments.indicator.file.elf.exports": [
+        "List of exported element names and types."
+    ],
+    "threat.enrichments.indicator.file.elf.go_import_hash": [
+        "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
+    ],
+    "threat.enrichments.indicator.file.elf.go_imports": [
+        "List of imported Go language element names and types."
+    ],
+    "threat.enrichments.indicator.file.elf.go_imports_names_entropy": [
+        "Shannon entropy calculation from the list of Go imports."
+    ],
+    "threat.enrichments.indicator.file.elf.go_imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of Go imports."
+    ],
+    "threat.enrichments.indicator.file.elf.go_stripped": [
+        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+    ],
+    "threat.enrichments.indicator.file.elf.header.abi_version": [
+        "Version of the ELF Application Binary Interface (ABI)."
+    ],
+    "threat.enrichments.indicator.file.elf.header.class": [
+        "Header class of the ELF file."
+    ],
+    "threat.enrichments.indicator.file.elf.header.data": [
+        "Data table of the ELF header."
+    ],
+    "threat.enrichments.indicator.file.elf.header.entrypoint": [
+        "Header entrypoint of the ELF file."
+    ],
+    "threat.enrichments.indicator.file.elf.header.object_version": [
+        "\"0x1\" for original ELF files."
+    ],
+    "threat.enrichments.indicator.file.elf.header.os_abi": [
+        "Application Binary Interface (ABI) of the Linux OS."
+    ],
+    "threat.enrichments.indicator.file.elf.header.type": [
+        "Header type of the ELF file."
+    ],
+    "threat.enrichments.indicator.file.elf.header.version": [
+        "Version of the ELF header."
+    ],
+    "threat.enrichments.indicator.file.elf.import_hash": [
+        "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash."
+    ],
+    "threat.enrichments.indicator.file.elf.imports": [
+        "List of imported element names and types."
+    ],
+    "threat.enrichments.indicator.file.elf.imports_names_entropy": [
+        "Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "threat.enrichments.indicator.file.elf.imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "threat.enrichments.indicator.file.elf.sections": [
+        "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.chi2": [
+        "Chi-square probability distribution of the section."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.entropy": [
+        "Shannon entropy calculation from the section."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.flags": [
+        "ELF Section List flags."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.name": [
+        "ELF Section List name."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.physical_offset": [
+        "ELF Section List offset."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.physical_size": [
+        "ELF Section List physical size."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.type": [
+        "ELF Section List type."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.var_entropy": [
+        "Variance for Shannon entropy calculation from the section."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.virtual_address": [
+        "ELF Section List virtual address."
+    ],
+    "threat.enrichments.indicator.file.elf.sections.virtual_size": [
+        "ELF Section List virtual size."
+    ],
+    "threat.enrichments.indicator.file.elf.segments": [
+        "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
+    ],
+    "threat.enrichments.indicator.file.elf.segments.sections": [
+        "ELF object segment sections."
+    ],
+    "threat.enrichments.indicator.file.elf.segments.type": [
+        "ELF object segment type."
+    ],
+    "threat.enrichments.indicator.file.elf.shared_libraries": [
+        "List of shared libraries used by this ELF object."
+    ],
+    "threat.enrichments.indicator.file.elf.telfhash": [
+        "telfhash symbol hash for ELF file."
+    ],
+    "threat.enrichments.indicator.file.extension": [
+        "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
+    ],
+    "threat.enrichments.indicator.file.gid": [
+        "Primary group ID (GID) of the file."
+    ],
+    "threat.enrichments.indicator.file.group": [
+        "Primary group name of the file."
+    ],
+    "threat.enrichments.indicator.file.hash.md5": [
+        "MD5 hash."
+    ],
+    "threat.enrichments.indicator.file.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "threat.enrichments.indicator.file.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "threat.enrichments.indicator.file.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "threat.enrichments.indicator.file.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "threat.enrichments.indicator.file.inode": [
+        "Inode representing the file in the filesystem."
+    ],
+    "threat.enrichments.indicator.file.mime_type": [
+        "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+    ],
+    "threat.enrichments.indicator.file.mode": [
+        "Mode of the file in octal representation."
+    ],
+    "threat.enrichments.indicator.file.mtime": [
+        "Last time the file content was modified."
+    ],
+    "threat.enrichments.indicator.file.name": [
+        "Name of the file including the extension, without the directory."
+    ],
+    "threat.enrichments.indicator.file.owner": [
+        "File owner's username."
+    ],
+    "threat.enrichments.indicator.file.path": [
+        "Full path to the file, including the file name. It should include the drive letter, when appropriate."
+    ],
+    "threat.enrichments.indicator.file.pe.architecture": [
+        "CPU architecture target for the file."
+    ],
+    "threat.enrichments.indicator.file.pe.company": [
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "threat.enrichments.indicator.file.pe.description": [
+        "Internal description of the file, provided at compile-time."
+    ],
+    "threat.enrichments.indicator.file.pe.file_version": [
+        "Internal version of the file, provided at compile-time."
+    ],
+    "threat.enrichments.indicator.file.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "threat.enrichments.indicator.file.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time."
+    ],
+    "threat.enrichments.indicator.file.pe.product": [
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "threat.enrichments.indicator.file.size": [
+        "File size in bytes.\nOnly relevant when `file.type` is \"file\"."
+    ],
+    "threat.enrichments.indicator.file.target_path": [
+        "Target path for symlinks."
+    ],
+    "threat.enrichments.indicator.file.type": [
+        "File type (file, dir, or symlink)."
+    ],
+    "threat.enrichments.indicator.file.uid": [
+        "The user ID (UID) or security identifier (SID) of the file owner."
+    ],
+    "threat.enrichments.indicator.first_seen": [
+        "The date and time when intelligence source first reported sighting this indicator."
+    ],
+    "threat.enrichments.indicator.geo.city_name": [
+        "City name."
+    ],
+    "threat.enrichments.indicator.geo.continent_code": [
+        "Two-letter code representing continent's name."
+    ],
+    "threat.enrichments.indicator.geo.continent_name": [
+        "Name of the continent."
+    ],
+    "threat.enrichments.indicator.geo.country_iso_code": [
+        "Country ISO code."
+    ],
+    "threat.enrichments.indicator.geo.country_name": [
+        "Country name."
+    ],
+    "threat.enrichments.indicator.geo.location": [
+        "Longitude and latitude."
+    ],
+    "threat.enrichments.indicator.geo.name": [
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
+    ],
+    "threat.enrichments.indicator.geo.postal_code": [
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
+    ],
+    "threat.enrichments.indicator.geo.region_iso_code": [
+        "Region ISO code."
+    ],
+    "threat.enrichments.indicator.geo.region_name": [
+        "Region name."
+    ],
+    "threat.enrichments.indicator.geo.timezone": [
+        "The time zone of the location, such as IANA time zone name."
+    ],
+    "threat.enrichments.indicator.ip": [
+        "Identifies a threat indicator as an IP address (irrespective of direction)."
+    ],
+    "threat.enrichments.indicator.last_seen": [
+        "The date and time when intelligence source last reported sighting this indicator."
+    ],
+    "threat.enrichments.indicator.marking.tlp": [
+        "Traffic Light Protocol sharing markings."
+    ],
+    "threat.enrichments.indicator.modified_at": [
+        "The date and time when intelligence source last modified information for this indicator."
+    ],
+    "threat.enrichments.indicator.port": [
+        "Identifies a threat indicator as a port number (irrespective of direction)."
+    ],
+    "threat.enrichments.indicator.provider": [
+        "The name of the indicator's provider."
+    ],
+    "threat.enrichments.indicator.reference": [
+        "Reference URL linking to additional information about this indicator."
+    ],
+    "threat.enrichments.indicator.registry.data.bytes": [
+        "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values."
+    ],
+    "threat.enrichments.indicator.registry.data.strings": [
+        "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`)."
+    ],
+    "threat.enrichments.indicator.registry.data.type": [
+        "Standard registry type for encoding contents"
+    ],
+    "threat.enrichments.indicator.registry.hive": [
+        "Abbreviated name for the hive."
+    ],
+    "threat.enrichments.indicator.registry.key": [
+        "Hive-relative path of keys."
+    ],
+    "threat.enrichments.indicator.registry.path": [
+        "Full path, including hive, key and value"
+    ],
+    "threat.enrichments.indicator.registry.value": [
+        "Name of the value written."
+    ],
+    "threat.enrichments.indicator.scanner_stats": [
+        "Count of AV/EDR vendors that successfully detected malicious file or URL."
+    ],
+    "threat.enrichments.indicator.sightings": [
+        "Number of times this indicator was observed conducting threat activity."
+    ],
+    "threat.enrichments.indicator.type": [
+        "Type of indicator as represented by Cyber Observable in STIX 2.0."
+    ],
+    "threat.enrichments.indicator.url.domain": [
+        "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field."
+    ],
+    "threat.enrichments.indicator.url.extension": [
+        "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
+    ],
+    "threat.enrichments.indicator.url.fragment": [
+        "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
+    ],
+    "threat.enrichments.indicator.url.full": [
+        "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source."
+    ],
+    "threat.enrichments.indicator.url.original": [
+        "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not."
+    ],
+    "threat.enrichments.indicator.url.password": [
+        "Password of the request."
+    ],
+    "threat.enrichments.indicator.url.path": [
+        "Path of the request, such as \"/search\"."
+    ],
+    "threat.enrichments.indicator.url.port": [
+        "Port of the request, such as 443."
+    ],
+    "threat.enrichments.indicator.url.query": [
+        "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
+    ],
+    "threat.enrichments.indicator.url.registered_domain": [
+        "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
+    ],
+    "threat.enrichments.indicator.url.scheme": [
+        "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme."
+    ],
+    "threat.enrichments.indicator.url.subdomain": [
+        "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period."
+    ],
+    "threat.enrichments.indicator.url.top_level_domain": [
+        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
+    ],
+    "threat.enrichments.indicator.url.username": [
+        "Username of the request."
+    ],
+    "threat.enrichments.indicator.x509.alternative_names": [
+        "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses."
+    ],
+    "threat.enrichments.indicator.x509.issuer.common_name": [
+        "List of common name (CN) of issuing certificate authority."
+    ],
+    "threat.enrichments.indicator.x509.issuer.country": [
+        "List of country \\(C) codes"
+    ],
+    "threat.enrichments.indicator.x509.issuer.distinguished_name": [
+        "Distinguished name (DN) of issuing certificate authority."
+    ],
+    "threat.enrichments.indicator.x509.issuer.locality": [
+        "List of locality names (L)"
+    ],
+    "threat.enrichments.indicator.x509.issuer.organization": [
+        "List of organizations (O) of issuing certificate authority."
+    ],
+    "threat.enrichments.indicator.x509.issuer.organizational_unit": [
+        "List of organizational units (OU) of issuing certificate authority."
+    ],
+    "threat.enrichments.indicator.x509.issuer.state_or_province": [
+        "List of state or province names (ST, S, or P)"
+    ],
+    "threat.enrichments.indicator.x509.not_after": [
+        "Time at which the certificate is no longer considered valid."
+    ],
+    "threat.enrichments.indicator.x509.not_before": [
+        "Time at which the certificate is first considered valid."
+    ],
+    "threat.enrichments.indicator.x509.public_key_algorithm": [
+        "Algorithm used to generate the public key."
+    ],
+    "threat.enrichments.indicator.x509.public_key_curve": [
+        "The curve used by the elliptic curve public key algorithm. This is algorithm specific."
+    ],
+    "threat.enrichments.indicator.x509.public_key_exponent": [
+        "Exponent used to derive the public key. This is algorithm specific."
+    ],
+    "threat.enrichments.indicator.x509.public_key_size": [
+        "The size of the public key space in bits."
+    ],
+    "threat.enrichments.indicator.x509.serial_number": [
+        "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters."
+    ],
+    "threat.enrichments.indicator.x509.signature_algorithm": [
+        "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353."
+    ],
+    "threat.enrichments.indicator.x509.subject.common_name": [
+        "List of common names (CN) of subject."
+    ],
+    "threat.enrichments.indicator.x509.subject.country": [
+        "List of country \\(C) code"
+    ],
+    "threat.enrichments.indicator.x509.subject.distinguished_name": [
+        "Distinguished name (DN) of the certificate subject entity."
+    ],
+    "threat.enrichments.indicator.x509.subject.locality": [
+        "List of locality names (L)"
+    ],
+    "threat.enrichments.indicator.x509.subject.organization": [
+        "List of organizations (O) of subject."
+    ],
+    "threat.enrichments.indicator.x509.subject.organizational_unit": [
+        "List of organizational units (OU) of subject."
+    ],
+    "threat.enrichments.indicator.x509.subject.state_or_province": [
+        "List of state or province names (ST, S, or P)"
+    ],
+    "threat.enrichments.indicator.x509.version_number": [
+        "Version of x509 format."
+    ],
+    "threat.enrichments.matched.atomic": [
+        "Identifies the atomic indicator value that matched a local environment endpoint or network event."
+    ],
+    "threat.enrichments.matched.field": [
+        "Identifies the field of the atomic indicator that matched a local environment endpoint or network event."
+    ],
+    "threat.enrichments.matched.id": [
+        "Identifies the _id of the indicator document enriching the event."
+    ],
+    "threat.enrichments.matched.index": [
+        "Identifies the _index of the indicator document enriching the event."
+    ],
+    "threat.enrichments.matched.type": [
+        "Identifies the type of match that caused the event to be enriched with the given indicator"
+    ],
+    "threat.framework": [
+        "Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events."
+    ],
+    "threat.group.alias": [
+        "The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK\u00ae group alias(es)."
+    ],
+    "threat.group.id": [
+        "The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK\u00ae group id."
+    ],
+    "threat.group.name": [
+        "The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK\u00ae group name."
+    ],
+    "threat.group.reference": [
+        "The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK\u00ae group reference URL."
+    ],
+    "threat.indicator.as.number": [
+        "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet."
+    ],
+    "threat.indicator.as.organization.name": [
+        "Organization name."
+    ],
+    "threat.indicator.confidence": [
+        "Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields."
+    ],
+    "threat.indicator.description": [
+        "Describes the type of action conducted by the threat."
+    ],
+    "threat.indicator.email.address": [
+        "Identifies a threat indicator as an email address (irrespective of direction)."
+    ],
+    "threat.indicator.file.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "threat.indicator.file.Ext.code_signature": [
+        "Nested version of ECS code_signature fieldset."
+    ],
+    "threat.indicator.file.Ext.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "threat.indicator.file.Ext.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "threat.indicator.file.Ext.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "threat.indicator.file.Ext.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "threat.indicator.file.Ext.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "threat.indicator.file.Ext.device.bus_type": [
+        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+    ],
+    "threat.indicator.file.Ext.device.dos_name": [
+        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+    ],
+    "threat.indicator.file.Ext.device.file_system_type": [
+        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+    ],
+    "threat.indicator.file.Ext.device.nt_name": [
+        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+    ],
+    "threat.indicator.file.Ext.device.product_id": [
+        "ProductID of the device. It is provided by the vendor of the device if any."
+    ],
+    "threat.indicator.file.Ext.device.serial_number": [
+        "Serial Number of the device. It is provided by the vendor of the device if any."
+    ],
+    "threat.indicator.file.Ext.device.vendor_id": [
+        "VendorID of the device. It is provided by the vendor of the device."
+    ],
+    "threat.indicator.file.Ext.device.volume_device_type": [
+        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+    ],
+    "threat.indicator.file.Ext.entropy": [
+        "Entropy calculation of file's header and footer used to check file integrity."
+    ],
+    "threat.indicator.file.Ext.entry_modified": [
+        "Time of last status change.  See `st_ctim` member of `struct stat`."
+    ],
+    "threat.indicator.file.Ext.header_bytes": [
+        "First 16 bytes of file used to check file integrity."
+    ],
+    "threat.indicator.file.Ext.header_data": [
+        "First 16 bytes of file used to check file integrity."
+    ],
+    "threat.indicator.file.Ext.malware_classification.features.data.buffer": [
+        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
+    ],
+    "threat.indicator.file.Ext.malware_classification.features.data.decompressed_size": [
+        "The decompressed size of buffer."
+    ],
+    "threat.indicator.file.Ext.malware_classification.features.data.encoding": [
+        "The encoding of buffer (e.g. zlib)."
+    ],
+    "threat.indicator.file.Ext.malware_classification.identifier": [
+        "The model's unique identifier."
+    ],
+    "threat.indicator.file.Ext.malware_classification.score": [
+        "The score produced by the classification model."
+    ],
+    "threat.indicator.file.Ext.malware_classification.threshold": [
+        "The score threshold for the model.  Files that score above this threshold are considered malicious."
+    ],
+    "threat.indicator.file.Ext.malware_classification.upx_packed": [
+        "Whether UPX packing was detected."
+    ],
+    "threat.indicator.file.Ext.malware_classification.version": [
+        "The version of the model used."
+    ],
+    "threat.indicator.file.Ext.malware_signature": [
+        "Nested version of malware_signature fieldset."
+    ],
+    "threat.indicator.file.Ext.malware_signature.all_names": [
+        "The concatenated names of all yara signatures"
+    ],
+    "threat.indicator.file.Ext.malware_signature.identifier": [
+        "Malware artifact identifier."
+    ],
+    "threat.indicator.file.Ext.malware_signature.primary": [
+        "Primary malware signature match."
+    ],
+    "threat.indicator.file.Ext.malware_signature.primary.matches": [
+        "An array of bytes representing yara signature matches"
+    ],
+    "threat.indicator.file.Ext.malware_signature.primary.signature": [
+        "Primary malware signature match."
+    ],
+    "threat.indicator.file.Ext.malware_signature.primary.signature.hash": [
+        "Primary malware signature hash."
+    ],
+    "threat.indicator.file.Ext.malware_signature.primary.signature.hash.sha256": [
+        "Primary malware signature sha256."
+    ],
+    "threat.indicator.file.Ext.malware_signature.primary.signature.id": [
+        "Primary malware signature id."
+    ],
+    "threat.indicator.file.Ext.malware_signature.primary.signature.name": [
+        "Primary malware signature name."
+    ],
+    "threat.indicator.file.Ext.malware_signature.secondary": [
+        "An array of malware signature matches"
+    ],
+    "threat.indicator.file.Ext.malware_signature.version": [
+        "Primary malware signature version."
+    ],
+    "threat.indicator.file.Ext.monotonic_id": [
+        "File event monotonic ID."
+    ],
+    "threat.indicator.file.Ext.original": [
+        "Original file information during a modification event."
+    ],
+    "threat.indicator.file.Ext.original.gid": [
+        "Primary group ID (GID) of the file."
+    ],
+    "threat.indicator.file.Ext.original.group": [
+        "Primary group name of the file."
+    ],
+    "threat.indicator.file.Ext.original.mode": [
+        "Original file mode prior to a modification event"
+    ],
+    "threat.indicator.file.Ext.original.name": [
+        "Original file name prior to a modification event"
+    ],
+    "threat.indicator.file.Ext.original.owner": [
+        "File owner's username."
+    ],
+    "threat.indicator.file.Ext.original.path": [
+        "Original file path prior to a modification event"
+    ],
+    "threat.indicator.file.Ext.original.uid": [
+        "The user ID (UID) or security identifier (SID) of the file owner."
+    ],
+    "threat.indicator.file.Ext.quarantine_message": [
+        "Message describing quarantine results."
+    ],
+    "threat.indicator.file.Ext.quarantine_path": [
+        "Path on endpoint the quarantined file was originally."
+    ],
+    "threat.indicator.file.Ext.quarantine_result": [
+        "Boolean representing whether or not file quarantine succeeded."
+    ],
+    "threat.indicator.file.Ext.temp_file_path": [
+        "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
+    ],
+    "threat.indicator.file.Ext.windows": [
+        "Platform-specific Windows fields"
+    ],
+    "threat.indicator.file.Ext.windows.zone_identifier": [
+        "Windows zone identifier for a file"
+    ],
+    "threat.indicator.file.accessed": [
+        "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
+    ],
+    "threat.indicator.file.attributes": [
+        "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write."
+    ],
+    "threat.indicator.file.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "threat.indicator.file.code_signature.signing_id": [
+        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
+    ],
+    "threat.indicator.file.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "threat.indicator.file.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "threat.indicator.file.code_signature.team_id": [
+        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
+    ],
+    "threat.indicator.file.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "threat.indicator.file.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "threat.indicator.file.created": [
+        "File creation time.\nNote that not all filesystems store the creation time."
+    ],
+    "threat.indicator.file.ctime": [
+        "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
+    ],
+    "threat.indicator.file.device": [
+        "Device that is the source of the file."
+    ],
+    "threat.indicator.file.directory": [
+        "Directory where the file is located. It should include the drive letter, when appropriate."
+    ],
+    "threat.indicator.file.drive_letter": [
+        "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon."
+    ],
+    "threat.indicator.file.elf.architecture": [
+        "Machine architecture of the ELF file."
+    ],
+    "threat.indicator.file.elf.byte_order": [
+        "Byte sequence of ELF file."
+    ],
+    "threat.indicator.file.elf.cpu_type": [
+        "CPU type of the ELF file."
+    ],
+    "threat.indicator.file.elf.creation_date": [
+        "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
+    ],
+    "threat.indicator.file.elf.exports": [
+        "List of exported element names and types."
+    ],
+    "threat.indicator.file.elf.go_import_hash": [
+        "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
+    ],
+    "threat.indicator.file.elf.go_imports": [
+        "List of imported Go language element names and types."
+    ],
+    "threat.indicator.file.elf.go_imports_names_entropy": [
+        "Shannon entropy calculation from the list of Go imports."
+    ],
+    "threat.indicator.file.elf.go_imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of Go imports."
+    ],
+    "threat.indicator.file.elf.go_stripped": [
+        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+    ],
+    "threat.indicator.file.elf.header.abi_version": [
+        "Version of the ELF Application Binary Interface (ABI)."
+    ],
+    "threat.indicator.file.elf.header.class": [
+        "Header class of the ELF file."
+    ],
+    "threat.indicator.file.elf.header.data": [
+        "Data table of the ELF header."
+    ],
+    "threat.indicator.file.elf.header.entrypoint": [
+        "Header entrypoint of the ELF file."
+    ],
+    "threat.indicator.file.elf.header.object_version": [
+        "\"0x1\" for original ELF files."
+    ],
+    "threat.indicator.file.elf.header.os_abi": [
+        "Application Binary Interface (ABI) of the Linux OS."
+    ],
+    "threat.indicator.file.elf.header.type": [
+        "Header type of the ELF file."
+    ],
+    "threat.indicator.file.elf.header.version": [
+        "Version of the ELF header."
+    ],
+    "threat.indicator.file.elf.import_hash": [
+        "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash."
+    ],
+    "threat.indicator.file.elf.imports": [
+        "List of imported element names and types."
+    ],
+    "threat.indicator.file.elf.imports_names_entropy": [
+        "Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "threat.indicator.file.elf.imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "threat.indicator.file.elf.sections": [
+        "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
+    ],
+    "threat.indicator.file.elf.sections.chi2": [
+        "Chi-square probability distribution of the section."
+    ],
+    "threat.indicator.file.elf.sections.entropy": [
+        "Shannon entropy calculation from the section."
+    ],
+    "threat.indicator.file.elf.sections.flags": [
+        "ELF Section List flags."
+    ],
+    "threat.indicator.file.elf.sections.name": [
+        "ELF Section List name."
+    ],
+    "threat.indicator.file.elf.sections.physical_offset": [
+        "ELF Section List offset."
+    ],
+    "threat.indicator.file.elf.sections.physical_size": [
+        "ELF Section List physical size."
+    ],
+    "threat.indicator.file.elf.sections.type": [
+        "ELF Section List type."
+    ],
+    "threat.indicator.file.elf.sections.var_entropy": [
+        "Variance for Shannon entropy calculation from the section."
+    ],
+    "threat.indicator.file.elf.sections.virtual_address": [
+        "ELF Section List virtual address."
+    ],
+    "threat.indicator.file.elf.sections.virtual_size": [
+        "ELF Section List virtual size."
+    ],
+    "threat.indicator.file.elf.segments": [
+        "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
+    ],
+    "threat.indicator.file.elf.segments.sections": [
+        "ELF object segment sections."
+    ],
+    "threat.indicator.file.elf.segments.type": [
+        "ELF object segment type."
+    ],
+    "threat.indicator.file.elf.shared_libraries": [
+        "List of shared libraries used by this ELF object."
+    ],
+    "threat.indicator.file.elf.telfhash": [
+        "telfhash symbol hash for ELF file."
+    ],
+    "threat.indicator.file.extension": [
+        "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
+    ],
+    "threat.indicator.file.gid": [
+        "Primary group ID (GID) of the file."
+    ],
+    "threat.indicator.file.group": [
+        "Primary group name of the file."
+    ],
+    "threat.indicator.file.hash.md5": [
+        "MD5 hash."
+    ],
+    "threat.indicator.file.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "threat.indicator.file.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "threat.indicator.file.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "threat.indicator.file.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "threat.indicator.file.inode": [
+        "Inode representing the file in the filesystem."
+    ],
+    "threat.indicator.file.mime_type": [
+        "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
+    ],
+    "threat.indicator.file.mode": [
+        "Mode of the file in octal representation."
+    ],
+    "threat.indicator.file.mtime": [
+        "Last time the file content was modified."
+    ],
+    "threat.indicator.file.name": [
+        "Name of the file including the extension, without the directory."
+    ],
+    "threat.indicator.file.owner": [
+        "File owner's username."
+    ],
+    "threat.indicator.file.path": [
+        "Full path to the file, including the file name. It should include the drive letter, when appropriate."
+    ],
+    "threat.indicator.file.pe.architecture": [
+        "CPU architecture target for the file."
+    ],
+    "threat.indicator.file.pe.company": [
+        "Internal company name of the file, provided at compile-time."
+    ],
+    "threat.indicator.file.pe.description": [
+        "Internal description of the file, provided at compile-time."
+    ],
+    "threat.indicator.file.pe.file_version": [
+        "Internal version of the file, provided at compile-time."
+    ],
+    "threat.indicator.file.pe.imphash": [
+        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
+    ],
+    "threat.indicator.file.pe.original_file_name": [
+        "Internal name of the file, provided at compile-time."
+    ],
+    "threat.indicator.file.pe.product": [
+        "Internal product name of the file, provided at compile-time."
+    ],
+    "threat.indicator.file.size": [
+        "File size in bytes.\nOnly relevant when `file.type` is \"file\"."
+    ],
+    "threat.indicator.file.target_path": [
+        "Target path for symlinks."
+    ],
+    "threat.indicator.file.type": [
+        "File type (file, dir, or symlink)."
+    ],
+    "threat.indicator.file.uid": [
+        "The user ID (UID) or security identifier (SID) of the file owner."
+    ],
+    "threat.indicator.first_seen": [
+        "The date and time when intelligence source first reported sighting this indicator."
+    ],
+    "threat.indicator.geo.city_name": [
+        "City name."
+    ],
+    "threat.indicator.geo.continent_code": [
+        "Two-letter code representing continent's name."
+    ],
+    "threat.indicator.geo.continent_name": [
+        "Name of the continent."
+    ],
+    "threat.indicator.geo.country_iso_code": [
+        "Country ISO code."
+    ],
+    "threat.indicator.geo.country_name": [
+        "Country name."
+    ],
+    "threat.indicator.geo.location": [
+        "Longitude and latitude."
+    ],
+    "threat.indicator.geo.name": [
+        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
+    ],
+    "threat.indicator.geo.postal_code": [
+        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
+    ],
+    "threat.indicator.geo.region_iso_code": [
+        "Region ISO code."
+    ],
+    "threat.indicator.geo.region_name": [
+        "Region name."
+    ],
+    "threat.indicator.geo.timezone": [
+        "The time zone of the location, such as IANA time zone name."
+    ],
+    "threat.indicator.ip": [
+        "Identifies a threat indicator as an IP address (irrespective of direction)."
+    ],
+    "threat.indicator.last_seen": [
+        "The date and time when intelligence source last reported sighting this indicator."
+    ],
+    "threat.indicator.marking.tlp": [
+        "Traffic Light Protocol sharing markings."
+    ],
+    "threat.indicator.modified_at": [
+        "The date and time when intelligence source last modified information for this indicator."
+    ],
+    "threat.indicator.port": [
+        "Identifies a threat indicator as a port number (irrespective of direction)."
+    ],
+    "threat.indicator.provider": [
+        "The name of the indicator's provider."
+    ],
+    "threat.indicator.reference": [
+        "Reference URL linking to additional information about this indicator."
+    ],
+    "threat.indicator.registry.data.bytes": [
+        "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values."
+    ],
+    "threat.indicator.registry.data.strings": [
+        "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`)."
+    ],
+    "threat.indicator.registry.data.type": [
+        "Standard registry type for encoding contents"
+    ],
+    "threat.indicator.registry.hive": [
+        "Abbreviated name for the hive."
+    ],
+    "threat.indicator.registry.key": [
+        "Hive-relative path of keys."
+    ],
+    "threat.indicator.registry.path": [
+        "Full path, including hive, key and value"
+    ],
+    "threat.indicator.registry.value": [
+        "Name of the value written."
+    ],
+    "threat.indicator.scanner_stats": [
+        "Count of AV/EDR vendors that successfully detected malicious file or URL."
+    ],
+    "threat.indicator.sightings": [
+        "Number of times this indicator was observed conducting threat activity."
+    ],
+    "threat.indicator.type": [
+        "Type of indicator as represented by Cyber Observable in STIX 2.0."
+    ],
+    "threat.indicator.url.domain": [
+        "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field."
+    ],
+    "threat.indicator.url.extension": [
+        "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
+    ],
+    "threat.indicator.url.fragment": [
+        "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
+    ],
+    "threat.indicator.url.full": [
+        "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source."
+    ],
+    "threat.indicator.url.original": [
+        "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not."
+    ],
+    "threat.indicator.url.password": [
+        "Password of the request."
+    ],
+    "threat.indicator.url.path": [
+        "Path of the request, such as \"/search\"."
+    ],
+    "threat.indicator.url.port": [
+        "Port of the request, such as 443."
+    ],
+    "threat.indicator.url.query": [
+        "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
+    ],
+    "threat.indicator.url.registered_domain": [
+        "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
+    ],
+    "threat.indicator.url.scheme": [
+        "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme."
+    ],
+    "threat.indicator.url.subdomain": [
+        "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period."
+    ],
+    "threat.indicator.url.top_level_domain": [
+        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
+    ],
+    "threat.indicator.url.username": [
+        "Username of the request."
+    ],
+    "threat.indicator.x509.alternative_names": [
+        "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses."
+    ],
+    "threat.indicator.x509.issuer.common_name": [
+        "List of common name (CN) of issuing certificate authority."
+    ],
+    "threat.indicator.x509.issuer.country": [
+        "List of country \\(C) codes"
+    ],
+    "threat.indicator.x509.issuer.distinguished_name": [
+        "Distinguished name (DN) of issuing certificate authority."
+    ],
+    "threat.indicator.x509.issuer.locality": [
+        "List of locality names (L)"
+    ],
+    "threat.indicator.x509.issuer.organization": [
+        "List of organizations (O) of issuing certificate authority."
+    ],
+    "threat.indicator.x509.issuer.organizational_unit": [
+        "List of organizational units (OU) of issuing certificate authority."
+    ],
+    "threat.indicator.x509.issuer.state_or_province": [
+        "List of state or province names (ST, S, or P)"
+    ],
+    "threat.indicator.x509.not_after": [
+        "Time at which the certificate is no longer considered valid."
+    ],
+    "threat.indicator.x509.not_before": [
+        "Time at which the certificate is first considered valid."
+    ],
+    "threat.indicator.x509.public_key_algorithm": [
+        "Algorithm used to generate the public key."
+    ],
+    "threat.indicator.x509.public_key_curve": [
+        "The curve used by the elliptic curve public key algorithm. This is algorithm specific."
+    ],
+    "threat.indicator.x509.public_key_exponent": [
+        "Exponent used to derive the public key. This is algorithm specific."
+    ],
+    "threat.indicator.x509.public_key_size": [
+        "The size of the public key space in bits."
+    ],
+    "threat.indicator.x509.serial_number": [
+        "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters."
+    ],
+    "threat.indicator.x509.signature_algorithm": [
+        "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353."
+    ],
+    "threat.indicator.x509.subject.common_name": [
+        "List of common names (CN) of subject."
+    ],
+    "threat.indicator.x509.subject.country": [
+        "List of country \\(C) code"
+    ],
+    "threat.indicator.x509.subject.distinguished_name": [
+        "Distinguished name (DN) of the certificate subject entity."
+    ],
+    "threat.indicator.x509.subject.locality": [
+        "List of locality names (L)"
+    ],
+    "threat.indicator.x509.subject.organization": [
+        "List of organizations (O) of subject."
+    ],
+    "threat.indicator.x509.subject.organizational_unit": [
+        "List of organizational units (OU) of subject."
+    ],
+    "threat.indicator.x509.subject.state_or_province": [
+        "List of state or province names (ST, S, or P)"
+    ],
+    "threat.indicator.x509.version_number": [
+        "Version of x509 format."
+    ],
+    "threat.software.id": [
+        "The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use a MITRE ATT&CK\u00ae software id."
+    ],
+    "threat.software.name": [
+        "The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use a MITRE ATT&CK\u00ae software name."
+    ],
+    "threat.software.platforms": [
+        "The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use MITRE ATT&CK\u00ae software platform values."
+    ],
+    "threat.software.reference": [
+        "The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use a MITRE ATT&CK\u00ae software reference URL."
+    ],
+    "threat.software.type": [
+        "The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use a MITRE ATT&CK\u00ae software type."
+    ],
+    "threat.tactic.id": [
+        "The id of tactic used by this threat. You can use a MITRE ATT&CK\u00ae tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )"
+    ],
+    "threat.tactic.name": [
+        "Name of the type of tactic used by this threat. You can use a MITRE ATT&CK\u00ae tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)"
+    ],
+    "threat.tactic.reference": [
+        "The reference url of tactic used by this threat. You can use a MITRE ATT&CK\u00ae tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )"
+    ],
+    "threat.technique.id": [
+        "The id of technique used by this threat. You can use a MITRE ATT&CK\u00ae technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)"
+    ],
+    "threat.technique.name": [
+        "The name of technique used by this threat. You can use a MITRE ATT&CK\u00ae technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)"
+    ],
+    "threat.technique.reference": [
+        "The reference url of technique used by this threat. You can use a MITRE ATT&CK\u00ae technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)"
+    ],
+    "threat.technique.subtechnique.id": [
+        "The full id of subtechnique used by this threat. You can use a MITRE ATT&CK\u00ae subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)"
+    ],
+    "threat.technique.subtechnique.name": [
+        "The name of subtechnique used by this threat. You can use a MITRE ATT&CK\u00ae subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)"
+    ],
+    "threat.technique.subtechnique.reference": [
+        "The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK\u00ae subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)"
+    ],
+    "user.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "user.Ext.real": [
+        "User info prior to any setuid operations.",
+        "User info prior to any setuid operations.",
+        "User info prior to any setuid operations.",
+        "User info prior to any setuid operations.",
+        "User info prior to any setuid operations.",
+        "User info prior to any setuid operations.",
+        "User info prior to any setuid operations."
+    ],
+    "user.Ext.real.id": [
+        "One or multiple unique identifiers of the user.",
+        "One or multiple unique identifiers of the user.",
+        "One or multiple unique identifiers of the user.",
+        "One or multiple unique identifiers of the user.",
+        "One or multiple unique identifiers of the user.",
+        "One or multiple unique identifiers of the user.",
+        "One or multiple unique identifiers of the user."
+    ],
+    "user.Ext.real.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "user.domain": [
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+    ],
+    "user.email": [
+        "User email address.",
+        "User email address.",
+        "User email address.",
+        "User email address.",
+        "User email address.",
+        "User email address.",
+        "User email address."
+    ],
+    "user.full_name": [
+        "User's full name, if available.",
+        "User's full name, if available.",
+        "User's full name, if available.",
+        "User's full name, if available.",
+        "User's full name, if available.",
+        "User's full name, if available.",
+        "User's full name, if available."
+    ],
+    "user.group.Ext": [
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in.",
+        "Object for all custom defined fields to live in."
+    ],
+    "user.group.Ext.real": [
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations.",
+        "Group info prior to any setgid operations."
+    ],
+    "user.group.Ext.real.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "user.group.Ext.real.name": [
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "user.group.domain": [
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
+        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
+    ],
+    "user.group.id": [
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform.",
+        "Unique identifier for the group on the system/platform."
+    ],
+    "user.group.name": [
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group.",
+        "Name of the group."
+    ],
+    "user.hash": [
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+    ],
+    "user.id": [
+        "Unique identifier of the user.",
+        "Unique identifier of the user.",
+        "Unique identifier of the user.",
+        "Unique identifier of the user.",
+        "Unique identifier of the user.",
+        "Unique identifier of the user.",
+        "Unique identifier of the user.",
+        "Unique identifier of the user.",
+        "Unique identifier of the user."
+    ],
+    "user.name": [
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user.",
+        "Short name or login of the user."
+    ],
+    "Endpoint.configuration": [
+        "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state",
+        "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
+    ],
+    "Endpoint.configuration.isolation": [
+        "Configuration setting for Host Isolation from the network",
+        "Configuration setting for Host Isolation from the network"
+    ],
+    "Endpoint.policy.applied.actions": [
+        "actions applied during the application of the policy"
+    ],
+    "Endpoint.policy.applied.actions.message": [
+        "message about the application of the action to further qualify the status of the action"
+    ],
+    "Endpoint.policy.applied.actions.name": [
+        "name of the action that was applied"
+    ],
+    "Endpoint.policy.applied.actions.status": [
+        "the status of the action"
+    ],
+    "Endpoint.policy.applied.endpoint_policy_version": [
+        "the version of this applied policy"
+    ],
+    "Endpoint.policy.applied.response": [
+        "the response of actions that failed in the applied policy"
+    ],
+    "Endpoint.policy.applied.response.configurations": [
+        "the configurations of the applied policy"
+    ],
+    "Endpoint.policy.applied.response.configurations.antivirus_registration": [
+        "overall antivirus registration configuration and status of the applied policy"
+    ],
+    "Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions": [
+        "all actions that were taken for antivirus registration"
+    ],
+    "Endpoint.policy.applied.response.configurations.antivirus_registration.status": [
+        "the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions": [
+        "all actions that were taken for attack surface reduction"
+    ],
+    "Endpoint.policy.applied.response.configurations.attack_surface_reduction.status": [
+        "the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions": [
+        "all actions that were taken for behavior_protection"
+    ],
+    "Endpoint.policy.applied.response.configurations.behavior_protection.status": [
+        "the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.configurations.events": [
+        "overall event collection configuration and status of the applied policy"
+    ],
+    "Endpoint.policy.applied.response.configurations.events.concerned_actions": [
+        "all actions that were taken for event collection"
+    ],
+    "Endpoint.policy.applied.response.configurations.events.status": [
+        "the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions": [
+        "all actions that were taken for host isolation"
+    ],
+    "Endpoint.policy.applied.response.configurations.host_isolation.status": [
+        "the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.configurations.logging": [
+        "overall logging configuration and status of the applied policy"
+    ],
+    "Endpoint.policy.applied.response.configurations.logging.concerned_actions": [
+        "all actions that were taken for logging"
+    ],
+    "Endpoint.policy.applied.response.configurations.logging.status": [
+        "the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.configurations.malware": [
+        "overall malware configuration and status of the applied policy"
+    ],
+    "Endpoint.policy.applied.response.configurations.malware.concerned_actions": [
+        "all actions that were taken for malware"
+    ],
+    "Endpoint.policy.applied.response.configurations.malware.status": [
+        "the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.configurations.memory_protection": [
+        "overall memory_protection configuration and status of the applied policy"
+    ],
+    "Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions": [
+        "all actions that were taken for memory_protection"
+    ],
+    "Endpoint.policy.applied.response.configurations.memory_protection.status": [
+        "the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.configurations.ransomware.concerned_actions": [
+        "all actions that were taken for ransomware"
+    ],
+    "Endpoint.policy.applied.response.configurations.ransomware.status": [
+        "the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.configurations.streaming": [
+        "overall data streaming configuration and status of the applied policy"
+    ],
+    "Endpoint.policy.applied.response.configurations.streaming.concerned_actions": [
+        "all actions that were taken for data streaming"
+    ],
+    "Endpoint.policy.applied.response.configurations.streaming.status": [
+        "the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.diagnostic": [
+        "the diagnostic configurations of the applied policy"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions": [
+        "all actions that were taken for the diagnostic configuration of behavior protection"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.behavior_protection.status": [
+        "the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.credential_protection.concerned_actions": [
+        "all actions that were taken for the diagnostic configuration of credential protection"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.credential_protection.status": [
+        "the overall status of the diagnostic configuration of credential protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.malware.concerned_actions": [
+        "all actions that were taken for the diagnostic configuration of malware"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.malware.status": [
+        "the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions": [
+        "all actions that were taken for the diagnostic configuration of memory protection"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.memory_protection.status": [
+        "the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.memory_scan.concerned_actions": [
+        "all actions that were taken for the diagnostic configuration of memory scan"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.memory_scan.status": [
+        "the overall status of the diagnostic configuration of memory scan, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions": [
+        "all actions that were taken for the diagnostic configuration of ransomware"
+    ],
+    "Endpoint.policy.applied.response.diagnostic.ransomware.status": [
+        "the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
+    ],
+    "Endpoint.state": [
+        "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)",
+        "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
+    ],
+    "Endpoint.state.isolation": [
+        "Current network isolation state of the host",
+        "Current network isolation state of the host"
+    ],
+    "agent.build.original": [
+        "Extended build information for the agent.\nThis field is intended to contain any build information that a data source may provide, no specific formatting is required."
+    ],
+    "Effective_process.entity_id": [
+        "Unique identifier for the effective process.",
+        "Unique identifier for the effective process.",
+        "Unique identifier for the effective process."
+    ],
+    "Effective_process.executable": [
+        "Executable name for the effective process.",
+        "Executable name for the effective process.",
+        "Executable name for the effective process."
+    ],
+    "Effective_process.name": [
+        "Process name for the effective process.",
+        "Process name for the effective process.",
+        "Process name for the effective process."
+    ],
+    "Effective_process.pid": [
+        "Process ID.",
+        "Process ID.",
+        "Process ID."
+    ],
+    "process.thread.Ext.call_stack.allocation_private_bytes": [
+        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing.",
+        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing.",
+        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing.",
+        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+    ],
+    "process.thread.Ext.call_stack.callsite_leading_bytes": [
+        "Hex opcode bytes preceding the callsite",
+        "Hex opcode bytes preceding the callsite",
+        "Hex opcode bytes preceding the callsite",
+        "Hex opcode bytes preceding the callsite"
+    ],
+    "process.thread.Ext.call_stack.callsite_trailing_bytes": [
+        "Hex opcode bytes after the callsite (where control will return to)",
+        "Hex opcode bytes after the callsite (where control will return to)",
+        "Hex opcode bytes after the callsite (where control will return to)",
+        "Hex opcode bytes after the callsite (where control will return to)"
+    ],
+    "process.thread.Ext.call_stack.protection": [
+        "Protection of the page containing this instruction.  This is `R-X' by default if omitted.",
+        "Protection of the page containing this instruction.  This is `R-X' by default if omitted.",
+        "Protection of the page containing this instruction.  This is `R-X' by default if omitted.",
+        "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+    ],
+    "registry.data.bytes": [
+        "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values."
+    ],
+    "registry.data.type": [
+        "Standard registry type for encoding contents"
+    ],
+    "registry.hive": [
+        "Abbreviated name for the hive."
+    ],
+    "registry.key": [
+        "Hive-relative path of keys."
+    ],
+    "container.image.hash.all": [
+        "An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set."
+    ],
+    "orchestrator.cluster.id": [
+        "Unique ID of the cluster."
+    ],
+    "orchestrator.resource.ip": [
+        "IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running)."
+    ],
+    "orchestrator.resource.parent.type": [
+        "Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet)."
+    ],
+    "package.name": [
+        "Package name"
+    ],
+    "process.Ext.defense_evasions": [
+        "List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping."
+    ],
+    "process.Ext.device.bus_type": [
+        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+    ],
+    "process.Ext.device.dos_name": [
+        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+    ],
+    "process.Ext.device.file_system_type": [
+        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+    ],
+    "process.Ext.device.nt_name": [
+        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+    ],
+    "process.Ext.device.product_id": [
+        "ProductID of the device. It is provided by the vendor of the device if any."
+    ],
+    "process.Ext.device.serial_number": [
+        "Serial Number of the device. It is provided by the vendor of the device if any."
+    ],
+    "process.Ext.device.vendor_id": [
+        "VendorID of the device. It is provided by the vendor of the device."
+    ],
+    "process.Ext.device.volume_device_type": [
+        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+    ],
+    "process.Ext.effective_parent.entity_id": [
+        "Unique identifier for the effective process."
+    ],
+    "process.Ext.effective_parent.executable": [
+        "Executable name for the effective process."
+    ],
+    "process.Ext.effective_parent.name": [
+        "Process name for the effective process."
+    ],
+    "process.Ext.effective_parent.pid": [
+        "Process ID."
+    ],
+    "process.Ext.memfd": [
+        "Object for memfd events."
+    ],
+    "process.Ext.memfd.flag_allow_seal": [
+        "Allow sealing operations on this file."
+    ],
+    "process.Ext.memfd.flag_cloexec": [
+        "Sets the the close-on-exec flag on the new file descriptor."
+    ],
+    "process.Ext.memfd.flag_exec": [
+        "Exec flag is set for file."
+    ],
+    "process.Ext.memfd.flag_hugetlb": [
+        "The anonymous file will be created in the hugetlbfs filesystem using huge pages."
+    ],
+    "process.Ext.memfd.flag_noexec_seal": [
+        "Sets both NOEXEC and MFD_ALLOW_SEALING."
+    ],
+    "process.Ext.memfd.flags": [
+        "Flags passed to the memfd operation."
+    ],
+    "process.Ext.memfd.name": [
+        "Filename for the created file. Appears in /proc/self/fd."
+    ],
+    "process.Ext.mitigation_policies": [
+        "Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled"
+    ],
+    "process.Ext.ptrace": [
+        "Object for ptrace events."
+    ],
+    "process.Ext.ptrace.child_pid": [
+        "PID of the ptrace target."
+    ],
+    "process.Ext.ptrace.request": [
+        "ptrace request."
+    ],
+    "process.Ext.relative_file_creation_time": [
+        "Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future."
+    ],
+    "process.Ext.relative_file_name_modify_time": [
+        "Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
+    ],
+    "process.Ext.session_info.authentication_package": [
+        "Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP"
+    ],
+    "process.Ext.session_info.client_address": [
+        "Client's IPv4 or IPv6 address as a string, if available."
+    ],
+    "process.Ext.session_info.id": [
+        "Session ID"
+    ],
+    "process.Ext.session_info.logon_type": [
+        "Session logon type.  Examples include Interactive, Network, and Service."
+    ],
+    "process.Ext.session_info.relative_logon_time": [
+        "Process creation time, relative to logon time, in seconds."
+    ],
+    "process.Ext.session_info.relative_password_age": [
+        "Process creation time, relative to the last time the password was changed, in seconds."
+    ],
+    "process.Ext.session_info.user_flags": [
+        "List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON."
+    ],
+    "process.Ext.shmget": [
+        "Object for shmget events."
+    ],
+    "process.Ext.shmget.flags": [
+        "flags passed to shmget."
+    ],
+    "process.Ext.shmget.key": [
+        "Key passed to the shmget request."
+    ],
+    "process.Ext.shmget.size": [
+        "Requested size."
+    ],
+    "process.Ext.token.elevation_level": [
+        "What level of elevation the token has"
+    ],
+    "process.Ext.token.security_attributes": [
+        "Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class."
+    ],
+    "process.Ext.trusted": [
+        "Whether or not the process is a trusted application"
+    ],
+    "process.Ext.trusted_descendant": [
+        "Whether or not the process is a descendent of a trusted application"
+    ],
+    "process.end": [
+        "The time the process ended."
+    ],
+    "process.entry_leader.attested_groups.name": [
+        "Name of the group."
+    ],
+    "process.entry_leader.attested_user.id": [
+        "Unique identifier of the user."
+    ],
+    "process.entry_leader.attested_user.name": [
+        "Short name or login of the user."
+    ],
+    "process.group.id": [
+        "Unique identifier for the group on the system/platform."
+    ],
+    "process.group.name": [
+        "Name of the group."
+    ],
+    "process.io": [
+        "A chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input."
+    ],
+    "process.io.max_bytes_per_process_exceeded": [
+        "If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting."
+    ],
+    "process.io.text": [
+        "A chunk of output or input sanitized to UTF-8.\nBest efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word."
+    ],
+    "process.io.total_bytes_captured": [
+        "The total number of bytes captured in this event."
+    ],
+    "process.io.total_bytes_skipped": [
+        "The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero"
+    ],
+    "process.parent.thread.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "process.parent.thread.Ext.call_stack": [
+        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame."
+    ],
+    "process.parent.thread.Ext.call_stack.allocation_private_bytes": [
+        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+    ],
+    "process.parent.thread.Ext.call_stack.callsite_leading_bytes": [
+        "Hex opcode bytes preceding the callsite"
+    ],
+    "process.parent.thread.Ext.call_stack.callsite_trailing_bytes": [
+        "Hex opcode bytes after the callsite (where control will return to)"
+    ],
+    "process.parent.thread.Ext.call_stack.protection": [
+        "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
+    ],
+    "process.parent.thread.Ext.call_stack.symbol_info": [
+        "The nearest symbol for `instruction_pointer`."
+    ],
+    "process.parent.thread.Ext.call_stack_contains_unbacked": [
+        "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
+    ],
+    "process.parent.thread.Ext.call_stack_summary": [
+        "Concatentation of the non-repeated modules in the call stack."
+    ],
+    "process.parent.thread.Ext.hardware_breakpoint_set": [
+        "Whether a hardware breakpoint was set for the thread. This field is omitted if false."
+    ],
+    "process.thread.capabilities.effective": [
+        "This is the set of capabilities used by the kernel to perform permission checks for the thread."
+    ],
+    "process.thread.capabilities.permitted": [
+        "This is a limiting superset for the effective capabilities that the thread may assume."
+    ],
+    "process.tty.columns": [
+        "The number of character columns per line. e.g terminal width\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'"
+    ],
+    "process.tty.rows": [
+        "The number of character rows in the terminal. e.g terminal height\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'"
+    ],
+    "user.effective.domain": [
+        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
+    ],
+    "user.effective.email": [
+        "User email address."
+    ],
+    "user.effective.full_name": [
+        "User's full name, if available."
+    ],
+    "user.effective.hash": [
+        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
+    ],
+    "user.effective.id": [
+        "Unique identifier of the user."
+    ],
+    "user.effective.name": [
+        "Short name or login of the user."
+    ],
+    "winlog.event_data": [
+        "The event-specific data. This is a non-exhaustive list of parameters that are used in Windows events."
+    ],
+    "winlog.event_data.PrivilegeList": [
+        "An array of sensitive privileges, assigned to the new logon."
+    ],
+    "Endpoint.capabilities": [
+        "Enabled capabilities"
+    ],
+    "Endpoint.status": [
+        "The current status of the endpoint e.g. enrolled, unenrolled."
+    ],
+    "action_id": [
+        "The action id",
+        "The action id"
+    ],
+    "agent_id": [
+        "Alias field that maps to {agent: {id}}"
+    ],
+    "completed_at": [
+        "Request completion timestamp when the response is done executing. Usually matches with @timestamp."
+    ],
+    "data.alert_id": [
+        "List of alert ids that triggered the action",
+        "List of alert ids that triggered the action"
+    ],
+    "data.command": [
+        "The action that is requested",
+        "The action that is requested"
+    ],
+    "data.comment": [
+        "A comment that describes the action that is requested",
+        "A comment that describes the action that is requested"
+    ],
+    "started_at": [
+        "Timestamp of start of request"
+    ],
+    "status": [
+        "The status of the request that distinguishes if the request is queued, running or completed."
+    ],
+    "EndpointActions.action_id": [
+        "The action id",
+        "The action id"
+    ],
+    "EndpointActions.completed_at": [
+        "Request completion timestamp when the response is done executing. Usually matches with @timestamp."
+    ],
+    "EndpointActions.data": [
+        "The action request information",
+        "The action request information"
+    ],
+    "EndpointActions.data.alert_id": [
+        "List of alert ids that triggered the action",
+        "List of alert ids that triggered the action"
+    ],
+    "EndpointActions.data.command": [
+        "The action that is requested",
+        "The action that is requested"
+    ],
+    "EndpointActions.data.comment": [
+        "A comment that describes the action that is requested",
+        "A comment that describes the action that is requested"
+    ],
+    "EndpointActions.started_at": [
+        "Timestamp of start of request"
+    ],
+    "EndpointActions.status": [
+        "The status of the request that distinguishes if the request is queued, running or completed."
+    ],
+    "error.code": [
+        "Error code describing the error.",
+        "Error code describing the error."
+    ],
+    "error.id": [
+        "Unique identifier for the error.",
+        "Unique identifier for the error."
+    ],
+    "error.message": [
+        "Error message.",
+        "Error message."
+    ],
+    "error.stack_trace": [
+        "The stack trace of this error in plain text.",
+        "The stack trace of this error in plain text."
+    ],
+    "error.type": [
+        "The type of the error, for example the class name of the exception.",
+        "The type of the error, for example the class name of the exception."
+    ],
+    "event.end": [
+        "`event.end` contains the date when the event ended or when the activity was last observed.",
+        "`event.end` contains the date when the event ended or when the activity was last observed.",
+        "`event.end` contains the date when the event ended or when the activity was last observed.",
+        "`event.end` contains the date when the event ended or when the activity was last observed."
+    ],
+    "event.start": [
+        "`event.start` contains the date when the event started or when the activity was first observed.",
+        "`event.start` contains the date when the event started or when the activity was first observed.",
+        "`event.start` contains the date when the event started or when the activity was first observed.",
+        "`event.start` contains the date when the event started or when the activity was first observed."
+    ],
+    "dll.Ext.defense_evasions": [
+        "List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump."
+    ],
+    "dll.Ext.device.bus_type": [
+        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+    ],
+    "dll.Ext.device.dos_name": [
+        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+    ],
+    "dll.Ext.device.file_system_type": [
+        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+    ],
+    "dll.Ext.device.nt_name": [
+        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+    ],
+    "dll.Ext.device.product_id": [
+        "ProductID of the device. It is provided by the vendor of the device if any."
+    ],
+    "dll.Ext.device.serial_number": [
+        "Serial Number of the device. It is provided by the vendor of the device if any."
+    ],
+    "dll.Ext.device.vendor_id": [
+        "VendorID of the device. It is provided by the vendor of the device."
+    ],
+    "dll.Ext.device.volume_device_type": [
+        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+    ],
+    "dll.Ext.load_index": [
+        "A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.\nThe first load index is 1."
+    ],
+    "dll.Ext.relative_file_creation_time": [
+        "Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future."
+    ],
+    "dll.Ext.relative_file_name_modify_time": [
+        "Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
+    ],
+    "dll.Ext.size": [
+        "Size of DLL"
+    ],
+    "billable": [
+        "Whether document should be included in billing calculations"
+    ],
+    "agents": [
+        "Alias field that maps to {agent: {id}}"
+    ],
+    "expiration": [
+        "Request expiration timestamp"
+    ],
+    "input_type": [
+        "The input type of the action, distinguishes endpoint actions as `endpoint`"
+    ],
+    "type": [
+        "Distinguishes the type of input. Usually set to `INPUT_ACTION`"
+    ],
+    "user_id": [
+        "The user id"
+    ],
+    "EndpointActions.expiration": [
+        "Request expiration timestamp"
+    ],
+    "EndpointActions.input_type": [
+        "The input type of the action, distinguishes endpoint actions as `endpoint`"
+    ],
+    "EndpointActions.type": [
+        "Distinguishes the type of input. Usually set to `INPUT_ACTION`"
+    ],
+    "Persistence.args": [
+        "Arguments used to execute the persistence item"
+    ],
+    "Persistence.executable": [
+        "The persistence item's executable"
+    ],
+    "Persistence.keepalive": [
+        "Keep alive option boolean"
+    ],
+    "Persistence.name": [
+        "The persistence item's name"
+    ],
+    "Persistence.path": [
+        "The file's path"
+    ],
+    "Persistence.runatload": [
+        "Run at load option boolean"
+    ],
+    "event.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "event.Ext.correlation": [
+        "Information about event this should be correlated with."
+    ],
+    "event.Ext.correlation.id": [
+        "ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event"
+    ],
+    "file.Ext.device.bus_type": [
+        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
+    ],
+    "file.Ext.device.dos_name": [
+        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
+    ],
+    "file.Ext.device.file_system_type": [
+        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
+    ],
+    "file.Ext.device.nt_name": [
+        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
+    ],
+    "file.Ext.device.product_id": [
+        "ProductID of the device. It is provided by the vendor of the device if any."
+    ],
+    "file.Ext.device.serial_number": [
+        "Serial Number of the device. It is provided by the vendor of the device if any."
+    ],
+    "file.Ext.device.vendor_id": [
+        "VendorID of the device. It is provided by the vendor of the device."
+    ],
+    "file.Ext.device.volume_device_type": [
+        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
+    ],
+    "file.Ext.entropy": [
+        "Entropy calculation of file's header and footer used to check file integrity."
+    ],
+    "file.Ext.header_bytes": [
+        "First 16 bytes of file used to check file integrity."
+    ],
+    "file.Ext.header_data": [
+        "First 16 bytes of file used to check file integrity."
+    ],
+    "file.Ext.malware_signature": [
+        "Nested version of malware_signature fieldset."
+    ],
+    "file.Ext.malware_signature.all_names": [
+        "The concatenated names of all yara signatures"
+    ],
+    "file.Ext.malware_signature.identifier": [
+        "Malware artifact identifier."
+    ],
+    "file.Ext.malware_signature.primary": [
+        "Primary malware signature match."
+    ],
+    "file.Ext.malware_signature.primary.matches": [
+        "An array of bytes representing yara signature matches"
+    ],
+    "file.Ext.malware_signature.primary.signature": [
+        "Primary malware signature match."
+    ],
+    "file.Ext.malware_signature.primary.signature.hash": [
+        "Primary malware signature hash."
+    ],
+    "file.Ext.malware_signature.primary.signature.hash.sha256": [
+        "Primary malware signature sha256."
+    ],
+    "file.Ext.malware_signature.primary.signature.id": [
+        "Primary malware signature id."
+    ],
+    "file.Ext.malware_signature.primary.signature.name": [
+        "Primary malware signature name."
+    ],
+    "file.Ext.malware_signature.secondary": [
+        "An array of malware signature matches"
+    ],
+    "file.Ext.malware_signature.version": [
+        "Primary malware signature version."
+    ],
+    "file.Ext.monotonic_id": [
+        "File event monotonic ID."
+    ],
+    "file.Ext.original.extension": [
+        "Original file extension prior to a modification event"
+    ],
+    "file.origin_referrer_url": [
+        "The url of the webpage that linked to the file."
+    ],
+    "file.origin_url": [
+        "The url where the file is hosted."
+    ],
+    "Target.process.Ext.created_suspended": [
+        "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls."
+    ],
+    "Target.process.Ext.memory_region.hash.sha256": [
+        "The sha256 of the memory region."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.secondary": [
+        "Additional matching details if available."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.secondary.matches": [
+        "The second matching details."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.secondary.signature.hash": [
+        "hash of second file matching signature."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256": [
+        "sha256 hash of second file matching signature."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.secondary.signature.id": [
+        "The id of the second yara rule matched."
+    ],
+    "Target.process.Ext.memory_region.malware_signature.secondary.signature.name": [
+        "The name of the second yara rule matched."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.dotnet": [
+        "Whether this file is a .NET PE"
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.sections": [
+        "The file's relevant sections, if it is a PE"
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5": [
+        "MD5 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384": [
+        "SHA384 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh": [
+        "TLSH hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.name": [
+        "The section's name"
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.streams": [
+        "The file's streams, if it is a PE"
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5": [
+        "MD5 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384": [
+        "SHA384 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh": [
+        "TLSH hash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.name": [
+        "The stream's name"
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.architecture": [
+        "CPU architecture target for the file."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.go_import_hash": [
+        "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.go_imports": [
+        "List of imported Go language element names and types."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.go_imports_names_entropy": [
+        "Shannon entropy calculation from the list of Go imports."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of Go imports."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.go_stripped": [
+        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.import_hash": [
+        "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.imports": [
+        "List of imported element names and types."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.imports_names_entropy": [
+        "Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.pehash": [
+        "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.sections": [
+        "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.sections.entropy": [
+        "Shannon entropy calculation from the section."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.sections.name": [
+        "PE Section List name."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.sections.physical_size": [
+        "PE Section List physical size."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.sections.var_entropy": [
+        "Variance for Shannon entropy calculation from the section."
+    ],
+    "Target.process.Ext.memory_region.mapped_pe.sections.virtual_size": [
+        "PE Section List virtual size. This is always the same as `physical_size`."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.dotnet": [
+        "Whether this file is a .NET PE"
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.sections": [
+        "The file's relevant sections, if it is a PE"
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.md5": [
+        "MD5 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384": [
+        "SHA384 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh": [
+        "TLSH hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.sections.name": [
+        "The section's name"
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.streams": [
+        "The file's streams, if it is a PE"
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.md5": [
+        "MD5 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384": [
+        "SHA384 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh": [
+        "TLSH hash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.Ext.streams.name": [
+        "The stream's name"
+    ],
+    "Target.process.Ext.memory_region.memory_pe.architecture": [
+        "CPU architecture target for the file."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.go_import_hash": [
+        "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.go_imports": [
+        "List of imported Go language element names and types."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.go_imports_names_entropy": [
+        "Shannon entropy calculation from the list of Go imports."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.go_imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of Go imports."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.go_stripped": [
+        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.import_hash": [
+        "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.imports": [
+        "List of imported element names and types."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.imports_names_entropy": [
+        "Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.pehash": [
+        "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.sections": [
+        "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.sections.entropy": [
+        "Shannon entropy calculation from the section."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.sections.name": [
+        "PE Section List name."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.sections.physical_size": [
+        "PE Section List physical size."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.sections.var_entropy": [
+        "Variance for Shannon entropy calculation from the section."
+    ],
+    "Target.process.Ext.memory_region.memory_pe.sections.virtual_size": [
+        "PE Section List virtual size. This is always the same as `physical_size`."
+    ],
+    "destination.port": [
+        "Port of the destination.",
+        "Port of the destination."
+    ],
+    "network.transport": [
+        "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
+        "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying."
+    ],
+    "network.type": [
+        "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
+        "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying."
+    ],
+    "process.Ext.api.metadata": [
+        "Information related to the API call."
+    ],
+    "process.Ext.api.metadata.amsi_filenames": [
+        "A list of filenames previously scanned by AMSI."
+    ],
+    "process.Ext.api.metadata.amsi_logs": [
+        "Information related to previous AMSI scans."
+    ],
+    "process.Ext.api.metadata.amsi_logs.entries": [
+        "A subset of the AMSI content buffers scanned prior to this event."
+    ],
+    "process.Ext.api.metadata.amsi_logs.type": [
+        "The AMSI content type scanned prior to this event."
+    ],
+    "process.Ext.api.metadata.background_callcount": [
+        "This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call."
+    ],
+    "process.Ext.api.metadata.client_is_local": [
+        "Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely."
+    ],
+    "process.Ext.api.metadata.client_machine": [
+        "Client process's machine name (provided by the client and potentially untrustworthy)."
+    ],
+    "process.Ext.api.metadata.client_machine_fqdn": [
+        "Client process's machine name FQDN (provided by the client and potentially untrustworthy)."
+    ],
+    "process.Ext.api.metadata.client_process_id": [
+        "Client process id"
+    ],
+    "process.Ext.api.metadata.ms_since_last_keyevent": [
+        "This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event."
+    ],
+    "process.Ext.api.metadata.procedure_symbol": [
+        "Summary of the hook procedure."
+    ],
+    "process.Ext.api.metadata.return_value": [
+        "Return value of RegisterRawInputDevices API call."
+    ],
+    "process.Ext.api.metadata.security_descriptor": [
+        "The security descriptor of the device."
+    ],
+    "process.Ext.api.metadata.start_address_allocation_protection": [
+        "Memory protection attributes associated with the starting address of a thread."
+    ],
+    "process.Ext.api.metadata.start_address_module": [
+        "Name of the module associated with the starting address of a thread."
+    ],
+    "process.Ext.api.metadata.target_address_name": [
+        "The name of the memory region targeted by the API call."
+    ],
+    "process.Ext.api.metadata.target_address_path": [
+        "The path of the memory region targeted by the API call."
+    ],
+    "process.Ext.api.metadata.thread_info_flags": [
+        "Thread info flags."
+    ],
+    "process.Ext.api.metadata.visible_windows_count": [
+        "Number of visible windows owned by the caller thread."
+    ],
+    "process.Ext.api.metadata.windows_count": [
+        "Number of windows owned by the caller thread."
+    ],
+    "process.Ext.api.parameters": [
+        "Parameter values passed to the API call."
+    ],
+    "process.Ext.api.parameters.address": [
+        "The target memory address."
+    ],
+    "process.Ext.api.parameters.allocation_type": [
+        "The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`"
+    ],
+    "process.Ext.api.parameters.app_name": [
+        "The application name requesting the AMSI scan."
+    ],
+    "process.Ext.api.parameters.argument1": [
+        "The first argument to the procedure."
+    ],
+    "process.Ext.api.parameters.argument2": [
+        "The second argument to the procedure."
+    ],
+    "process.Ext.api.parameters.argument3": [
+        "The third argument to the procedure."
+    ],
+    "process.Ext.api.parameters.buffer": [
+        "The content associated with an AMSI scan."
+    ],
+    "process.Ext.api.parameters.consumer_details": [
+        "Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name."
+    ],
+    "process.Ext.api.parameters.consumer_name": [
+        "Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered."
+    ],
+    "process.Ext.api.parameters.consumer_type": [
+        "An example list of consumer type.\n  \"ActiveScriptEventConsumer\" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.\n  \"CommandLineEventConsumer\" - Launches an arbitrary process in the local system context when an event is delivered to it.\n  \"LogFileEventConsumer\" - Writes customized strings to a text log file when events are delivered to it.\n  \"NTEventLogEventConsumer\" - Logs a specific message to the Windows event log when an event is delivered to it.\n  \"SMTPEventConsumer\" - Sends an email message using SMTP each time an event is delivered to it."
+    ],
+    "process.Ext.api.parameters.content_name": [
+        "The content name, typically a filename, associated with an AMSI scan."
+    ],
+    "process.Ext.api.parameters.context_flags": [
+        "The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`"
+    ],
+    "process.Ext.api.parameters.desired_access": [
+        "This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`."
+    ],
+    "process.Ext.api.parameters.desired_access_numeric": [
+        "This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`."
+    ],
+    "process.Ext.api.parameters.device": [
+        "The name of the device object."
+    ],
+    "process.Ext.api.parameters.driver": [
+        "The name of the driver object."
+    ],
+    "process.Ext.api.parameters.eax": [
+        "The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall."
+    ],
+    "process.Ext.api.parameters.ebp": [
+        "The x86 EBP frame pointer register."
+    ],
+    "process.Ext.api.parameters.ebx": [
+        "The x86 EBX general purpose register."
+    ],
+    "process.Ext.api.parameters.ecx": [
+        "The x86 ECX general purpose register. First argument in __fastcall and __thiscall."
+    ],
+    "process.Ext.api.parameters.edi": [
+        "The x86 EDI general purpose register."
+    ],
+    "process.Ext.api.parameters.edx": [
+        "The x86 EDX general purpose register. Second argument in a __fastcall."
+    ],
+    "process.Ext.api.parameters.eip": [
+        "The x86 EIP instruction pointer register."
+    ],
+    "process.Ext.api.parameters.esi": [
+        "The x86 ESI general purpose register."
+    ],
+    "process.Ext.api.parameters.esp": [
+        "The x86 ESP stack pointer register."
+    ],
+    "process.Ext.api.parameters.event_filter_details": [
+        "Provide an overview of the query that define when an event should be triggered."
+    ],
+    "process.Ext.api.parameters.event_filter_name": [
+        "Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer."
+    ],
+    "process.Ext.api.parameters.flags": [
+        "Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure."
+    ],
+    "process.Ext.api.parameters.handle_type": [
+        "This parameter indicates whether the detected access was attempt against a process or a thread."
+    ],
+    "process.Ext.api.parameters.hook_module": [
+        "DLL containing the hook procedure."
+    ],
+    "process.Ext.api.parameters.hook_type": [
+        "Type of hook procedure to be installed."
+    ],
+    "process.Ext.api.parameters.io_control_code": [
+        "The I/O control code for the requested device operation."
+    ],
+    "process.Ext.api.parameters.namespace": [
+        "WMI namespace to which the connection is made."
+    ],
+    "process.Ext.api.parameters.operation": [
+        "Specifies the connection or request to WMI"
+    ],
+    "process.Ext.api.parameters.procedure": [
+        "The memory address of the procedure or function."
+    ],
+    "process.Ext.api.parameters.protection": [
+        "The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
+    ],
+    "process.Ext.api.parameters.protection_old": [
+        "The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
+    ],
+    "process.Ext.api.parameters.r8": [
+        "The x64 R8 general purpose register. Third argument in a __fastcall."
+    ],
+    "process.Ext.api.parameters.r9": [
+        "The x64 R9 general purpose register. Fourth argument in a __fastcall."
+    ],
+    "process.Ext.api.parameters.rax": [
+        "The x64 RAX general purpose register. Return value in a __fastcall."
+    ],
+    "process.Ext.api.parameters.rbp": [
+        "The x64 RBP general purpose register."
+    ],
+    "process.Ext.api.parameters.rbx": [
+        "The x64 RBX general purpose register."
+    ],
+    "process.Ext.api.parameters.rcx": [
+        "The x64 RCX general purpose register. First argument in a __fastcall."
+    ],
+    "process.Ext.api.parameters.rdi": [
+        "The x64 RDI general purpose register."
+    ],
+    "process.Ext.api.parameters.rdx": [
+        "The x64 RDX general purpose register. Second argument in a __fastcall."
+    ],
+    "process.Ext.api.parameters.rip": [
+        "The x64 RIP instruction pointer register."
+    ],
+    "process.Ext.api.parameters.rsi": [
+        "The x64 RSI general purpose register."
+    ],
+    "process.Ext.api.parameters.rsp": [
+        "The x64 RSP stack pointer register."
+    ],
+    "process.Ext.api.parameters.size": [
+        "The size."
+    ],
+    "process.Ext.api.parameters.usage": [
+        "This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure."
+    ],
+    "process.Ext.api.parameters.usage_page": [
+        "This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure."
+    ],
+    "process.Ext.memory_region.hash.sha256": [
+        "The sha256 of the memory region."
+    ],
+    "process.Ext.memory_region.malware_signature.secondary": [
+        "Additional matching details if available."
+    ],
+    "process.Ext.memory_region.malware_signature.secondary.matches": [
+        "The second matching details."
+    ],
+    "process.Ext.memory_region.malware_signature.secondary.signature.hash": [
+        "hash of second file matching signature."
+    ],
+    "process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256": [
+        "sha256 hash of second file matching signature."
+    ],
+    "process.Ext.memory_region.malware_signature.secondary.signature.id": [
+        "The id of the second yara rule matched."
+    ],
+    "process.Ext.memory_region.malware_signature.secondary.signature.name": [
+        "The name of the second yara rule matched."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.dotnet": [
+        "Whether this file is a .NET PE"
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.sections": [
+        "The file's relevant sections, if it is a PE"
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5": [
+        "MD5 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384": [
+        "SHA384 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh": [
+        "TLSH hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.sections.name": [
+        "The section's name"
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.streams": [
+        "The file's streams, if it is a PE"
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5": [
+        "MD5 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384": [
+        "SHA384 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh": [
+        "TLSH hash."
+    ],
+    "process.Ext.memory_region.mapped_pe.Ext.streams.name": [
+        "The stream's name"
+    ],
+    "process.Ext.memory_region.mapped_pe.architecture": [
+        "CPU architecture target for the file."
+    ],
+    "process.Ext.memory_region.mapped_pe.go_import_hash": [
+        "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
+    ],
+    "process.Ext.memory_region.mapped_pe.go_imports": [
+        "List of imported Go language element names and types."
+    ],
+    "process.Ext.memory_region.mapped_pe.go_imports_names_entropy": [
+        "Shannon entropy calculation from the list of Go imports."
+    ],
+    "process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of Go imports."
+    ],
+    "process.Ext.memory_region.mapped_pe.go_stripped": [
+        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+    ],
+    "process.Ext.memory_region.mapped_pe.import_hash": [
+        "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash."
+    ],
+    "process.Ext.memory_region.mapped_pe.imports": [
+        "List of imported element names and types."
+    ],
+    "process.Ext.memory_region.mapped_pe.imports_names_entropy": [
+        "Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "process.Ext.memory_region.mapped_pe.imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "process.Ext.memory_region.mapped_pe.pehash": [
+        "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html."
+    ],
+    "process.Ext.memory_region.mapped_pe.sections": [
+        "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+    ],
+    "process.Ext.memory_region.mapped_pe.sections.entropy": [
+        "Shannon entropy calculation from the section."
+    ],
+    "process.Ext.memory_region.mapped_pe.sections.name": [
+        "PE Section List name."
+    ],
+    "process.Ext.memory_region.mapped_pe.sections.physical_size": [
+        "PE Section List physical size."
+    ],
+    "process.Ext.memory_region.mapped_pe.sections.var_entropy": [
+        "Variance for Shannon entropy calculation from the section."
+    ],
+    "process.Ext.memory_region.mapped_pe.sections.virtual_size": [
+        "PE Section List virtual size. This is always the same as `physical_size`."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.dotnet": [
+        "Whether this file is a .NET PE"
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.sections": [
+        "The file's relevant sections, if it is a PE"
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.sections.hash.md5": [
+        "MD5 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384": [
+        "SHA384 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh": [
+        "TLSH hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.sections.name": [
+        "The section's name"
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.streams": [
+        "The file's streams, if it is a PE"
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.streams.hash.md5": [
+        "MD5 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1": [
+        "SHA1 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256": [
+        "SHA256 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384": [
+        "SHA384 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512": [
+        "SHA512 hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep": [
+        "SSDEEP hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh": [
+        "TLSH hash."
+    ],
+    "process.Ext.memory_region.memory_pe.Ext.streams.name": [
+        "The stream's name"
+    ],
+    "process.Ext.memory_region.memory_pe.architecture": [
+        "CPU architecture target for the file."
+    ],
+    "process.Ext.memory_region.memory_pe.go_import_hash": [
+        "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
+    ],
+    "process.Ext.memory_region.memory_pe.go_imports": [
+        "List of imported Go language element names and types."
+    ],
+    "process.Ext.memory_region.memory_pe.go_imports_names_entropy": [
+        "Shannon entropy calculation from the list of Go imports."
+    ],
+    "process.Ext.memory_region.memory_pe.go_imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of Go imports."
+    ],
+    "process.Ext.memory_region.memory_pe.go_stripped": [
+        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
+    ],
+    "process.Ext.memory_region.memory_pe.import_hash": [
+        "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash."
+    ],
+    "process.Ext.memory_region.memory_pe.imports": [
+        "List of imported element names and types."
+    ],
+    "process.Ext.memory_region.memory_pe.imports_names_entropy": [
+        "Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "process.Ext.memory_region.memory_pe.imports_names_var_entropy": [
+        "Variance for Shannon entropy calculation from the list of imported element names and types."
+    ],
+    "process.Ext.memory_region.memory_pe.pehash": [
+        "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html."
+    ],
+    "process.Ext.memory_region.memory_pe.sections": [
+        "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
+    ],
+    "process.Ext.memory_region.memory_pe.sections.entropy": [
+        "Shannon entropy calculation from the section."
+    ],
+    "process.Ext.memory_region.memory_pe.sections.name": [
+        "PE Section List name."
+    ],
+    "process.Ext.memory_region.memory_pe.sections.physical_size": [
+        "PE Section List physical size."
+    ],
+    "process.Ext.memory_region.memory_pe.sections.var_entropy": [
+        "Variance for Shannon entropy calculation from the section."
+    ],
+    "process.Ext.memory_region.memory_pe.sections.virtual_size": [
+        "PE Section List virtual size. This is always the same as `physical_size`."
+    ],
+    "process.thread.Ext.call_stack.protection_provenance": [
+        "The name of the memory region that last modified the protection of this page.  \"Unbacked\" can indicate shellcode."
+    ],
+    "process.thread.Ext.call_stack_contains_unbacked": [
+        "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.allocation_private_bytes": [
+        "The number of bytes in this memory region that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.protection": [
+        "The memory protection for the acting region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
+    ],
+    "process.thread.Ext.call_stack_final_user_module.protection_provenance": [
+        "The name of the memory region that caused the last modification of the protection of this page. \"Unbacked\" may indicate shellcode."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.protection_provenance_path": [
+        "The path of the module that caused the last modification the protection of this page."
+    ],
+    "process.thread.Ext.call_stack_final_user_module.reason": [
+        "The unexpected call_stack_summary that led to an \"Undetermined\" protection_provenance."
+    ],
+    "destination.address": [
+        "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
+    ],
+    "destination.as.number": [
+        "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet."
+    ],
+    "destination.as.organization.name": [
+        "Organization name."
+    ],
+    "destination.bytes": [
+        "Bytes sent from the destination to the source."
+    ],
+    "destination.domain": [
+        "The domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment."
+    ],
+    "destination.packets": [
+        "Packets sent from the destination to the source."
+    ],
+    "destination.registered_domain": [
+        "The highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
+    ],
+    "destination.top_level_domain": [
+        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
+    ],
+    "dns.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "dns.Ext.options": [
+        "DNS options field, uint64, representing as a keyword to avoid overflows in ES"
+    ],
+    "dns.Ext.status": [
+        "DNS status field, uint32"
+    ],
+    "dns.question.registered_domain": [
+        "The highest registered domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
+    ],
+    "dns.question.subdomain": [
+        "The subdomain is all of the labels under the registered_domain.\nIf the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period."
+    ],
+    "dns.question.top_level_domain": [
+        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
+    ],
+    "dns.resolved_ip": [
+        "Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for."
+    ],
+    "http.request.body.bytes": [
+        "Size in bytes of the request body."
+    ],
+    "http.request.body.content": [
+        "The full HTTP request body."
+    ],
+    "http.request.bytes": [
+        "Total size in bytes of the request (body and headers)."
+    ],
+    "http.response.Ext": [
+        "Object for all custom defined fields to live in."
+    ],
+    "http.response.Ext.version": [
+        "HTTP version"
+    ],
+    "http.response.body.bytes": [
+        "Size in bytes of the response body."
+    ],
+    "http.response.body.content": [
+        "The full HTTP response body."
+    ],
+    "http.response.bytes": [
+        "Total size in bytes of the response (body and headers)."
+    ],
+    "http.response.status_code": [
+        "HTTP response status code."
+    ],
+    "network.bytes": [
+        "Total bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum."
+    ],
+    "network.community_id": [
+        "A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec."
+    ],
+    "network.direction": [
+        "Direction of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values \"ingress\" or \"egress\".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values \"inbound\", \"outbound\", \"internal\" or \"external\".\nNote that \"internal\" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that \"external\" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers."
+    ],
+    "network.iana_number": [
+        "IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number."
+    ],
+    "network.packets": [
+        "Total packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum."
+    ],
+    "network.protocol": [
+        "In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying."
+    ],
+    "source.address": [
+        "Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
+    ],
+    "source.as.number": [
+        "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet."
+    ],
+    "source.as.organization.name": [
+        "Organization name."
+    ],
+    "source.bytes": [
+        "Bytes sent from the source to the destination."
+    ],
+    "source.domain": [
+        "The domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment."
+    ],
+    "source.packets": [
+        "Packets sent from the source to the destination."
+    ],
+    "source.port": [
+        "Port of the source."
+    ],
+    "source.registered_domain": [
+        "The highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
+    ],
+    "source.top_level_domain": [
+        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
+    ],
+    "Endpoint.metrics": [
+        "Metrics fields hold the endpoint and system's performance metrics"
+    ],
+    "Endpoint.metrics.cpu": [
+        "CPU statistics"
+    ],
+    "Endpoint.metrics.cpu.endpoint": [
+        "CPU metrics for the endpoint"
+    ],
+    "Endpoint.metrics.cpu.endpoint.histogram": [
+        "This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket"
+    ],
+    "Endpoint.metrics.cpu.endpoint.latest": [
+        "Average CPU over the last sample interval"
+    ],
+    "Endpoint.metrics.cpu.endpoint.mean": [
+        "Average CPU load used by the endpoint"
+    ],
+    "Endpoint.metrics.disks": [
+        "An array of disk information for the host"
+    ],
+    "Endpoint.metrics.disks.device": [
+        "Device name"
+    ],
+    "Endpoint.metrics.disks.endpoint_drive": [
+        "This field will be present and set to true only for the drive that holds the installed endpoint"
+    ],
+    "Endpoint.metrics.disks.free": [
+        "The number of bytes marked as free on the disk"
+    ],
+    "Endpoint.metrics.disks.fstype": [
+        "The file system type for the drive"
+    ],
+    "Endpoint.metrics.disks.mount": [
+        "The disks mount location"
+    ],
+    "Endpoint.metrics.disks.total": [
+        "The size of the disk in bytes"
+    ],
+    "Endpoint.metrics.documents_volume": [
+        "Statistics about sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.alerts.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.alerts.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.alerts.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.alerts.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.sent_bytes": [
+        "Total size of API Event sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.sent_count": [
+        "Number of sent API Event documents"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.sources": [
+        "An array of API Event document statistics per source"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.sources.sent_bytes": [
+        "Total size of API Event sent documents from source"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.sources.sent_count": [
+        "Number of sent API Event documents from source"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.sources.source": [
+        "API Event document source name"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes": [
+        "Total size of suppressed API Event documents from source"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.sources.suppressed_count": [
+        "Number of suppressed API Event documents from source"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.suppressed_bytes": [
+        "Total size of suppressed API Event documents"
+    ],
+    "Endpoint.metrics.documents_volume.api_events.suppressed_count": [
+        "Number of suppressed API Event documents"
+    ],
+    "Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.dns_events.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.dns_events.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.dns_events.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.dns_events.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.file_events.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.file_events.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.file_events.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.file_events.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.library_events.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.library_events.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.library_events.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.library_events.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.network_events.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.network_events.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.network_events.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.network_events.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.overall.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.overall.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.overall.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.overall.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.process_events.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.process_events.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.process_events.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.process_events.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.registry_events.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.registry_events.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.registry_events.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.registry_events.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.security_events.sent_bytes": [
+        "Total size of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.security_events.sent_count": [
+        "Number of sent documents"
+    ],
+    "Endpoint.metrics.documents_volume.security_events.suppressed_bytes": [
+        "Total size of suppressed documents"
+    ],
+    "Endpoint.metrics.documents_volume.security_events.suppressed_count": [
+        "Number of suppressed documents"
+    ],
+    "Endpoint.metrics.event_filter.active_global_count": [
+        "The number of active global event filters"
+    ],
+    "Endpoint.metrics.event_filter.active_user_count": [
+        "The number of active user event filters"
+    ],
+    "Endpoint.metrics.malicious_behavior_rules": [
+        "An array of performance information about each malicious behavior rule"
+    ],
+    "Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent": [
+        "Perfect of Endpoint's update spent running the rule"
+    ],
+    "Endpoint.metrics.malicious_behavior_rules.id": [
+        "The rule id"
+    ],
+    "Endpoint.metrics.memory": [
+        "Memory statistics"
+    ],
+    "Endpoint.metrics.memory.endpoint": [
+        "Endpoint memory utilization"
+    ],
+    "Endpoint.metrics.memory.endpoint.private": [
+        "The memory private to the endpoint"
+    ],
+    "Endpoint.metrics.memory.endpoint.private.latest": [
+        "The memory usage by the endpoint for the last sample interval"
+    ],
+    "Endpoint.metrics.memory.endpoint.private.mean": [
+        "Average memory usage by the endpoint since its start"
+    ],
+    "Endpoint.metrics.system_impact": [
+        "An array of system impact information"
+    ],
+    "Endpoint.metrics.system_impact.authentication_events.week_idle_ms": [
+        "The total milliseconds spent queueing authentication events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.authentication_events.week_ms": [
+        "The total milliseconds spent on authentication events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.dns_events.week_idle_ms": [
+        "The total milliseconds spent queueing DNS events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.dns_events.week_ms": [
+        "The total milliseconds spent on DNS events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.file_events.week_idle_ms": [
+        "The total milliseconds spent queueing file events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.file_events.week_ms": [
+        "The total milliseconds spent on file events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.library_load_events.week_idle_ms": [
+        "The total milliseconds spent queueing library load events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.library_load_events.week_ms": [
+        "The total milliseconds spent on library load events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.malware.week_idle_ms": [
+        "The total milliseconds spent queueing malware scanning due to the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.malware.week_ms": [
+        "The total milliseconds spent on malware scanning due to the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.network_events.week_idle_ms": [
+        "The total milliseconds spent queueing network events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.network_events.week_ms": [
+        "The total milliseconds spent on network events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.overall.week_idle_ms": [
+        "The total milliseconds spent queueing activity for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.overall.week_ms": [
+        "The total milliseconds spent monitoring the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.process.code_signature": [
+        "Code signature of the process"
+    ],
+    "Endpoint.metrics.system_impact.process.code_signature.exists": [
+        "Boolean to capture if a signature is present."
+    ],
+    "Endpoint.metrics.system_impact.process.code_signature.signing_id": [
+        "'The identifier used to sign the binary.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'"
+    ],
+    "Endpoint.metrics.system_impact.process.code_signature.status": [
+        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
+    ],
+    "Endpoint.metrics.system_impact.process.code_signature.subject_name": [
+        "Subject name of the code signer"
+    ],
+    "Endpoint.metrics.system_impact.process.code_signature.team_id": [
+        "'The team identifier used to sign the binary.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'"
+    ],
+    "Endpoint.metrics.system_impact.process.code_signature.trusted": [
+        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
+    ],
+    "Endpoint.metrics.system_impact.process.code_signature.valid": [
+        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
+    ],
+    "Endpoint.metrics.system_impact.process.executable": [
+        "Path to the process executable for the impact entry"
+    ],
+    "Endpoint.metrics.system_impact.process_events.week_idle_ms": [
+        "The total milliseconds spent queueing process events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.process_events.week_ms": [
+        "The total milliseconds spent on process events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.registry_events.week_idle_ms": [
+        "The total milliseconds spent queueing registry events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.registry_events.week_ms": [
+        "The total milliseconds spent on registry events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms": [
+        "The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.threat_intelligence_events.week_ms": [
+        "The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.win32k_events.week_idle_ms": [
+        "The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week"
+    ],
+    "Endpoint.metrics.system_impact.win32k_events.week_ms": [
+        "The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week"
+    ],
+    "Endpoint.metrics.threads": [
+        "Statistics about the individual Endpoint threads (array)"
+    ],
+    "Endpoint.metrics.threads.cpu.mean": [
+        "The thread's average CPU use"
+    ],
+    "Endpoint.metrics.threads.name": [
+        "The thread name"
+    ],
+    "Endpoint.metrics.uptime": [
+        "Number of seconds since boot"
+    ],
+    "Endpoint.metrics.uptime.endpoint": [
+        "Number of seconds since the endpoint was started"
+    ],
+    "Endpoint.metrics.uptime.system": [
+        "Number of seconds since the system was started"
+    ]
+}
diff --git a/scripts/generate-docs/pydocgen/__main__.py b/scripts/generate-docs/pydocgen/__main__.py
index 34844f6ca..8ef84eed5 100644
--- a/scripts/generate-docs/pydocgen/__main__.py
+++ b/scripts/generate-docs/pydocgen/__main__.py
@@ -2,8 +2,12 @@
 import pathlib
 import traceback
 import sys
+from unittest import result
 from .models import PackageList
+from .custom_documentation import CustomDocList
 from .markdown import generate_package_list_markdown
+from sqlmodel import SQLModel, Field, create_engine, Session, select
+from typing import Optional
 
 def resolve_packages_dir() -> pathlib.Path:
     """
@@ -13,6 +17,14 @@ def resolve_packages_dir() -> pathlib.Path:
     root_dir = this_file.parents[3]
     return root_dir / "package" / "endpoint" / "data_stream"
 
+def resolve_custom_documentation_dir() -> pathlib.Path:
+    """
+    resolve_custom_documentation_dir returns the directory where the custom documentation is stored relative to this file
+    """
+    this_file = pathlib.Path(__file__).resolve()
+    root_dir = this_file.parents[3]
+    return root_dir / "custom_documentation" / "src" / "endpoint" / "data_stream"
+
 def main():
     parser = argparse.ArgumentParser(description="Dump packages as JSON")
     parser.add_argument(
@@ -29,28 +41,71 @@ def main():
     )
     args = parser.parse_args()
 
-    #
-    # Validate the output directory
-    #
-    if args.output.exists():
-        raise FileExistsError(
-            f"output directory {args.output} already exists, please remove it or specify a different directory"
-        )
-    args.output.mkdir(parents=True)
+    # #
+    # # Validate the output directory
+    # #
+    # if args.output.exists():
+    #     raise FileExistsError(
+    #         f"output directory {args.output} already exists, please remove it or specify a different directory"
+    #     )
+    # args.output.mkdir(parents=True)
 
     #
     # Create the PackageList object and dump it to a file
     #
     package_list = PackageList.from_packages_dir(args.packages_dir)
-    json_path = args.output / "packages.json"
-    with json_path.open("w") as f:
-        # Dump to json with indentation and exclude None values
-        f.write(package_list.model_dump_json(indent=4, exclude_none=True))
 
-    #
-    # Generate markdown files
-    #
-    generate_package_list_markdown(package_list, args.output)
+    fields = {}
+
+    class DocumentField(SQLModel, table=True):
+        id: Optional[int] = Field(default=None, primary_key=True)
+        name: str = Field(sa_column_kwargs={"unique": True})
+        description: str
+
+    engine = create_engine("sqlite:///:memory:")
+    SQLModel.metadata.create_all(engine)
+
+    def add_to_db(field: DocumentField, session: Session):
+        existing_field = session.exec(select(DocumentField).where(DocumentField.name == field.name)).first()
+        if existing_field:
+            if existing_field.description != field.description:
+                raise ValueError(
+                    f"Field {field.name} already exists with different description"
+                )
+        else:
+            session.add(field)
+            session.commit()
+
+    with Session(engine) as session:
+        for package in package_list:
+            for field in package.fields:
+                if field.fields:
+                    for sub_field in field.fields:
+                        name = f"{field.name}.{sub_field.name}"
+                        add_to_db(DocumentField(name=name, description=sub_field.description), session)
+                else:
+                    add_to_db(DocumentField(name=field.name, description=field.description), session)
+
+    statement = select(DocumentField).where(
+        DocumentField.name
+        == "Endpoint.metrics.system_impact.threat_intelligence_events.week_ms"
+    )
+    results = session.exec(statement)
+    for result in results:
+        print(result)
+
+    # json_path = args.output / "packages.json"
+    # with json_path.open("w") as f:
+    #     # Dump to json with indentation and exclude None values
+    #     f.write(package_list.model_dump_json(indent=4, exclude_none=True))
+
+    # #
+    # # Generate markdown files
+    # #
+    # generate_package_list_markdown(package_list, args.output)
+
+    # custom_doc_list = CustomDocList.from_yaml(resolve_custom_documentation_dir())
+    # import pdb; pdb.set_trace()
 
 if __name__ == "__main__":
     try:
diff --git a/scripts/generate-docs/pydocgen/custom_documentation.py b/scripts/generate-docs/pydocgen/custom_documentation.py
new file mode 100644
index 000000000..8323a06b9
--- /dev/null
+++ b/scripts/generate-docs/pydocgen/custom_documentation.py
@@ -0,0 +1,69 @@
+import json
+import pathlib
+import yaml
+from pydantic import BaseModel, Field
+from typing import List, Optional, Any, Dict
+
+
+class Overview(BaseModel):
+    """
+    Overview of the package
+    """
+    name: str
+    description: str
+
+class Filter(BaseModel):
+    """
+    Filter for the package
+    """
+    event_dataset: str = Field(..., alias="event.dataset")
+    event_module: str = Field(..., alias="event.module")
+    event_provider: Optional[str] = Field(None, alias="event.provider")
+    host_os_type: Optional[str] = Field(None, alias="host.os.type")
+
+
+class Identification(BaseModel):
+    """
+    Identification of the package
+    """
+    filter: Filter
+    os: List[str]
+    data_stream: str
+
+class Fields(BaseModel):
+    """
+    Fields for the package
+    """
+    endpoint: List[str]
+
+class CustomDocumentation(BaseModel):
+    """
+    Custom documentation for a package
+    """
+    overview: Overview
+    identification: Identification
+    fields: Fields
+    filepath: pathlib.Path
+
+    @classmethod
+    def from_yaml(cls, yaml_path: pathlib.Path) -> "CustomDocumentation":
+        with yaml_path.open("r") as f:
+            data = yaml.safe_load(f)
+            return cls(**data, filepath=yaml_path)
+
+
+class CustomDocList(BaseModel):
+    """
+    List of custom documentation for a package
+    """
+    map: Dict[str, CustomDocumentation]
+
+    @classmethod
+    def from_yaml(cls, yaml_dir: pathlib.Path) -> "CustomDocList":
+        yaml_files = list(yaml_dir.rglob("*.yaml"))
+        temp_map = {}
+        for yaml_path in yaml_dir.rglob("*.yaml"):
+            custom_doc = CustomDocumentation.from_yaml(yaml_path)
+            temp_map[custom_doc.filepath.stem] = custom_doc
+
+        return cls(map=temp_map)
diff --git a/scripts/generate-docs/pydocgen/models.py b/scripts/generate-docs/pydocgen/models.py
index 79e201117..2548a5c6c 100644
--- a/scripts/generate-docs/pydocgen/models.py
+++ b/scripts/generate-docs/pydocgen/models.py
@@ -1,8 +1,8 @@
 import json
 import pathlib
 import yaml
-from pydantic import BaseModel
-from typing import List, Optional, Any, Dict
+from pydantic import BaseModel, RootModel
+from typing import List, Optional, Any, Dict, Iterator
 
 
 class MultiField(BaseModel):
@@ -104,12 +104,23 @@ def from_package_dir(cls, package_dir: pathlib.Path):
         return cls(name=package_dir.name, fields=fields, sample_event=sample_event)
 
 
-class PackageList(BaseModel):
+class PackageList(RootModel):
     """
     PackageList is a list of packages
     """
+    root: List[Package] = []
 
-    packages: List[Package] = []
+    def __iter__(self) -> Iterator[Package]:
+        return iter(self.root)
+
+    def __getitem__(self, index) -> List[Package]:
+        return self.root[index]
+
+    def __len__(self) -> int:
+        return len(self.root)
+
+    def append(self, package: Package) -> None:
+        self.root.append(package)
 
     @classmethod
     def from_packages_dir(cls, packages_dir: pathlib.Path):
@@ -123,4 +134,4 @@ def from_packages_dir(cls, packages_dir: pathlib.Path):
         packages = [
             Package.from_package_dir(package_path) for package_path in package_paths
         ]
-        return cls(packages=packages)
+        return cls(root=packages)

From 8e768a1f787c19a085ae5d7a022c3bb3cdb5a503 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 21 Mar 2025 21:47:05 +0000
Subject: [PATCH 08/25] stashing

---
 scripts/generate-docs/pydocgen/__main__.py    |  98 +++++++------
 .../pydocgen/custom_documentation.py          |  69 ---------
 scripts/generate-docs/pydocgen/models.py      | 137 ------------------
 3 files changed, 53 insertions(+), 251 deletions(-)
 delete mode 100644 scripts/generate-docs/pydocgen/custom_documentation.py
 delete mode 100644 scripts/generate-docs/pydocgen/models.py

diff --git a/scripts/generate-docs/pydocgen/__main__.py b/scripts/generate-docs/pydocgen/__main__.py
index 8ef84eed5..e572487c9 100644
--- a/scripts/generate-docs/pydocgen/__main__.py
+++ b/scripts/generate-docs/pydocgen/__main__.py
@@ -2,11 +2,16 @@
 import pathlib
 import traceback
 import sys
+import tempfile
 from unittest import result
-from .models import PackageList
-from .custom_documentation import CustomDocList
+
+from .models.packages import PackageList
+from .models.custom_documentation import CustomDocList
 from .markdown import generate_package_list_markdown
 from sqlmodel import SQLModel, Field, create_engine, Session, select
+from sqlalchemy import Engine
+
+
 from typing import Optional
 
 def resolve_packages_dir() -> pathlib.Path:
@@ -53,59 +58,62 @@ def main():
     #
     # Create the PackageList object and dump it to a file
     #
-    package_list = PackageList.from_packages_dir(args.packages_dir)
+    # package_list = PackageList.from_packages_dir(args.packages_dir)
+
+    def createDatabase(db_path: pathlib.Path) -> Engine:
 
-    fields = {}
+        if db_path.exists():
+            print(f"{db_path} already exists, skipping database creation")
+            return create_engine(f"sqlite:///{db_path}")
+
+        def add_to_db(field: DocumentField, session: Session):
+            existing_field = session.exec(
+                select(DocumentField).where(DocumentField.name == field.name)
+            ).first()
+            if existing_field:
+                if existing_field.description != field.description:
+                    raise ValueError(
+                        f"Field {field.name} already exists with different description"
+                    )
+            else:
+                session.add(field)
+
+        print(f"{db_path} does not exist, creating database")
+        engine = create_engine(f"sqlite:///{db_path}")
+        SQLModel.metadata.create_all(engine)
+        package_list = PackageList.from_packages_dir(args.packages_dir)
+        with Session(engine) as session:
+            for package in package_list:
+                for field in package.fields:
+                    if field.fields:
+                        for sub_field in field.fields:
+                            name = f"{field.name}.{sub_field.name}"
+                            add_to_db(DocumentField(name=name, description=sub_field.description), session)
+                    else:
+                        add_to_db(DocumentField(name=field.name, description=field.description), session)
+            session.commit()
+        return engine
 
     class DocumentField(SQLModel, table=True):
         id: Optional[int] = Field(default=None, primary_key=True)
         name: str = Field(sa_column_kwargs={"unique": True})
         description: str
 
-    engine = create_engine("sqlite:///:memory:")
-    SQLModel.metadata.create_all(engine)
-
-    def add_to_db(field: DocumentField, session: Session):
-        existing_field = session.exec(select(DocumentField).where(DocumentField.name == field.name)).first()
-        if existing_field:
-            if existing_field.description != field.description:
-                raise ValueError(
-                    f"Field {field.name} already exists with different description"
-                )
-        else:
-            session.add(field)
-            session.commit()
+    db_path = pathlib.Path(tempfile.gettempdir()) / "generate-docs.db"
+    engine = createDatabase(db_path)
 
+    custom_docs = CustomDocList.from_yaml(resolve_custom_documentation_dir())
+
+    not_found_fields = []
     with Session(engine) as session:
-        for package in package_list:
-            for field in package.fields:
-                if field.fields:
-                    for sub_field in field.fields:
-                        name = f"{field.name}.{sub_field.name}"
-                        add_to_db(DocumentField(name=name, description=sub_field.description), session)
+        for custom_doc in custom_docs:
+            for field in custom_doc.fields.endpoint:
+                statement = select(DocumentField).where(DocumentField.name == field)
+                result = session.exec(statement).first()
+                if not result:
+                    print(f"name: {field}, description: <Description Not Found>")
                 else:
-                    add_to_db(DocumentField(name=field.name, description=field.description), session)
-
-    statement = select(DocumentField).where(
-        DocumentField.name
-        == "Endpoint.metrics.system_impact.threat_intelligence_events.week_ms"
-    )
-    results = session.exec(statement)
-    for result in results:
-        print(result)
-
-    # json_path = args.output / "packages.json"
-    # with json_path.open("w") as f:
-    #     # Dump to json with indentation and exclude None values
-    #     f.write(package_list.model_dump_json(indent=4, exclude_none=True))
-
-    # #
-    # # Generate markdown files
-    # #
-    # generate_package_list_markdown(package_list, args.output)
-
-    # custom_doc_list = CustomDocList.from_yaml(resolve_custom_documentation_dir())
-    # import pdb; pdb.set_trace()
+                    print(f"name: {result.name}, description: {result.description}")
 
 if __name__ == "__main__":
     try:
diff --git a/scripts/generate-docs/pydocgen/custom_documentation.py b/scripts/generate-docs/pydocgen/custom_documentation.py
deleted file mode 100644
index 8323a06b9..000000000
--- a/scripts/generate-docs/pydocgen/custom_documentation.py
+++ /dev/null
@@ -1,69 +0,0 @@
-import json
-import pathlib
-import yaml
-from pydantic import BaseModel, Field
-from typing import List, Optional, Any, Dict
-
-
-class Overview(BaseModel):
-    """
-    Overview of the package
-    """
-    name: str
-    description: str
-
-class Filter(BaseModel):
-    """
-    Filter for the package
-    """
-    event_dataset: str = Field(..., alias="event.dataset")
-    event_module: str = Field(..., alias="event.module")
-    event_provider: Optional[str] = Field(None, alias="event.provider")
-    host_os_type: Optional[str] = Field(None, alias="host.os.type")
-
-
-class Identification(BaseModel):
-    """
-    Identification of the package
-    """
-    filter: Filter
-    os: List[str]
-    data_stream: str
-
-class Fields(BaseModel):
-    """
-    Fields for the package
-    """
-    endpoint: List[str]
-
-class CustomDocumentation(BaseModel):
-    """
-    Custom documentation for a package
-    """
-    overview: Overview
-    identification: Identification
-    fields: Fields
-    filepath: pathlib.Path
-
-    @classmethod
-    def from_yaml(cls, yaml_path: pathlib.Path) -> "CustomDocumentation":
-        with yaml_path.open("r") as f:
-            data = yaml.safe_load(f)
-            return cls(**data, filepath=yaml_path)
-
-
-class CustomDocList(BaseModel):
-    """
-    List of custom documentation for a package
-    """
-    map: Dict[str, CustomDocumentation]
-
-    @classmethod
-    def from_yaml(cls, yaml_dir: pathlib.Path) -> "CustomDocList":
-        yaml_files = list(yaml_dir.rglob("*.yaml"))
-        temp_map = {}
-        for yaml_path in yaml_dir.rglob("*.yaml"):
-            custom_doc = CustomDocumentation.from_yaml(yaml_path)
-            temp_map[custom_doc.filepath.stem] = custom_doc
-
-        return cls(map=temp_map)
diff --git a/scripts/generate-docs/pydocgen/models.py b/scripts/generate-docs/pydocgen/models.py
deleted file mode 100644
index 2548a5c6c..000000000
--- a/scripts/generate-docs/pydocgen/models.py
+++ /dev/null
@@ -1,137 +0,0 @@
-import json
-import pathlib
-import yaml
-from pydantic import BaseModel, RootModel
-from typing import List, Optional, Any, Dict, Iterator
-
-
-class MultiField(BaseModel):
-    """
-    fields can have a number of multi_fields
-    """
-
-    name: str
-    type: str
-    norms: Optional[bool] = None
-    normalizer: Optional[str] = None
-    ignore_above: Optional[int] = None
-    default_field: Optional[bool] = None
-
-    class Config:
-        """
-        this config setting ensures that the model will raise an error if any extra fields are present
-        """
-
-        extra = "forbid"
-
-
-class Field(BaseModel):
-    """
-    Field field as defined in fields.yml
-    """
-
-    name: str
-    title: Optional[str] = None
-    default_field: Optional[bool] = None
-    level: Optional[str] = None
-    type: Optional[str] = None
-    ignore_above: Optional[int] = None
-    description: Optional[str] = None
-    fields: Optional[List["Field"]] = None
-    required: Optional[bool] = None
-    group: Optional[int] = None
-    multi_fields: Optional[List[MultiField]] = None
-    example: Optional[Any] = None
-    format: Optional[str] = None
-    enabled: Optional[bool] = None
-    doc_values: Optional[bool] = None
-    index: Optional[bool] = None
-    footnote: Optional[str] = None
-    pattern: Optional[str] = None
-    path: Optional[str] = None
-
-    class Config:
-        """
-        this config setting ensures that the model will raise an error if any extra fields are present
-        """
-
-        extra = "forbid"
-
-
-class Package(BaseModel):
-    """
-    A package consists of a name, a list of fields and an optional sample event
-    """
-
-    name: str
-    fields: List[Field]
-    sample_event: Optional[Dict[Any, Any]] = None
-
-    @classmethod
-    def from_package_dir(cls, package_dir: pathlib.Path):
-        """
-        takes a directory and returns a Package object
-        - name is the name of the directory (package)
-        - fields are read from fields/fields.yml
-        - sample_event is read from sample_event.json if it exists
-
-        Args:
-            package_dir: directory holding the package data
-        """
-        if not package_dir.exists():
-            raise ValueError(f"package directory {package_dir} does not exist")
-        if not package_dir.is_dir():
-            raise ValueError(f"package directory {package_dir} is not a directory")
-
-        #
-        # read fields from fields.yml and create Field objects
-        #
-        fields_path = package_dir / "fields" / "fields.yml"
-        fields_data = yaml.safe_load(fields_path.read_text())
-        fields = [Field(**field) for field in fields_data]
-
-        #
-        # read sample event if it exists
-        #
-        sample_event = None
-        sample_event_path = package_dir / "sample_event.json"
-        if sample_event_path.exists():
-            sample_event = json.loads(sample_event_path.read_text())
-
-        #
-        # return the Package object
-        #
-        return cls(name=package_dir.name, fields=fields, sample_event=sample_event)
-
-
-class PackageList(RootModel):
-    """
-    PackageList is a list of packages
-    """
-    root: List[Package] = []
-
-    def __iter__(self) -> Iterator[Package]:
-        return iter(self.root)
-
-    def __getitem__(self, index) -> List[Package]:
-        return self.root[index]
-
-    def __len__(self) -> int:
-        return len(self.root)
-
-    def append(self, package: Package) -> None:
-        self.root.append(package)
-
-    @classmethod
-    def from_packages_dir(cls, packages_dir: pathlib.Path):
-        """
-        from_packages_dir creates a PackageList from a directory of packages
-
-        Args:
-            packages_dir: top level directory holding the packages
-        """
-        package_paths = list(packages_dir.glob("*"))
-        packages = [
-            Package.from_package_dir(package_path) for package_path in package_paths
-        ]
-        return cls(root=packages)

From 57b677f381aeafe4c3d3545294cb3d73a4955cd8 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Tue, 25 Mar 2025 22:05:46 +0000
Subject: [PATCH 09/25] custom documentation markdown

---
 scripts/generate-docs/output/README.md        |  4162 --
 .../generate-docs/output/action_responses.md  |   249 -
 scripts/generate-docs/output/actions.md       |   296 -
 scripts/generate-docs/output/alerts.md        |  2373 -
 scripts/generate-docs/output/api.md           |   715 -
 scripts/generate-docs/output/collection.md    |   106 -
 scripts/generate-docs/output/file.md          |   518 -
 scripts/generate-docs/output/heartbeat.md     |    96 -
 scripts/generate-docs/output/library.md       |   501 -
 scripts/generate-docs/output/metadata.md      |   214 -
 scripts/generate-docs/output/metrics.md       |   316 -
 scripts/generate-docs/output/network.md       |   482 -
 scripts/generate-docs/output/packages.json    | 36484 ----------------
 scripts/generate-docs/output/policy.md        |   264 -
 scripts/generate-docs/output/process.md       |   804 -
 scripts/generate-docs/output/registry.md      |   401 -
 scripts/generate-docs/output/security.md      |   411 -
 scripts/generate-docs/pydocgen/__main__.py    |   177 +-
 scripts/generate-docs/pydocgen/markdown.py    |   254 +-
 .../linux/linux_malicious_behavior_alert.md   |   133 +
 .../alerts/linux/linux_malware_alert.md       |   244 +
 .../alerts/linux/linux_memory_threat_alert.md |   218 +
 .../macos/macos_malicious_behavior_alert.md   |   120 +
 .../alerts/macos/macos_malware_alert.md       |   162 +
 .../alerts/macos/macos_memory_threat_alert.md |   142 +
 .../windows_malicious_behavior_alert.md       |   129 +
 .../alerts/windows/windows_malware_alert.md   |   217 +
 .../windows/windows_memory_threat_alert.md    |   158 +
 .../windows/windows_ransomware_alert.md       |   187 +
 .../windows/windows_shellcode_thread.md       |   274 +
 .../api/windows/windows_api_amsi.md           |    89 +
 .../api/windows/windows_api_asm.md            |    92 +
 .../windows/windows_api_credential_access.md  |    89 +
 .../api/windows/windows_api_kernel_audit.md   |    84 +
 .../api/windows/windows_api_tcpip.md          |    88 +
 .../windows_api_threat_intelligence.md        |   128 +
 .../api/windows/windows_api_win32k.md         |   110 +
 .../api/windows/windows_api_wmi.md            |    99 +
 .../file/linux/linux_file_create.md           |    85 +
 .../file/linux/linux_file_delete.md           |    84 +
 .../linux/linux_file_endpoint_unquarantine.md |    68 +
 .../file/linux/linux_file_rename.md           |    88 +
 .../file/macos/macos_file_access.md           |    77 +
 .../file/macos/macos_file_delete.md           |    92 +
 .../macos/macos_file_endpoint_unquarantine.md |    68 +
 .../macos_file_extended_attributes_delete.md  |    92 +
 .../file/macos/macos_file_launch_daemon.md    |    90 +
 .../file/macos/macos_file_modification.md     |    94 +
 .../file/macos/macos_file_mount.md            |    89 +
 .../file/macos/macos_file_rename.md           |    95 +
 .../file/windows/windows_file_create.md       |    96 +
 .../file/windows/windows_file_delete.md       |    91 +
 .../windows_file_endpoint_unquarantine.md     |    68 +
 .../file/windows/windows_file_modification.md |    92 +
 .../file/windows/windows_file_open.md         |    93 +
 .../file/windows/windows_file_overwrite.md    |    92 +
 .../file/windows/windows_file_rename.md       |    96 +
 .../library/macos/macos_library_load.md       |    95 +
 .../library/windows/windows_library_load.md   |   101 +
 .../sample_output/metadata/metadata.md        |    72 +
 .../sample_output/metrics/metrics.md          |   212 +
 ...twork_attempted_accepted_and_disconnect.md |    96 +
 .../linux/linux_network_dns_lookup_result.md  |    78 +
 ...ork_connection_attempted_and_disconnect.md |    94 +
 .../macos/macos_network_dns_lookup_result.md  |    97 +
 ...twork_attempted_accepted_and_disconnect.md |    90 +
 .../windows_network_dns_lookup_requested.md   |    84 +
 .../windows_network_dns_lookup_result.md      |    85 +
 .../sample_output/policy/policy_response.md   |   113 +
 .../linux/linux_process_already_running.md    |   214 +
 .../linux/linux_process_fork_exec_exit.md     |   218 +
 .../process/linux/linux_process_gid_change.md |   216 +
 .../linux/linux_process_memfd_create.md       |   219 +
 .../process/linux/linux_process_ptrace.md     |   215 +
 .../linux/linux_process_session_id_change.md  |   212 +
 .../process/linux/linux_process_shmget.md     |   215 +
 .../linux/linux_process_text_output.md        |   218 +
 .../process/linux/linux_process_uid_change.md |   216 +
 .../macos/macos_process_already_running.md    |    93 +
 .../macos/macos_process_fork_exec_exit.md     |   111 +
 .../macos/macos_process_remote_thread.md      |   106 +
 .../windows_process_already_running.md        |   118 +
 .../windows_process_create_and_exit.md        |   143 +
 .../windows/windows_registry_modification.md  |    89 +
 .../windows/windows_registry_query.md         |    87 +
 .../macos_security_gatekeeper_override.md     |    93 +
 .../security/macos/macos_security_log_on.md   |    90 +
 .../macos/macos_security_rdp_log_on.md        |    90 +
 .../macos/macos_security_ssh_log_on.md        |    90 +
 .../windows/windows_security_log_off.md       |    85 +
 .../windows/windows_security_log_on.md        |    88 +
 .../windows/windows_volume_device_mount.md    |    86 +
 .../windows/windows_volume_device_unmount.md  |    77 +
 93 files changed, 9273 insertions(+), 48569 deletions(-)
 delete mode 100644 scripts/generate-docs/output/README.md
 delete mode 100644 scripts/generate-docs/output/action_responses.md
 delete mode 100644 scripts/generate-docs/output/actions.md
 delete mode 100644 scripts/generate-docs/output/alerts.md
 delete mode 100644 scripts/generate-docs/output/api.md
 delete mode 100644 scripts/generate-docs/output/collection.md
 delete mode 100644 scripts/generate-docs/output/file.md
 delete mode 100644 scripts/generate-docs/output/heartbeat.md
 delete mode 100644 scripts/generate-docs/output/library.md
 delete mode 100644 scripts/generate-docs/output/metadata.md
 delete mode 100644 scripts/generate-docs/output/metrics.md
 delete mode 100644 scripts/generate-docs/output/network.md
 delete mode 100644 scripts/generate-docs/output/packages.json
 delete mode 100644 scripts/generate-docs/output/policy.md
 delete mode 100644 scripts/generate-docs/output/process.md
 delete mode 100644 scripts/generate-docs/output/registry.md
 delete mode 100644 scripts/generate-docs/output/security.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/linux/linux_malicious_behavior_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/linux/linux_malware_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/linux/linux_memory_threat_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/macos/macos_malicious_behavior_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/macos/macos_malware_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/macos/macos_memory_threat_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/windows/windows_malicious_behavior_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/windows/windows_malware_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/windows/windows_memory_threat_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/windows/windows_ransomware_alert.md
 create mode 100644 scripts/generate-docs/sample_output/alerts/windows/windows_shellcode_thread.md
 create mode 100644 scripts/generate-docs/sample_output/api/windows/windows_api_amsi.md
 create mode 100644 scripts/generate-docs/sample_output/api/windows/windows_api_asm.md
 create mode 100644 scripts/generate-docs/sample_output/api/windows/windows_api_credential_access.md
 create mode 100644 scripts/generate-docs/sample_output/api/windows/windows_api_kernel_audit.md
 create mode 100644 scripts/generate-docs/sample_output/api/windows/windows_api_tcpip.md
 create mode 100644 scripts/generate-docs/sample_output/api/windows/windows_api_threat_intelligence.md
 create mode 100644 scripts/generate-docs/sample_output/api/windows/windows_api_win32k.md
 create mode 100644 scripts/generate-docs/sample_output/api/windows/windows_api_wmi.md
 create mode 100644 scripts/generate-docs/sample_output/file/linux/linux_file_create.md
 create mode 100644 scripts/generate-docs/sample_output/file/linux/linux_file_delete.md
 create mode 100644 scripts/generate-docs/sample_output/file/linux/linux_file_endpoint_unquarantine.md
 create mode 100644 scripts/generate-docs/sample_output/file/linux/linux_file_rename.md
 create mode 100644 scripts/generate-docs/sample_output/file/macos/macos_file_access.md
 create mode 100644 scripts/generate-docs/sample_output/file/macos/macos_file_delete.md
 create mode 100644 scripts/generate-docs/sample_output/file/macos/macos_file_endpoint_unquarantine.md
 create mode 100644 scripts/generate-docs/sample_output/file/macos/macos_file_extended_attributes_delete.md
 create mode 100644 scripts/generate-docs/sample_output/file/macos/macos_file_launch_daemon.md
 create mode 100644 scripts/generate-docs/sample_output/file/macos/macos_file_modification.md
 create mode 100644 scripts/generate-docs/sample_output/file/macos/macos_file_mount.md
 create mode 100644 scripts/generate-docs/sample_output/file/macos/macos_file_rename.md
 create mode 100644 scripts/generate-docs/sample_output/file/windows/windows_file_create.md
 create mode 100644 scripts/generate-docs/sample_output/file/windows/windows_file_delete.md
 create mode 100644 scripts/generate-docs/sample_output/file/windows/windows_file_endpoint_unquarantine.md
 create mode 100644 scripts/generate-docs/sample_output/file/windows/windows_file_modification.md
 create mode 100644 scripts/generate-docs/sample_output/file/windows/windows_file_open.md
 create mode 100644 scripts/generate-docs/sample_output/file/windows/windows_file_overwrite.md
 create mode 100644 scripts/generate-docs/sample_output/file/windows/windows_file_rename.md
 create mode 100644 scripts/generate-docs/sample_output/library/macos/macos_library_load.md
 create mode 100644 scripts/generate-docs/sample_output/library/windows/windows_library_load.md
 create mode 100644 scripts/generate-docs/sample_output/metadata/metadata.md
 create mode 100644 scripts/generate-docs/sample_output/metrics/metrics.md
 create mode 100644 scripts/generate-docs/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
 create mode 100644 scripts/generate-docs/sample_output/network/linux/linux_network_dns_lookup_result.md
 create mode 100644 scripts/generate-docs/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
 create mode 100644 scripts/generate-docs/sample_output/network/macos/macos_network_dns_lookup_result.md
 create mode 100644 scripts/generate-docs/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
 create mode 100644 scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_requested.md
 create mode 100644 scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_result.md
 create mode 100644 scripts/generate-docs/sample_output/policy/policy_response.md
 create mode 100644 scripts/generate-docs/sample_output/process/linux/linux_process_already_running.md
 create mode 100644 scripts/generate-docs/sample_output/process/linux/linux_process_fork_exec_exit.md
 create mode 100644 scripts/generate-docs/sample_output/process/linux/linux_process_gid_change.md
 create mode 100644 scripts/generate-docs/sample_output/process/linux/linux_process_memfd_create.md
 create mode 100644 scripts/generate-docs/sample_output/process/linux/linux_process_ptrace.md
 create mode 100644 scripts/generate-docs/sample_output/process/linux/linux_process_session_id_change.md
 create mode 100644 scripts/generate-docs/sample_output/process/linux/linux_process_shmget.md
 create mode 100644 scripts/generate-docs/sample_output/process/linux/linux_process_text_output.md
 create mode 100644 scripts/generate-docs/sample_output/process/linux/linux_process_uid_change.md
 create mode 100644 scripts/generate-docs/sample_output/process/macos/macos_process_already_running.md
 create mode 100644 scripts/generate-docs/sample_output/process/macos/macos_process_fork_exec_exit.md
 create mode 100644 scripts/generate-docs/sample_output/process/macos/macos_process_remote_thread.md
 create mode 100644 scripts/generate-docs/sample_output/process/windows/windows_process_already_running.md
 create mode 100644 scripts/generate-docs/sample_output/process/windows/windows_process_create_and_exit.md
 create mode 100644 scripts/generate-docs/sample_output/registry/windows/windows_registry_modification.md
 create mode 100644 scripts/generate-docs/sample_output/registry/windows/windows_registry_query.md
 create mode 100644 scripts/generate-docs/sample_output/security/macos/macos_security_gatekeeper_override.md
 create mode 100644 scripts/generate-docs/sample_output/security/macos/macos_security_log_on.md
 create mode 100644 scripts/generate-docs/sample_output/security/macos/macos_security_rdp_log_on.md
 create mode 100644 scripts/generate-docs/sample_output/security/macos/macos_security_ssh_log_on.md
 create mode 100644 scripts/generate-docs/sample_output/security/windows/windows_security_log_off.md
 create mode 100644 scripts/generate-docs/sample_output/security/windows/windows_security_log_on.md
 create mode 100644 scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_mount.md
 create mode 100644 scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_unmount.md

diff --git a/scripts/generate-docs/output/README.md b/scripts/generate-docs/output/README.md
deleted file mode 100644
index 3bbe5985b..000000000
--- a/scripts/generate-docs/output/README.md
+++ /dev/null
@@ -1,4162 +0,0 @@
-# alerts
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "agent": {
-        "build": {
-            "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-        },
-        "id": "2b1eb7f7-bd61-436a-98af-c2b182043476",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "container": {
-        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-        "image": {
-            "name": "docker.io/library/nginx",
-            "tag": "latest"
-        },
-        "name": "nginx"
-    },
-    "cloud": {
-        "account": {
-            "id": "1234"
-        },
-        "instance": {
-            "name": "webserver-12"
-        },
-        "project": {
-            "id": "1234"
-        },
-        "provider": "aws",
-        "region": "us-east-1"
-    },
-    "orchestrator": {
-        "cluster": {
-            "name": "webservers"
-        },
-        "namespace": "webapp",
-        "resource": {
-            "name": "webservers",
-            "type": "kubernetes"
-        }
-    },
-    "process": {
-        "Ext": {
-            "ancestry": [
-                "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw"
-            ],
-            "protection": "PsProtectedSignerWinSystem",
-            "user": "SYSTEM",
-            "architecture": "x86_64",
-            "token": {
-                "elevation": true,
-                "integrity_level_name": "system",
-                "domain": "NT AUTHORITY",
-                "user": "SYSTEM",
-                "elevation_type": "default",
-                "sid": "S-1-5-18"
-            },
-            "memory_region": {
-                "region_size": 4096,
-                "region_protection": "RWX",
-                "allocation_base": 2401471234048,
-                "allocation_type": "PRIVATE",
-                "bytes_allocation_offset": 0,
-                "region_state": "COMMIT",
-                "bytes_compressed_present": false,
-                "region_start_bytes": "58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124",
-                "allocation_protection": "RW-",
-                "region_base": 2401471238144,
-                "allocation_size": 8192,
-                "bytes_address": 2401471234048
-            }
-        },
-        "parent": {
-            "Ext": {
-                "protection": "",
-                "user": "",
-                "architecture": "unknown"
-            },
-            "name": "System Idle Process",
-            "start": "2022-04-04T12:15:41.4606245Z",
-            "pid": 0,
-            "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
-            "command_line": "",
-            "executable": "",
-            "ppid": 0,
-            "uptime": 822
-        },
-        "pe": {},
-        "name": "System",
-        "start": "2022-04-04T12:15:41.4606245Z",
-        "pid": 4,
-        "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTQtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
-        "command_line": "",
-        "executable": "",
-        "thread": {
-            "Ext": {
-                "call_stack": [
-                    {
-                        "instruction_pointer": 140705188471348,
-                        "memory_section": {
-                            "memory_address": 140705187827712,
-                            "memory_size": 1163264,
-                            "protection": "R-X"
-                        },
-                        "module_name": "ntdll.dll",
-                        "module_path": "c:\\windows\\system32\\ntdll.dll",
-                        "symbol_info": "c:\\windows\\system32\\ntdll.dll!NtAlpcSendWaitReceivePort+0x14"
-                    },
-                    {
-                        "instruction_pointer": 140705158956066,
-                        "memory_section": {
-                            "memory_address": 140705158664192,
-                            "memory_size": 921600,
-                            "protection": "R-X"
-                        },
-                        "module_name": "rpcrt4.dll",
-                        "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                        "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879048422"
-                    },
-                    {
-                        "instruction_pointer": 140705158944113,
-                        "memory_section": {
-                            "memory_address": 140705158664192,
-                            "memory_size": 921600,
-                            "protection": "R-X"
-                        },
-                        "module_name": "rpcrt4.dll",
-                        "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                        "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879045571"
-                    },
-                    {
-                        "instruction_pointer": 140705158854463,
-                        "memory_section": {
-                            "memory_address": 140705158664192,
-                            "memory_size": 921600,
-                            "protection": "R-X"
-                        },
-                        "module_name": "rpcrt4.dll",
-                        "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                        "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF87902F73F"
-                    },
-                    {
-                        "instruction_pointer": 140705155101013,
-                        "memory_section": {
-                            "memory_address": 140705154535424,
-                            "memory_size": 2334720,
-                            "protection": "R-X"
-                        },
-                        "module_name": "combase.dll",
-                        "module_path": "c:\\windows\\system32\\combase.dll",
-                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9B155"
-                    },
-                    {
-                        "instruction_pointer": 140705155097096,
-                        "memory_section": {
-                            "memory_address": 140705154535424,
-                            "memory_size": 2334720,
-                            "protection": "R-X"
-                        },
-                        "module_name": "combase.dll",
-                        "module_path": "c:\\windows\\system32\\combase.dll",
-                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9A208"
-                    },
-                    {
-                        "instruction_pointer": 140705155090820,
-                        "memory_section": {
-                            "memory_address": 140705154535424,
-                            "memory_size": 2334720,
-                            "protection": "R-X"
-                        },
-                        "module_name": "combase.dll",
-                        "module_path": "c:\\windows\\system32\\combase.dll",
-                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C98984"
-                    },
-                    {
-                        "instruction_pointer": 140705155093243,
-                        "memory_section": {
-                            "memory_address": 140705154535424,
-                            "memory_size": 2334720,
-                            "protection": "R-X"
-                        },
-                        "module_name": "combase.dll",
-                        "module_path": "c:\\windows\\system32\\combase.dll",
-                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C992FB"
-                    },
-                    {
-                        "instruction_pointer": 140705155073556,
-                        "memory_section": {
-                            "memory_address": 140705154535424,
-                            "memory_size": 2334720,
-                            "protection": "R-X"
-                        },
-                        "module_name": "combase.dll",
-                        "module_path": "c:\\windows\\system32\\combase.dll",
-                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C94614"
-                    },
-                    {
-                        "instruction_pointer": 140705155277630,
-                        "memory_section": {
-                            "memory_address": 140705154535424,
-                            "memory_size": 2334720,
-                            "protection": "R-X"
-                        },
-                        "module_name": "combase.dll",
-                        "module_path": "c:\\windows\\system32\\combase.dll",
-                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC633E"
-                    },
-                    {
-                        "instruction_pointer": 140705158666224,
-                        "memory_section": {
-                            "memory_address": 140705158664192,
-                            "memory_size": 921600,
-                            "protection": "R-X"
-                        },
-                        "module_name": "rpcrt4.dll",
-                        "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                        "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF8790017F0"
-                    },
-                    {
-                        "instruction_pointer": 140705155255496,
-                        "memory_section": {
-                            "memory_address": 140705154535424,
-                            "memory_size": 2334720,
-                            "protection": "R-X"
-                        },
-                        "module_name": "combase.dll",
-                        "module_path": "c:\\windows\\system32\\combase.dll",
-                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC0CC8"
-                    },
-                    {
-                        "instruction_pointer": 140705155775858,
-                        "memory_section": {
-                            "memory_address": 140705154535424,
-                            "memory_size": 2334720,
-                            "protection": "R-X"
-                        },
-                        "module_name": "combase.dll",
-                        "module_path": "c:\\windows\\system32\\combase.dll",
-                        "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878D3FD72"
-                    },
-                    {
-                        "instruction_pointer": 140704876148243,
-                        "memory_section": {
-                            "memory_address": 140704875483136,
-                            "memory_size": 708608,
-                            "protection": "R-X"
-                        },
-                        "module_name": "fastprox.dll",
-                        "module_path": "c:\\windows\\system32\\wbem\\fastprox.dll",
-                        "symbol_info": "c:\\windows\\system32\\wbem\\fastprox.dll!0x7FF868293613"
-                    },
-                    {
-                        "instruction_pointer": 140699640718787,
-                        "memory_section": {
-                            "memory_address": 140699634241536,
-                            "memory_size": 9220096,
-                            "protection": "R-X"
-                        },
-                        "module_name": "alertstests.exe",
-                        "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
-                        "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301AE5C3"
-                    },
-                    {
-                        "instruction_pointer": 140699640807495,
-                        "memory_section": {
-                            "memory_address": 140699634241536,
-                            "memory_size": 9220096,
-                            "protection": "R-X"
-                        },
-                        "module_name": "alertstests.exe",
-                        "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
-                        "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301C4047"
-                    },
-                    {
-                        "instruction_pointer": 140705160001044,
-                        "memory_section": {
-                            "memory_address": 140705159909376,
-                            "memory_size": 520192,
-                            "protection": "R-X"
-                        },
-                        "module_name": "kernel32.dll",
-                        "module_path": "c:\\windows\\system32\\kernel32.dll",
-                        "symbol_info": "c:\\windows\\system32\\kernel32.dll!BaseThreadInitThunk+0x14"
-                    },
-                    {
-                        "instruction_pointer": 140705188161185,
-                        "memory_section": {
-                            "memory_address": 140705187827712,
-                            "memory_size": 1163264,
-                            "protection": "R-X"
-                        },
-                        "module_name": "ntdll.dll",
-                        "module_path": "c:\\windows\\system32\\ntdll.dll",
-                        "symbol_info": "c:\\windows\\system32\\ntdll.dll!RtlUserThreadStart+0x21"
-                    }
-                ],
-                "call_stack_final_hook_module": {
-                    "code_signature": [
-                        {
-                            "exists": true,
-                            "status": "trusted",
-                            "subject_name": "Microsoft Corporation",
-                            "trusted": true
-                        }
-                    ],
-                    "hash": {
-                        "sha256": "e5bfc1a2967fa513177a0327770927d9a2efa5a4f33ac18f716bae7c3f857994"
-                    },
-                    "path": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\131.0.2903.112\\msedge_elf.dll"
-                },
-                "call_stack_final_user_module": {
-                    "code_signature": [
-                        {
-                            "exists": true,
-                            "status": "trusted",
-                            "subject_name": "Microsoft Windows",
-                            "trusted": true
-                        }
-                    ],
-                    "hash": {
-                        "sha256": "8c9740e7fe9c97d5782b8d3db102c7880c40f0b27f20d3ec9f334fe0161b7e55"
-                    },
-                    "name": "rpcrt4.dll",
-                    "path": "c:\\windows\\system32\\rpcrt4.dll"
-                },
-                "call_stack_summary": "ntdll.dll, rpcrt4.dll, combase.dll, rpcrt4.dll, combase.dll, fastprox.dll, alertstests.exe, kernel32.dll, ntdll.dll",
-                "hardware_breakpoint_set": true,
-                "start_address": 140699640807104,
-                "start_address_module": "C:\\Users\\vagrant\\endpoint-dev\\Build\\_WS-vs2019-x64-dbg\\AlertsTests\\Debug\\AlertsTests.exe"
-            },
-            "id": 5752
-        },
-        "uptime": 822
-    },
-    "rule": {
-        "ruleset": "production"
-    },
-    "message": "Malware Prevention Alert",
-    "@timestamp": "2022-04-04T12:15:41.5944062Z",
-    "file": {
-        "Ext": {
-            "temp_file_path": "C:\\Windows\\TEMP\\90edbe42-fe6c-4965-8a6b-222aa2b15cf2",
-            "code_signature": [
-                {
-                    "exists": false
-                }
-            ],
-            "quarantine_path": "C:\\.equarantine\\20a65f043449c96f10e538a860a415b55ff46c93",
-            "quarantine_message": "Success",
-            "quarantine_result": true,
-            "malware_classification": {
-                "identifier": "endpointpe-v4-model",
-                "score": 0.692318737506866,
-                "threshold": 0.58,
-                "version": "4.0.19000"
-            }
-        },
-        "owner": "Administrators",
-        "extension": "dll",
-        "drive_letter": "C",
-        "created": "2022-04-04T12:15:41.4606245Z",
-        "accessed": "2022-04-04T12:15:41.4606245Z",
-        "mtime": "2022-04-04T12:15:41.4606245Z",
-        "directory": "C:\\sysmon",
-        "path": "C:\\sysmon\\9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
-        "code_signature": {
-            "exists": false
-        },
-        "size": 4608,
-        "pe": {
-            "file_version": "0.0.0.0",
-            "description": " ",
-            "original_file_name": "5t5mpwxc.dll",
-            "Ext": {
-                "dotnet": true,
-                "streams": [
-                    {
-                        "name": "#~",
-                        "hash": {
-                            "md5": "debf08c09d49337fbe7acde4d3749242",
-                            "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
-                        }
-                    },
-                    {
-                        "name": "#Blob",
-                        "hash": {
-                            "md5": "debf08c09d49337fbe7acde4d3749242",
-                            "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
-                        }
-                    }
-                ],
-                "sections": [
-                    {
-                        "name": ".reloc",
-                        "hash": {
-                            "md5": "debf08c09d49337fbe7acde4d3749242",
-                            "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
-                        }
-                    }
-                ]
-            }
-        },
-        "name": "9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
-        "hash": {
-            "sha1": "9c0e42a47d34240a9a4101cc5d3bc5787dc5ad73",
-            "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53",
-            "md5": "debf08c09d49337fbe7acde4d3749242"
-        }
-    },
-    "Endpoint": {
-        "policy": {
-            "applied": {
-                "artifacts": {
-                    "global": {
-                        "identifiers": [
-                            {
-                                "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
-                                "name": "diagnostic-configuration-v1"
-                            },
-                            {
-                                "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
-                                "name": "diagnostic-endpointpe-v4-blocklist"
-                            },
-                            {
-                                "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
-                                "name": "diagnostic-endpointpe-v4-exceptionlist"
-                            },
-                            {
-                                "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
-                                "name": "diagnostic-endpointpe-v4-model"
-                            },
-                            {
-                                "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
-                                "name": "diagnostic-malware-signature-v1-windows"
-                            },
-                            {
-                                "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
-                                "name": "diagnostic-ransomware-v1-windows"
-                            },
-                            {
-                                "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
-                                "name": "diagnostic-rules-windows-v1"
-                            },
-                            {
-                                "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
-                                "name": "endpointpe-v4-blocklist"
-                            },
-                            {
-                                "sha256": "d784c2aa70a2216dd5bfeecfdd67a83ff5b656e9321bd70cf345a8667a63fb2e",
-                                "name": "endpointpe-v4-exceptionlist"
-                            },
-                            {
-                                "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
-                                "name": "endpointpe-v4-model"
-                            },
-                            {
-                                "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
-                                "name": "global-configuration-v1"
-                            },
-                            {
-                                "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
-                                "name": "global-exceptionlist-windows"
-                            },
-                            {
-                                "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
-                                "name": "global-trustlist-windows-v1"
-                            },
-                            {
-                                "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
-                                "name": "production-malware-signature-v1-windows"
-                            },
-                            {
-                                "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
-                                "name": "production-ransomware-v1-windows"
-                            },
-                            {
-                                "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
-                                "name": "production-rules-windows-v1"
-                            }
-                        ],
-                        "update_age": 0,
-                        "snapshot": "2023-09-26",
-                        "version": "1.0.260"
-                    },
-                    "user": {
-                        "identifiers": [
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-blocklist-windows-v1"
-                            },
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-eventfilterlist-windows-v1"
-                            },
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-exceptionlist-windows-v1"
-                            },
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-hostisolationexceptionlist-windows-v1"
-                            },
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-trustlist-windows-v1"
-                            }
-                        ],
-                        "version": "1.0.0"
-                    }
-                }
-            }
-        }
-    },
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "logs",
-        "dataset": "endpoint.alerts"
-    },
-    "elastic": {
-        "agent": {
-            "id": "2b1eb7f7-bd61-436a-98af-c2b182043476"
-        }
-    },
-    "host": {
-        "hostname": "security-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.34",
-            "fe80::4850:4f4f:4b53:8103",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "security-win-1",
-        "id": "bbea673e-eae6-4b03-8724-2183f79da331",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "severity": 73,
-        "code": "malicious_file",
-        "risk_score": 73,
-        "created": "2022-04-04T12:15:41.5944062Z",
-        "kind": "alert",
-        "module": "endpoint",
-        "type": [
-            "info",
-            "change",
-            "denied"
-        ],
-        "agent_id_status": "verified",
-        "sequence": 29414,
-        "ingested": "2022-04-04T12:19:33Z",
-        "action": "rename",
-        "id": "MYfSjQEEEFe1o09b+++++D5Q",
-        "category": [
-            "malware",
-            "intrusion_detection",
-            "file"
-        ],
-        "dataset": "endpoint.alerts",
-        "outcome": "success"
-    },
-    "user": {
-        "domain": "NT AUTHORITY",
-        "name": "SYSTEM"
-    },
-    "Memory_protection": {
-        "cross_session": false,
-        "feature": "shellcode_thread",
-        "parent_to_child": false,
-        "self_injection": false,
-        "unique_key_v2": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
-    },
-    "Responses": [
-        {
-            "@timestamp": "2023-04-13T16:15:16.0Z",
-            "action": {
-                "action": "file_rollback",
-                "file": {
-                    "attributes": [
-                        "invalid"
-                    ],
-                    "path": "",
-                    "reason": 2147484160
-                },
-                "source": {
-                    "attributes": [
-                        "archive"
-                    ],
-                    "path": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy55\\git\\endpoint-dev\\Python\\runtime\\failed_test_logs\\20230413_181248\\EndpointRollbackTestCase\\test_rollback_trigger_malware_1_prevent\\tmp\\TRA14KA5Z2\\ExceptionlistTester-Windows.1d1phoq97d"
-                }
-            },
-            "message": "Successful production rollback",
-            "result": 0
-        },
-        {
-            "@timestamp": "2023-04-13T16:15:16.0Z",
-            "action": {
-                "action": "registry_rollback",
-                "key": {
-                    "actions": [
-                        "Deleted"
-                    ],
-                    "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback\\1"
-                }
-            },
-            "message": "Successful production registry rollback",
-            "result": 0
-        },
-        {
-            "@timestamp": "2023-04-13T16:15:16.0Z",
-            "action": {
-                "action": "registry_rollback",
-                "key": {
-                    "actions": [
-                        "Modified"
-                    ],
-                    "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback.valuetest",
-                    "values": [
-                        {
-                            "actions": [
-                                "Deleted"
-                            ],
-                            "name": "SomeValue"
-                        }
-                    ]
-                }
-            }
-        },
-        {
-            "@timestamp": "2023-07-19T14:21:05.0Z",
-            "action": {
-                "action": "process_rollback",
-                "process": {
-                    "path": "C:\\Users\\Pawel Mirski\\AppData\\Local\\Programs\\Python\\Python38-32\\python.exe"
-                }
-            },
-            "message": "Successful production process rollback",
-            "result": 0
-        }
-    ]
-}
-```
-</details>
-
-### [Fields](alerts.md)
-- [@timestamp](alerts.md#@timestamp)
-- [Events](alerts.md#Events)
-- [message](alerts.md#message)
-- [Endpoint](alerts.md#Endpoint)
-- [Memory_protection](alerts.md#Memory_protection)
-- [Ransomware](alerts.md#Ransomware)
-- [Responses](alerts.md#Responses)
-- [Target](alerts.md#Target)
-- [agent](alerts.md#agent)
-- [cloud](alerts.md#cloud)
-- [container](alerts.md#container)
-- [data_stream](alerts.md#data_stream)
-- [destination](alerts.md#destination)
-- [dll](alerts.md#dll)
-- [dns](alerts.md#dns)
-- [ecs](alerts.md#ecs)
-- [elastic](alerts.md#elastic)
-- [event](alerts.md#event)
-- [file](alerts.md#file)
-- [group](alerts.md#group)
-- [host](alerts.md#host)
-- [orchestrator](alerts.md#orchestrator)
-- [process](alerts.md#process)
-- [registry](alerts.md#registry)
-- [rule](alerts.md#rule)
-- [source](alerts.md#source)
-- [threat](alerts.md#threat)
-- [user](alerts.md#user)
-# policy
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "agent": {
-        "build": {
-            "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-        },
-        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "message": "Endpoint policy change",
-    "@timestamp": "2022-04-04T18:38:15.7178887Z",
-    "Endpoint": {
-        "configuration": {
-            "isolation": false
-        },
-        "state": {
-            "isolation": false
-        },
-        "policy": {
-            "applied": {
-                "response": {
-                    "configurations": {
-                        "behavior_protection": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "load_config",
-                                "workflow",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "configure_file_events",
-                                "configure_network_events",
-                                "configure_process_events",
-                                "configure_kernel",
-                                "connect_kernel",
-                                "configure_imageload_events",
-                                "configure_dns_events",
-                                "configure_security_events",
-                                "configure_registry_events",
-                                "configure_malicious_behavior"
-                            ],
-                            "status": "success"
-                        },
-                        "streaming": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "load_config",
-                                "configure_output",
-                                "workflow"
-                            ],
-                            "status": "success"
-                        },
-                        "malware": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "load_config",
-                                "workflow",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "configure_malware",
-                                "configure_kernel",
-                                "detect_process_events",
-                                "detect_file_write_events",
-                                "connect_kernel",
-                                "configure_user_notification",
-                                "configure_alerts",
-                                "detect_file_open_events",
-                                "detect_sync_image_load_events"
-                            ],
-                            "status": "success"
-                        },
-                        "logging": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "load_config",
-                                "configure_logging",
-                                "workflow"
-                            ],
-                            "status": "success"
-                        },
-                        "antivirus_registration": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "load_config",
-                                "configure_antivirus_registration",
-                                "workflow"
-                            ],
-                            "status": "unsupported"
-                        },
-                        "host_isolation": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "configure_host_isolation",
-                                "load_config",
-                                "workflow",
-                                "connect_kernel",
-                                "configure_user_notification"
-                            ],
-                            "status": "success"
-                        },
-                        "events": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "load_config",
-                                "workflow",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "detect_process_events",
-                                "detect_file_write_events",
-                                "detect_network_events",
-                                "configure_file_events",
-                                "configure_network_events",
-                                "configure_process_events",
-                                "configure_kernel",
-                                "connect_kernel",
-                                "detect_file_open_events",
-                                "detect_file_access_events",
-                                "detect_async_image_load_events",
-                                "detect_registry_events",
-                                "detect_registry_access_events",
-                                "configure_imageload_events",
-                                "configure_dns_events",
-                                "configure_security_events",
-                                "configure_registry_events"
-                            ],
-                            "status": "success"
-                        },
-                        "ransomware": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "load_config",
-                                "workflow",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "detect_process_events",
-                                "detect_file_write_events",
-                                "configure_process_events",
-                                "configure_file_events",
-                                "configure_ransomware",
-                                "configure_kernel",
-                                "connect_kernel",
-                                "configure_user_notification"
-                            ],
-                            "status": "success"
-                        },
-                        "memory_protection": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "configure_memory_threat",
-                                "configure_process_events",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "workflow",
-                                "load_config",
-                                "detect_process_events",
-                                "configure_kernel",
-                                "connect_kernel",
-                                "detect_thread_events"
-                            ],
-                            "status": "success"
-                        },
-                        "attack_surface_reduction": {
-                            "concerned_actions": [
-                                "agent_connectivity",
-                                "configure_credential_hardening",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "workflow",
-                                "load_config",
-                                "configure_kernel",
-                                "connect_kernel"
-                            ],
-                            "status": "success"
-                        }
-                    },
-                    "diagnostic": {
-                        "behavior_protection": {
-                            "concerned_actions": [
-                                "load_config",
-                                "workflow",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "configure_file_events",
-                                "configure_network_events",
-                                "configure_process_events",
-                                "configure_kernel",
-                                "connect_kernel",
-                                "configure_imageload_events",
-                                "configure_dns_events",
-                                "configure_security_events",
-                                "configure_registry_events",
-                                "configure_diagnostic_rollback",
-                                "detect_process_handle_events",
-                                "configure_diagnostic_malicious_behavior"
-                            ],
-                            "status": "success"
-                        },
-                        "malware": {
-                            "concerned_actions": [
-                                "load_config",
-                                "workflow",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "configure_diagnostic_malware",
-                                "detect_process_events",
-                                "detect_file_write_events",
-                                "connect_kernel",
-                                "configure_kernel",
-                                "detect_file_open_events",
-                                "detect_sync_image_load_events",
-                                "configure_diagnostic_rollback"
-                            ],
-                            "status": "success"
-                        },
-                        "ransomware": {
-                            "concerned_actions": [
-                                "load_config",
-                                "workflow",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "detect_process_events",
-                                "detect_file_write_events",
-                                "configure_process_events",
-                                "configure_file_events",
-                                "configure_diagnostic_ransomware",
-                                "configure_kernel",
-                                "connect_kernel",
-                                "configure_diagnostic_rollback"
-                            ],
-                            "status": "success"
-                        },
-                        "memory_protection": {
-                            "concerned_actions": [
-                                "load_config",
-                                "workflow",
-                                "download_global_artifacts",
-                                "download_user_artifacts",
-                                "detect_process_events",
-                                "configure_process_events",
-                                "configure_diagnostic_memory_threat",
-                                "configure_kernel",
-                                "connect_kernel",
-                                "detect_thread_events",
-                                "configure_diagnostic_rollback"
-                            ],
-                            "status": "success"
-                        }
-                    }
-                },
-                "name": "endpoint-1",
-                "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
-                "actions": [
-                    {
-                        "name": "configure_antivirus_registration",
-                        "message": "Antivirus registration is not possible on servers",
-                        "status": "unsupported"
-                    },
-                    {
-                        "name": "configure_ransomware",
-                        "message": "Successfully enabled ransomware prevention with mbr enabled and canaries enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_memory_threat",
-                        "message": "Successfully enabled memory threat prevention with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_diagnostic_memory_threat",
-                        "message": "Successfully enabled memory threat detection with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_host_isolation",
-                        "message": "Host is not isolated",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_malicious_behavior",
-                        "message": "Enabled 152 out of 152 malicious behavior rules",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_diagnostic_malicious_behavior",
-                        "message": "Enabled 196 out of 196 diagnostic malicious behavior rules",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_user_notification",
-                        "message": "Successfully configured user notification",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_malware",
-                        "message": "Successfully enabled malware prevention",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_diagnostic_malware",
-                        "message": "Successfully enabled malware detection",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_diagnostic_rollback",
-                        "message": "Diagnostic system rollback is enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_kernel",
-                        "message": "Successfully configured kernel",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_output",
-                        "message": "Successfully configured output connection",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_alerts",
-                        "message": "Successfully configured alerts",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_logging",
-                        "message": "Successfully configured logging",
-                        "status": "success"
-                    },
-                    {
-                        "name": "load_config",
-                        "message": "Successfully parsed configuration",
-                        "status": "success"
-                    },
-                    {
-                        "name": "download_user_artifacts",
-                        "message": "Successfully downloaded user artifacts",
-                        "status": "success"
-                    },
-                    {
-                        "name": "download_global_artifacts",
-                        "message": "Global artifacts are available for use",
-                        "status": "success"
-                    },
-                    {
-                        "name": "connect_kernel",
-                        "message": "Successfully connected to kernel",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_process_events",
-                        "message": "Successfully started process event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_sync_image_load_events",
-                        "message": "Successfully started sync image load event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_async_image_load_events",
-                        "message": "Successfully started async image load event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_file_write_events",
-                        "message": "Successfully started file write event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_file_open_events",
-                        "message": "Successfully stopped file open event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_network_events",
-                        "message": "Successfully started network event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_registry_events",
-                        "message": "Successfully started registry event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_thread_events",
-                        "message": "Successfully configured thread events",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_file_access_events",
-                        "message": "Successfully configured file access event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_registry_access_events",
-                        "message": "Successfully configured registry access event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "detect_process_handle_events",
-                        "message": "Successfully started process handle event reporting",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_file_events",
-                        "message": "Success enabling file events; current state is enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_network_events",
-                        "message": "Success enabling network events; current state is enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_process_events",
-                        "message": "Success enabling process events; current state is enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_imageload_events",
-                        "message": "Success enabling image load events; current state is enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_dns_events",
-                        "message": "Success enabling dns events; current state is enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_registry_events",
-                        "message": "Success enabling registry events; current state is enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_security_events",
-                        "message": "Success enabling security events; current state is enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_diagnostic_ransomware",
-                        "message": "Successfully enabled ransomware detection with mbr enabled and canaries enabled",
-                        "status": "success"
-                    },
-                    {
-                        "name": "agent_connectivity",
-                        "message": "Successfully connected to Agent",
-                        "status": "success"
-                    },
-                    {
-                        "name": "workflow",
-                        "message": "Successfully executed all workflows",
-                        "status": "success"
-                    },
-                    {
-                        "name": "configure_credential_hardening",
-                        "message": "Successfully configured credential hardening",
-                        "status": "success"
-                    }
-                ],
-                "endpoint_policy_version": "1",
-                "version": "2",
-                "artifacts": {
-                    "global": {
-                        "channel": "stable",
-                        "identifiers": [
-                            {
-                                "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
-                                "name": "diagnostic-configuration-v1"
-                            },
-                            {
-                                "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
-                                "name": "diagnostic-endpointpe-v4-blocklist"
-                            },
-                            {
-                                "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
-                                "name": "diagnostic-endpointpe-v4-exceptionlist"
-                            },
-                            {
-                                "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
-                                "name": "diagnostic-endpointpe-v4-model"
-                            },
-                            {
-                                "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
-                                "name": "diagnostic-malware-signature-v1-windows"
-                            },
-                            {
-                                "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
-                                "name": "diagnostic-ransomware-v1-windows"
-                            },
-                            {
-                                "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
-                                "name": "diagnostic-rules-windows-v1"
-                            },
-                            {
-                                "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
-                                "name": "endpointpe-v4-blocklist"
-                            },
-                            {
-                                "sha256": "b49fdcd8bf63af07ab1e74352137eb20f1e3710640dfcb1bfff3f7273ee14a7f",
-                                "name": "endpointpe-v4-exceptionlist"
-                            },
-                            {
-                                "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
-                                "name": "endpointpe-v4-model"
-                            },
-                            {
-                                "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
-                                "name": "global-configuration-v1"
-                            },
-                            {
-                                "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
-                                "name": "global-exceptionlist-windows"
-                            },
-                            {
-                                "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
-                                "name": "global-trustlist-windows-v1"
-                            },
-                            {
-                                "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
-                                "name": "production-malware-signature-v1-windows"
-                            },
-                            {
-                                "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
-                                "name": "production-ransomware-v1-windows"
-                            },
-                            {
-                                "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
-                                "name": "production-rules-windows-v1"
-                            }
-                        ],
-                        "update_age": 0,
-                        "snapshot": "2023-09-26",
-                        "version": "1.0.261"
-                    },
-                    "user": {
-                        "identifiers": [
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-blocklist-windows-v1"
-                            },
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-eventfilterlist-windows-v1"
-                            },
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-exceptionlist-windows-v1"
-                            },
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-hostisolationexceptionlist-windows-v1"
-                            },
-                            {
-                                "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                "name": "endpoint-trustlist-windows-v1"
-                            }
-                        ],
-                        "version": "1.0.0"
-                    }
-                },
-                "status": "success"
-            }
-        }
-    },
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "metrics",
-        "dataset": "endpoint.policy"
-    },
-    "host": {
-        "hostname": "data-viz-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.13",
-            "fe80::f40a:aed0:618a:972d",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "data-viz-win-1",
-        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "sequence": 35122,
-        "ingested": "2022-04-04T18:38:16Z",
-        "created": "2022-04-04T18:38:15.7178887Z",
-        "kind": "state",
-        "module": "endpoint",
-        "action": "endpoint_policy_response",
-        "id": "MYfZG00oEwD2/fqT+++++Bye",
-        "category": [
-            "host"
-        ],
-        "type": [
-            "change"
-        ],
-        "dataset": "endpoint.policy"
-    }
-}
-```
-</details>
-
-### [Fields](policy.md)
-- [@timestamp](policy.md#@timestamp)
-- [message](policy.md#message)
-- [Endpoint](policy.md#Endpoint)
-- [agent](policy.md#agent)
-- [data_stream](policy.md#data_stream)
-- [ecs](policy.md#ecs)
-- [event](policy.md#event)
-- [host](policy.md#host)
-# registry
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "registry": {
-        "hive": "HKLM",
-        "path": "HKLM\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
-        "data": {
-            "strings": [],
-            "type": "REG_NONE"
-        },
-        "value": "Enabled",
-        "key": "SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
-    },
-    "agent": {
-        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "Effective_process": {
-        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
-        "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
-        "name": "WMIC.exe",
-        "pid": 2732
-    },
-    "process": {
-        "Ext": {
-            "ancestry": [
-                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-            ],
-            "code_signature": [
-                {
-                    "trusted": true,
-                    "subject_name": "Microsoft Windows Publisher",
-                    "exists": true,
-                    "status": "trusted"
-                }
-            ]
-        },
-        "code_signature": {
-            "trusted": true,
-            "subject_name": "Microsoft Windows Publisher",
-            "exists": true,
-            "status": "trusted"
-        },
-        "name": "svchost.exe",
-        "pid": 2772,
-        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
-        "executable": "C:\\Windows\\System32\\svchost.exe",
-        "thread": {
-            "id": 340,
-            "Ext": {
-                "call_stack": [
-                    {
-                        "allocation_private_bytes": 16384,
-                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                        "protection": "RWX",
-                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                    }
-                ],
-                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                "hardware_breakpoint_set": true
-            }
-        }
-    },
-    "message": "Endpoint registry event",
-    "@timestamp": "2022-04-04T18:53:09.1283846Z",
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "logs",
-        "dataset": "endpoint.events.registry"
-    },
-    "host": {
-        "hostname": "data-viz-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.13",
-            "fe80::f40a:aed0:618a:972d",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "data-viz-win-1",
-        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "sequence": 36271,
-        "ingested": "2022-04-04T18:53:18Z",
-        "created": "2022-04-04T18:53:09.1283846Z",
-        "kind": "event",
-        "module": "endpoint",
-        "action": "query",
-        "id": "MYfZG00oEwD2/fqT+++++CMy",
-        "category": [
-            "registry"
-        ],
-        "type": [
-            "access"
-        ],
-        "dataset": "endpoint.events.registry"
-    },
-    "user": {
-        "domain": "NT AUTHORITY",
-        "name": "SYSTEM",
-        "id": "S-1-5-18"
-    }
-}
-```
-</details>
-
-### [Fields](registry.md)
-- [@timestamp](registry.md#@timestamp)
-- [message](registry.md#message)
-- [Effective_process](registry.md#Effective_process)
-- [agent](registry.md#agent)
-- [data_stream](registry.md#data_stream)
-- [destination](registry.md#destination)
-- [ecs](registry.md#ecs)
-- [event](registry.md#event)
-- [group](registry.md#group)
-- [host](registry.md#host)
-- [process](registry.md#process)
-- [registry](registry.md#registry)
-- [source](registry.md#source)
-- [user](registry.md#user)
-# process
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "agent": {
-        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "container": {
-        "id": "8d38b2f18290e973c5ea8f9ee207e970a8aa9191fa89bf3d4ea2a126f2f010a6",
-        "image": {
-            "name": "gke.gcr.io/csi-node-driver-registrar:v2.5.0-gke.1",
-            "tag": [
-                "v2.5.0-gke.1"
-            ],
-            "hash": {
-                "all": [
-                    "sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d"
-                ]
-            }
-        },
-        "name": "csi-driver-registrar"
-    },
-    "cloud": {
-        "account": {
-            "id": "1234"
-        },
-        "instance": {
-            "name": "webserver-12"
-        },
-        "project": {
-            "id": "1234"
-        },
-        "provider": "aws",
-        "region": "us-east-1"
-    },
-    "orchestrator": {
-        "cluster": {
-            "id": "f0cd61d5-327b-43e0-bc94-d9ea922fb4b5",
-            "name": "webservers"
-        },
-        "namespace": "webapp",
-        "resource": {
-            "ip": [
-                "10.1.237.155"
-            ],
-            "name": "pdcsi-node-6zh4j",
-            "type": "pod",
-            "parent": {
-                "type": "DaemonSet"
-            }
-        }
-    },
-    "process": {
-        "entry_leader": {
-            "attested_user": {
-                "id": "123",
-                "name": "userA"
-            },
-            "attested_groups": {
-                "name": "groupA"
-            }
-        },
-        "Ext": {
-            "ancestry": [
-                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-            ],
-            "memfd": {
-                "flag_hugetlb": false,
-                "flag_allow_seal": true,
-                "flags": 2,
-                "name": "test_memfd",
-                "flag_exec": false,
-                "flag_cloexec": false,
-                "flag_noexec_seal": false
-            },
-            "code_signature": [
-                {
-                    "trusted": true,
-                    "subject_name": "Microsoft Windows Publisher",
-                    "exists": true,
-                    "status": "trusted"
-                }
-            ],
-            "created_suspended": true,
-            "mitigation_policies": [
-                "Microsoft only, Opt-in to restrict to Microsoft, Windows Store and WHQL",
-                "CET dynamic APIs can only be called out of proc",
-                "CF Guard"
-            ],
-            "protection": "PsProtectedSignerAntimalware-Light",
-            "device": {
-                "volume_device_type": "Disk File System"
-            },
-            "authentication_id": "0x3e7",
-            "token": {
-                "integrity_level_name": "system",
-                "security_attributes": [
-                    "TSA://ProcUnique"
-                ],
-                "elevation_level": "default"
-            },
-            "effective_parent": {
-                "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
-                "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
-                "name": "WMIC.exe",
-                "pid": 2732
-            },
-            "relative_file_creation_time": 48628704.4029488,
-            "relative_file_name_modify_time": 48628704.4029488,
-            "session_info": {
-                "logon_type": "Interactive",
-                "client_address": "127.0.0.1",
-                "id": 1,
-                "authentication_package": "NTLM",
-                "relative_logon_time": 0.1,
-                "relative_password_age": 2592000.123,
-                "user_flags": [
-                    "LOGON_EXTRA_SIDS",
-                    "LOGON_NTLMV2_ENABLED",
-                    "LOGON_WINLOGON"
-                ]
-            }
-        },
-        "parent": {
-            "args": [],
-            "name": "services.exe",
-            "pid": 600,
-            "args_count": 0,
-            "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-            "command_line": "",
-            "executable": "C:\\Windows\\System32\\services.exe",
-            "thread": {
-                "Ext": {
-                    "call_stack": [
-                        {
-                            "allocation_private_bytes": 16384,
-                            "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                            "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                            "protection": "RWX",
-                            "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                        }
-                    ],
-                    "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                    "call_stack_contains_unbacked": true,
-                    "hardware_breakpoint_set": true
-                }
-            }
-        },
-        "pid": 2772,
-        "working_directory": "C:\\Windows\\system32\\",
-        "end": "2022-07-18T21:05:19.9419692Z",
-        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
-        "executable": "C:\\Windows\\System32\\svchost.exe",
-        "args": [
-            "C:\\Windows\\System32\\svchost.exe",
-            "-k",
-            "WerSvcGroup"
-        ],
-        "code_signature": {
-            "trusted": true,
-            "subject_name": "Microsoft Windows Publisher",
-            "exists": true,
-            "status": "trusted"
-        },
-        "pe": {
-            "original_file_name": "svchost.exe"
-        },
-        "name": "svchost.exe",
-        "args_count": 3,
-        "command_line": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
-        "hash": {
-            "sha1": "4fbfc6004084d97032837c21d3f426892d868eac",
-            "sha256": "cb19fd67b1d028e01f54c426a0924528c4a8d8ed8996cfe0ee0c6e45285436a1",
-            "md5": "1b280ad032268a636ecfe6f9165431b7"
-        },
-        "tty": {
-            "char_device": {
-                "major": 4,
-                "minor": 1
-            },
-            "rows": 24,
-            "columns": 80
-        },
-        "io": {
-            "text": "helloworld",
-            "total_bytes_captured": 10,
-            "total_bytes_skipped": 0,
-            "max_bytes_per_process_exceeded": false
-        },
-        "env_vars": [
-            "NICK=test",
-            "OTHER=why"
-        ]
-    },
-    "message": "Endpoint process event",
-    "@timestamp": "2022-04-04T18:53:08.6578986Z",
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "logs",
-        "dataset": "endpoint.events.process"
-    },
-    "host": {
-        "hostname": "data-viz-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.13",
-            "fe80::f40a:aed0:618a:972d",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "data-viz-win-1",
-        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "sequence": 36236,
-        "ingested": "2022-04-04T18:53:18Z",
-        "created": "2022-04-04T18:53:08.6578986Z",
-        "kind": "event",
-        "module": "endpoint",
-        "action": "start",
-        "id": "MYfZG00oEwD2/fqT+++++CLz",
-        "category": [
-            "process"
-        ],
-        "type": [
-            "start"
-        ],
-        "dataset": "endpoint.events.process"
-    },
-    "user": {
-        "domain": "NT AUTHORITY",
-        "name": "SYSTEM",
-        "id": "S-1-5-18"
-    }
-}
-```
-</details>
-
-### [Fields](process.md)
-- [@timestamp](process.md#@timestamp)
-- [message](process.md#message)
-- [agent](process.md#agent)
-- [cloud](process.md#cloud)
-- [container](process.md#container)
-- [data_stream](process.md#data_stream)
-- [destination](process.md#destination)
-- [ecs](process.md#ecs)
-- [event](process.md#event)
-- [group](process.md#group)
-- [host](process.md#host)
-- [orchestrator](process.md#orchestrator)
-- [package](process.md#package)
-- [process](process.md#process)
-- [source](process.md#source)
-- [user](process.md#user)
-# security
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "Target": {
-        "process": {
-            "Ext": {
-                "authentication_id": "0x3e7"
-            }
-        }
-    },
-    "agent": {
-        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "file": {
-        "path": "/User/admin/Downloads/application",
-        "code_signature": {
-            "signing_id": "com.developer.identifier",
-            "team_id": "XYZABC"
-        }
-    },
-    "process": {
-        "Ext": {
-            "ancestry": [
-                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-            ],
-            "authentication_id": "0x3e7",
-            "code_signature": [
-                {
-                    "trusted": true,
-                    "subject_name": "Microsoft Windows Publisher",
-                    "exists": true,
-                    "status": "trusted"
-                }
-            ]
-        },
-        "code_signature": {
-            "trusted": true,
-            "subject_name": "Microsoft Windows Publisher",
-            "exists": true,
-            "status": "trusted"
-        },
-        "name": "C:\\Windows\\System32\\services.exe",
-        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-        "executable": "C:\\Windows\\System32\\services.exe"
-    },
-    "message": "Endpoint security event",
-    "@timestamp": "2022-04-04T18:53:08.6510289Z",
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "logs",
-        "dataset": "endpoint.events.security"
-    },
-    "host": {
-        "hostname": "data-viz-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.13",
-            "fe80::f40a:aed0:618a:972d",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "data-viz-win-1",
-        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "sequence": 36385,
-        "ingested": "2022-04-04T18:53:18Z",
-        "created": "2022-04-04T18:53:08.6510289Z",
-        "kind": "event",
-        "module": "endpoint",
-        "action": "log_on",
-        "id": "MYfZG00oEwD2/fqT+++++CQ/",
-        "category": [
-            "authentication",
-            "session"
-        ],
-        "type": [
-            "start"
-        ],
-        "dataset": "endpoint.events.security",
-        "outcome": "success"
-    },
-    "user": {
-        "domain": "DESKTOP-1TK590J",
-        "effective": {
-            "domain": "DESKTOP-1TK590J",
-            "name": "EafTestLogon80589",
-            "id": "S-1-5-18",
-            "email": "EafTestLogon80589@DESKTOP-1TK590J.local",
-            "full_name": "EafTestLogon80589",
-            "hash": "f1297b0233914ec6ebf8fc01195e8712dfd8322f5e8d9d8bbe0083a0fc1860fd"
-        },
-        "id": "S-1-5-21-1749029863-1064264096-968553628-1001",
-        "name": "Default"
-    },
-    "winlog": {
-        "event_data": {
-            "PrivilegeList": [
-                "SeSecurityPrivilege",
-                "SeTakeOwnershipPrivilege",
-                "SeLoadDriverPrivilege",
-                "SeBackupPrivilege",
-                "SeRestorePrivilege",
-                "SeDebugPrivilege",
-                "SeSystemEnvironmentPrivilege",
-                "SeImpersonatePrivilege",
-                "SeDelegateSessionUserImpersonatePrivilege"
-            ]
-        }
-    }
-}
-```
-</details>
-
-### [Fields](security.md)
-- [@timestamp](security.md#@timestamp)
-- [message](security.md#message)
-- [Target](security.md#Target)
-- [agent](security.md#agent)
-- [data_stream](security.md#data_stream)
-- [destination](security.md#destination)
-- [ecs](security.md#ecs)
-- [event](security.md#event)
-- [file](security.md#file)
-- [group](security.md#group)
-- [host](security.md#host)
-- [process](security.md#process)
-- [source](security.md#source)
-- [user](security.md#user)
-- [winlog](security.md#winlog)
-# metadata
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "agent": {
-        "build": {
-            "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-        },
-        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "@timestamp": "2022-04-04T12:33:36.6664577Z",
-    "Endpoint": {
-        "capabilities": [
-            "isolation"
-        ],
-        "configuration": {
-            "isolation": false
-        },
-        "state": {
-            "isolation": false
-        },
-        "policy": {
-            "applied": {
-                "name": "endpoint-1",
-                "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
-                "status": "success"
-            }
-        },
-        "status": "enrolled"
-    },
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "metrics",
-        "dataset": "endpoint.metadata"
-    },
-    "elastic": {
-        "agent": {
-            "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21"
-        }
-    },
-    "host": {
-        "hostname": "data-viz-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.13",
-            "fe80::f40a:aed0:618a:972d",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "data-viz-win-1",
-        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "sequence": 5054,
-        "ingested": "2022-04-04T12:33:37Z",
-        "created": "2022-04-04T12:33:36.6664577Z",
-        "kind": "metric",
-        "module": "endpoint",
-        "action": "endpoint_metadata",
-        "id": "MYfZG00oEwD2/fqT+++++/SC",
-        "category": [
-            "host"
-        ],
-        "type": [
-            "info"
-        ],
-        "dataset": "endpoint.metadata"
-    }
-}
-```
-</details>
-
-### [Fields](metadata.md)
-- [@timestamp](metadata.md#@timestamp)
-- [Endpoint](metadata.md#Endpoint)
-- [agent](metadata.md#agent)
-- [data_stream](metadata.md#data_stream)
-- [ecs](metadata.md#ecs)
-- [elastic](metadata.md#elastic)
-- [event](metadata.md#event)
-- [host](metadata.md#host)
-# action_responses
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "EndpointActions": {
-        "completed_at": "2022-04-04T20:44:14.0Z",
-        "data": {
-            "comment": "Action completed successfully",
-            "command": "isolate"
-        },
-        "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
-        "started_at": "2022-04-04T20:44:08.0Z"
-    },
-    "agent": {
-        "id": "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
-    },
-    "@timestamp": "2022-04-04T20:44:14.0Z",
-    "data_stream": {
-        "namespace": "default",
-        "type": ".logs",
-        "dataset": "endpoint.action.responses"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "ingested": "2022-04-04T20:44:45Z"
-    }
-}
-```
-</details>
-
-### [Fields](action_responses.md)
-- [@timestamp](action_responses.md#@timestamp)
-- [action_id](action_responses.md#action_id)
-- [agent_id](action_responses.md#agent_id)
-- [completed_at](action_responses.md#completed_at)
-- [data.alert_id](action_responses.md#data.alert_id)
-- [data.command](action_responses.md#data.command)
-- [data.comment](action_responses.md#data.comment)
-- [started_at](action_responses.md#started_at)
-- [status](action_responses.md#status)
-- [EndpointActions](action_responses.md#EndpointActions)
-- [agent](action_responses.md#agent)
-- [data_stream](action_responses.md#data_stream)
-- [ecs](action_responses.md#ecs)
-- [error](action_responses.md#error)
-- [event](action_responses.md#event)
-# collection
-### [Fields](collection.md)
-- [@timestamp](collection.md#@timestamp)
-- [data_stream](collection.md#data_stream)
-- [ecs](collection.md#ecs)
-- [event](collection.md#event)
-# library
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "agent": {
-        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "process": {
-        "Ext": {
-            "ancestry": [
-                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-            ],
-            "code_signature": [
-                {
-                    "trusted": true,
-                    "subject_name": "Microsoft Windows",
-                    "exists": true,
-                    "status": "trusted"
-                }
-            ],
-            "protection": "PsProtectedSignerAntimalware-Light"
-        },
-        "code_signature": {
-            "trusted": true,
-            "subject_name": "Microsoft Windows",
-            "exists": true,
-            "status": "trusted"
-        },
-        "name": "VSSVC.exe",
-        "pid": 4528,
-        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ1MjgtMTMyOTM1NzEwODYuNjI4MzM0NzAw",
-        "executable": "C:\\Windows\\System32\\VSSVC.exe",
-        "thread": {
-            "id": 340,
-            "Ext": {
-                "call_stack": [
-                    {
-                        "allocation_private_bytes": 16384,
-                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                        "protection": "RWX",
-                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                    }
-                ],
-                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                "hardware_breakpoint_set": true
-            }
-        }
-    },
-    "dll": {
-        "Ext": {
-            "code_signature": [
-                {
-                    "trusted": true,
-                    "subject_name": "Microsoft Windows",
-                    "exists": true,
-                    "status": "trusted"
-                }
-            ],
-            "device": {
-                "volume_device_type": "Disk File System"
-            },
-            "load_index": 1,
-            "relative_file_creation_time": 48628704.4029488,
-            "relative_file_name_modify_time": 48628704.4029488,
-            "size": 65536
-        },
-        "path": "C:\\Windows\\System32\\msxml3.dll",
-        "code_signature": {
-            "trusted": true,
-            "subject_name": "Microsoft Windows",
-            "exists": true,
-            "status": "trusted"
-        },
-        "pe": {
-            "file_version": "8.110.17763.1911",
-            "imphash": "2e1d1e35c17be5497d2de33f06dc41b4",
-            "original_file_name": "MSXML3.dll"
-        },
-        "name": "msxml3.dll",
-        "hash": {
-            "sha1": "02488fb2dbf679a3282338178b451da635b79b54",
-            "sha256": "a9698adcf789d9e30f37dd5e6c9be0441bc37662ba7402e85071ccec2135d36c",
-            "md5": "65e4fd0564411bb60c600fae12cde2f9"
-        }
-    },
-    "message": "Endpoint DLL load event",
-    "@timestamp": "2022-04-04T18:38:08.3185831Z",
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "logs",
-        "dataset": "endpoint.events.library"
-    },
-    "host": {
-        "hostname": "data-viz-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.13",
-            "fe80::f40a:aed0:618a:972d",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "data-viz-win-1",
-        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "sequence": 34339,
-        "ingested": "2022-04-04T18:38:16Z",
-        "created": "2022-04-04T18:38:08.3185831Z",
-        "kind": "event",
-        "module": "endpoint",
-        "action": "load",
-        "id": "MYfZG00oEwD2/fqT+++++BRi",
-        "category": [
-            "library"
-        ],
-        "type": [
-            "start"
-        ],
-        "dataset": "endpoint.events.library"
-    },
-    "user": {
-        "domain": "NT AUTHORITY",
-        "name": "SYSTEM",
-        "id": "S-1-5-18"
-    },
-    "Effective_process": {
-        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTU2NS0xNjk1MTkyOTQ3",
-        "executable": "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
-        "name": "Terminal",
-        "pid": 565
-    }
-}
-```
-</details>
-
-### [Fields](library.md)
-- [@timestamp](library.md#@timestamp)
-- [message](library.md#message)
-- [Effective_process](library.md#Effective_process)
-- [agent](library.md#agent)
-- [data_stream](library.md#data_stream)
-- [destination](library.md#destination)
-- [dll](library.md#dll)
-- [ecs](library.md#ecs)
-- [event](library.md#event)
-- [file](library.md#file)
-- [group](library.md#group)
-- [host](library.md#host)
-- [process](library.md#process)
-- [source](library.md#source)
-- [user](library.md#user)
-# heartbeat
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "@timestamp": "2023-07-18T20:40:09.279939Z",
-    "agent": {
-        "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-    },
-    "data_stream": {
-        "dataset": "endpoint.heartbeat",
-        "namespace": "default",
-        "type": ".logs"
-    },
-    "message": "Endpoint heartbeat",
-    "event": {
-        "ingested": "2023-07-18T20:40:09.279939Z"
-    },
-    "billable": true
-}
-```
-</details>
-
-### [Fields](heartbeat.md)
-- [@timestamp](heartbeat.md#@timestamp)
-- [billable](heartbeat.md#billable)
-- [message](heartbeat.md#message)
-- [agent](heartbeat.md#agent)
-- [data_stream](heartbeat.md#data_stream)
-- [event](heartbeat.md#event)
-# actions
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "EndpointActions": {
-        "data": {
-            "comment": "testing isolation",
-            "command": "isolate"
-        },
-        "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
-        "input_type": "endpoint",
-        "expiration": "2022-04-18T20:44:07.805Z",
-        "type": "INPUT_ACTION"
-    },
-    "agent": {
-        "id": [
-            "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
-        ]
-    },
-    "@timestamp": "2022-04-04T20:44:07.805Z",
-    "event": {
-        "agent_id_status": "auth_metadata_missing",
-        "ingested": "2022-04-04T20:44:07Z"
-    },
-    "user": {
-        "id": "user@elastic.co"
-    }
-}
-```
-</details>
-
-### [Fields](actions.md)
-- [@timestamp](actions.md#@timestamp)
-- [action_id](actions.md#action_id)
-- [agents](actions.md#agents)
-- [data.alert_id](actions.md#data.alert_id)
-- [data.command](actions.md#data.command)
-- [data.comment](actions.md#data.comment)
-- [expiration](actions.md#expiration)
-- [input_type](actions.md#input_type)
-- [type](actions.md#type)
-- [user_id](actions.md#user_id)
-- [EndpointActions](actions.md#EndpointActions)
-- [agent](actions.md#agent)
-- [data_stream](actions.md#data_stream)
-- [ecs](actions.md#ecs)
-- [error](actions.md#error)
-- [event](actions.md#event)
-- [rule](actions.md#rule)
-- [user](actions.md#user)
-# file
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "agent": {
-        "id": "ccb7b1a1-303e-416f-b975-311737e8e125",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "Effective_process": {
-        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
-        "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
-        "name": "WMIC.exe",
-        "pid": 2732
-    },
-    "process": {
-        "Ext": {
-            "ancestry": [
-                "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTYwNC0xMzI5MzU0OTEwOS4zNTg1OTc3MDA=",
-                "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ3Mi0xMzI5MzU0OTEwOS43NjU4MjcwMA=="
-            ],
-            "code_signature": [
-                {
-                    "trusted": true,
-                    "subject_name": "Elasticsearch, Inc.",
-                    "exists": true,
-                    "status": "trusted"
-                }
-            ]
-        },
-        "args_count": 1,
-        "parent": {
-            "pid": 604,
-            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
-            "group_leader": {
-                "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-            }
-        },
-        "entry_leader": {
-            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
-            "parent": {
-                "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-            }
-        },
-        "session_leader": {
-            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-        },
-        "group_leader": {
-            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-        },
-        "code_signature": {
-            "trusted": true,
-            "subject_name": "Elasticsearch, Inc.",
-            "exists": true,
-            "status": "trusted"
-        },
-        "name": "winlogbeat.exe",
-        "pid": 4512,
-        "thread": {
-            "id": 340,
-            "Ext": {
-                "call_stack": [
-                    {
-                        "allocation_private_bytes": 16384,
-                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                        "protection": "RWX",
-                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                    }
-                ],
-                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                "hardware_breakpoint_set": true
-            }
-        },
-        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
-        "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
-    },
-    "message": "Endpoint file event",
-    "@timestamp": "2022-04-04T18:37:01.5775771Z",
-    "file": {
-        "Ext": {
-            "header_data": [],
-            "entropy": 5.28353871945538,
-            "device": {
-                "volume_device_type": "Disk File System"
-            },
-            "header_bytes": "7570646174655f74696d653a20323032",
-            "windows": {
-                "zone_identifier": -1
-            },
-            "monotonic_id": 3526
-        },
-        "path": "C:\\ProgramData\\winlogbeat\\.winlogbeat.yml.new",
-        "extension": "new",
-        "size": 1406,
-        "name": ".winlogbeat.yml.new",
-        "origin_referrer_url": "https://example.com",
-        "origin_url": "https://example.com/file.zip"
-    },
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "logs",
-        "dataset": "endpoint.events.file"
-    },
-    "host": {
-        "hostname": "response-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.9",
-            "fe80::4d1:ef01:c0ed:299a",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "response-win-1",
-        "id": "bcbbe9cb-0278-43f9-aa1b-2dc9839bbf6f",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "sequence": 32114,
-        "ingested": "2022-04-04T18:37:29Z",
-        "created": "2022-04-04T18:37:01.5775771Z",
-        "kind": "event",
-        "module": "endpoint",
-        "action": "creation",
-        "id": "MYfZFpbNKturKgFp+++++AlT",
-        "category": [
-            "file"
-        ],
-        "type": [
-            "creation"
-        ],
-        "dataset": "endpoint.events.file"
-    },
-    "user": {
-        "domain": "NT AUTHORITY",
-        "name": "SYSTEM",
-        "id": "S-1-5-18"
-    }
-}
-```
-</details>
-
-### [Fields](file.md)
-- [@timestamp](file.md#@timestamp)
-- [message](file.md#message)
-- [Effective_process](file.md#Effective_process)
-- [Persistence](file.md#Persistence)
-- [agent](file.md#agent)
-- [data_stream](file.md#data_stream)
-- [destination](file.md#destination)
-- [ecs](file.md#ecs)
-- [event](file.md#event)
-- [file](file.md#file)
-- [group](file.md#group)
-- [host](file.md#host)
-- [process](file.md#process)
-- [source](file.md#source)
-- [user](file.md#user)
-# api
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "@timestamp": "2023-01-09T19:38:51.5141503Z",
-    "Target": {
-        "process": {
-            "Ext": {
-                "created_suspended": true,
-                "protection": "PsProtectedSignerWinTcb",
-                "memory_region": {
-                    "allocation_base": 1649160290304,
-                    "allocation_protection": "RWX",
-                    "allocation_size": 4096,
-                    "allocation_type": "PRIVATE",
-                    "bytes_address": 1649160290304,
-                    "bytes_allocation_offset": 0,
-                    "bytes_compressed": "eJztwbEJACAMALA+5uAtWnAoOPg/+EWnJO9k1bo742XuMRsEAAAA0OsD8lge9g==",
-                    "bytes_compressed_present": true,
-                    "hash": {
-                        "sha256": "0b28b598ef70fd2377613fd88a50d52047ae31c16f2c688f3aa4e0b98d63730c"
-                    },
-                    "memory_pe_detected": false,
-                    "region_base": 1649160290304,
-                    "region_protection": "R--",
-                    "region_size": 4096,
-                    "region_state": "COMMIT",
-                    "strings": [
-                        "shellcode",
-                        "seed=AAAA"
-                    ]
-                },
-                "token": {
-                    "integrity_level_name": "high"
-                }
-            },
-            "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI1NzMyLTE2OTkwMDE3NDAuOTU4NTY4MDAw",
-            "executable": "C:\\Temp\\1_StayRunningWin32_x64.exe",
-            "name": "1_StayRunningWin32_x64.exe",
-            "pid": 25732
-        }
-    },
-    "dll": {
-        "Ext": {
-            "code_signature": [
-                {
-                    "exists": true,
-                    "status": "trusted",
-                    "subject_name": "Microsoft Windows",
-                    "trusted": true
-                }
-            ]
-        },
-        "hash": {
-            "sha256": "8b9731a4b83e801cda7b918f8194608e91f86b3a86ffb6bb24230b1cc28e1a54"
-        },
-        "path": "c:\\windows\\system32\\drivers\\pktmon.sys"
-    },
-    "destination": {
-        "ip": "2001:4860:4860::8844",
-        "port": 139
-    },
-    "event": {
-        "category": [
-            "api",
-            "intrusion_detection"
-        ],
-        "created": "2023-01-09T19:38:51.5141503Z",
-        "dataset": "endpoint.events.api",
-        "id": "MvlgiHxIZtj1+Abi++++++ul",
-        "kind": "event",
-        "module": "endpoint",
-        "outcome": "success",
-        "provider": "Microsoft-Windows-Threat-Intelligence",
-        "sequence": 3802,
-        "type": [
-            "credential_access"
-        ]
-    },
-    "host": {
-        "architecture": "x86_64",
-        "hostname": "DESKTOP-OCG8CR6",
-        "id": "dabadaba-0000-0000-0000-000000000000",
-        "ip": [
-            "169.254.104.226",
-            "fe80::6037:d589:2ee9:772f",
-            "172.22.6.230",
-            "fe80::80ea:8e8d:e1f2:6622",
-            "169.254.74.35",
-            "fe80::900c:a9d3:fd8:9345",
-            "127.0.0.1",
-            "::1"
-        ],
-        "mac": [
-            "00-15-5D-00-09-18",
-            "00-15-5D-00-09-19",
-            "00-15-5D-00-09-17"
-        ],
-        "name": "DESKTOP-OCG8CR6",
-        "os": {
-            "Ext": {
-                "variant": "Windows 11 Enterprise N"
-            },
-            "family": "windows",
-            "full": "Windows 11 Enterprise N 22H2 (10.0.22621.963)",
-            "kernel": "22H2 (10.0.22621.963)",
-            "name": "Windows",
-            "platform": "windows",
-            "type": "windows",
-            "version": "22H2 (10.0.22621.963)"
-        }
-    },
-    "message": "Endpoint API event - hand-crafted with a superset of fields",
-    "network": {
-        "transport": "tcp",
-        "type": "ipv6"
-    },
-    "process": {
-        "Ext": {
-            "ancestry": [
-                "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTgxMi0xNjczMjkxNTMzLjcxNjczMTgwMA==",
-                "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ5NjAtMTY3Mjk2NTgzMC4yODc0OTYxMDA=",
-                "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTY2MjgtMTY3Mjk2NTc3Mi41MTg4MDA1MDA=",
-                "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ2MDAtMTY3Mjk2NTcxMy40NzY1NDUyMDA="
-            ],
-            "api": {
-                "behaviors": [
-                    "cross-process",
-                    "rapid_background_polling",
-                    "multiple_polling_processes",
-                    "pid_spoofing"
-                ],
-                "metadata": {
-                    "target_address_name": "Unbacked",
-                    "target_address_path": "c:\\windows\\system32\\ntdll.dll",
-                    "return_value": 1,
-                    "windows_count": 2,
-                    "visible_windows_count": 0,
-                    "thread_info_flags": 16,
-                    "start_address_module": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe",
-                    "start_address_allocation_protection": "RCX",
-                    "procedure_symbol": "taskbar.dll",
-                    "ms_since_last_keyevent": 94,
-                    "background_callcount": 6021,
-                    "security_descriptor": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)",
-                    "client_machine": "DESKTOP-EXAMPLE",
-                    "client_machine_fqdn": "DESKTOP-EXAMPLE",
-                    "client_process_id": 3600,
-                    "client_is_local": true,
-                    "amsi_filenames": [
-                        "C:\\script.ps1"
-                    ],
-                    "amsi_logs": {
-                        "entries": [
-                            "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
-                        ],
-                        "type": "PowerShell"
-                    }
-                },
-                "name": "OpenProcess",
-                "parameters": {
-                    "desired_access": [
-                        "PROCESS_QUERY_LIMITED_INFORMATION",
-                        "PROCESS_VM_READ"
-                    ],
-                    "desired_access_numeric": 4112,
-                    "handle_type": "process",
-                    "address": 2904525045760,
-                    "allocation_type": "COMMIT|RESERVE",
-                    "protection": "R-X",
-                    "protection_old": "R-X",
-                    "size": 16,
-                    "context_flags": 1048607,
-                    "r8": 8,
-                    "r9": 9,
-                    "rax": 10,
-                    "rbp": 3,
-                    "rbx": 11,
-                    "rcx": 2883351609344,
-                    "rdi": 5,
-                    "rdx": 13,
-                    "rip": 140706538588528,
-                    "rsi": 4,
-                    "rsp": 2,
-                    "eax": 10,
-                    "ebp": 3,
-                    "ebx": 11,
-                    "ecx": 12,
-                    "edi": 5,
-                    "edx": 0,
-                    "eip": 1,
-                    "esi": 4,
-                    "esp": 2,
-                    "argument1": 2583984274656,
-                    "argument2": 4105953215,
-                    "argument3": 31058890,
-                    "procedure": 140705553857280,
-                    "usage_page": "GENERIC",
-                    "usage": "KEYBOARD",
-                    "flags": "INPUTSINK",
-                    "hook_type": "WH_KEYBOARD_LL",
-                    "hook_module": "c:\\windows\\system32\\taskbar.dll",
-                    "device": "\\Device\\PktMonDev",
-                    "io_control_code": 27365,
-                    "event_filter_name": "ExampleFilter",
-                    "event_filter_details": "__EventFilter{EventNamespace = \"root\\CimV2\"; Name = \"ExampleFilter\";};",
-                    "consumer_name": "ExampleConsumer",
-                    "consumer_type": "CommandLineEventConsumer",
-                    "consumer_details": "CommandLineEventConsumer{Name = \"ExampleConsumer\";};",
-                    "namespace": "root\\Microsoft\\Windows\\DeviceGuard",
-                    "operation": "Win32_Process::Create",
-                    "app_name": "PowerShell",
-                    "content_name": "C:\\script.ps1",
-                    "buffer": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
-                },
-                "summary": "VirtualAllocEx( charmap.exe, NULL, 0x10, COMMIT|RESERVE, R-X )"
-            },
-            "code_signature": [
-                {
-                    "exists": true,
-                    "status": "errorBadDigest",
-                    "subject_name": "Microsoft Windows",
-                    "trusted": false
-                }
-            ],
-            "memory_region": {
-                "allocation_base": 140712018378752,
-                "allocation_protection": "RCX",
-                "allocation_size": 45056,
-                "allocation_type": "IMAGE",
-                "mapped_path": "C:\\Program Files\\Python39\\DLLs\\libffi-7.dll",
-                "region_base": 140712018395136,
-                "region_protection": "R-X",
-                "region_size": 8192,
-                "region_state": "COMMIT"
-            },
-            "token": {
-                "integrity_level_name": "system"
-            }
-        },
-        "code_signature": {
-            "exists": true,
-            "status": "errorBadDigest",
-            "subject_name": "Microsoft Windows",
-            "trusted": false
-        },
-        "command_line": "",
-        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTkxNi0xNjczMjkzMTMwLjk0NjAwMjAw",
-        "executable": "c\\git\\endpoint-dev\\Tools\\Leia\\modules\\exe_malware\\mimikatz.exe",
-        "name": "mimikatz.exe",
-        "pid": 916,
-        "thread": {
-            "Ext": {
-                "call_stack": [
-                    {
-                        "allocation_private_bytes": 4096,
-                        "protection_provenance": "dabapi.dll",
-                        "symbol_info": "c:\\windows\\system32\\ntdll.dll!ZwProtectVirtualMemory+0x14"
-                    },
-                    {
-                        "symbol_info": "c:\\windows\\system32\\kernelbase.dll!VirtualProtect+0x36"
-                    },
-                    {
-                        "allocation_private_bytes": 8192,
-                        "callsite_leading_bytes": "c048895424204c8bc9488d0d801f0000418d500248ff15052a00000f1f4400004883c438c3cccccccccccccccccccccc4883ec2048b880bf1acaf87f0000ffd0",
-                        "callsite_trailing_bytes": "4883c420c3ec48498363e800498d4320ba2500000049c743e004000000440fb7ca4c8d05d0320000ba2b000000498943d848ff15f82a00000f1f4400004883c4",
-                        "protection": "RWX",
-                        "protection_provenance": "eventstests.exe",
-                        "symbol_info": "c:\\windows\\system32\\dabapi.dll!DabApiBufferFree+0x10"
-                    },
-                    {
-                        "symbol_info": "Unknown"
-                    }
-                ],
-                "call_stack_final_user_module": {
-                    "allocation_private_bytes": 4096,
-                    "code_signature": [
-                        {
-                            "exists": true,
-                            "status": "trusted",
-                            "subject_name": "Microsoft Windows",
-                            "trusted": true
-                        }
-                    ],
-                    "hash": {
-                        "sha256": "0386c57d59ee1292bb74d9878358da7a0ba00e5b56ed52fd6171b9e6d29d85aa"
-                    },
-                    "name": "dabapi.dll",
-                    "path": "c:\\windows\\system32\\dabapi.dll",
-                    "protection": "RWX",
-                    "protection_provenance": "eventstests.exe",
-                    "protection_provenance_path": "c:\\dev\\eventstests.exe",
-                    "reason": "ntdll.dll"
-                },
-                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll"
-            },
-            "id": 11628
-        }
-    },
-    "user": {
-        "domain": "DESKTOP-OCG8CR6",
-        "id": "S-1-5-21-3820246941-898183108-3095036578-1001",
-        "name": "User"
-    }
-}
-```
-</details>
-
-### [Fields](api.md)
-- [@timestamp](api.md#@timestamp)
-- [message](api.md#message)
-- [Target](api.md#Target)
-- [data_stream](api.md#data_stream)
-- [destination](api.md#destination)
-- [dll](api.md#dll)
-- [ecs](api.md#ecs)
-- [event](api.md#event)
-- [host](api.md#host)
-- [network](api.md#network)
-- [process](api.md#process)
-- [user](api.md#user)
-# network
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "agent": {
-        "id": "afd348c6-0ec9-4961-805e-8ed2fc4c043b",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "process": {
-        "Ext": {
-            "ancestry": [
-                "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTYxMi0xMzI5MzU0OTEwOS43MzU5NDk3MDA=",
-                "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTQ3Ni0xMzI5MzU0OTEwOS4zODExMTM3MDA="
-            ],
-            "code_signature": [
-                {
-                    "trusted": false,
-                    "subject_name": "Google LLC",
-                    "exists": true,
-                    "status": "errorExpired"
-                }
-            ]
-        },
-        "parent": {
-            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
-            "group_leader": {
-                "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-            }
-        },
-        "entry_leader": {
-            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
-            "parent": {
-                "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-            }
-        },
-        "session_leader": {
-            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-        },
-        "group_leader": {
-            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-        },
-        "code_signature": {
-            "trusted": false,
-            "subject_name": "Google LLC",
-            "exists": true,
-            "status": "errorExpired"
-        },
-        "name": "GCEWindowsAgent.exe",
-        "pid": 580,
-        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
-        "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
-    },
-    "destination": {
-        "geo": {
-            "continent_name": "North America",
-            "country_iso_code": "US",
-            "country_name": "United States",
-            "location": {
-                "lon": -97.822,
-                "lat": 37.751
-            }
-        },
-        "as": {
-            "number": 15169,
-            "organization": {
-                "name": "GOOGLE"
-            }
-        },
-        "address": "64.233.191.95",
-        "port": 443,
-        "bytes": 4923,
-        "ip": "64.233.191.95"
-    },
-    "source": {
-        "address": "10.201.0.32",
-        "port": 54924,
-        "bytes": 498,
-        "ip": "10.201.0.32"
-    },
-    "dns": {
-        "Ext": {
-            "status": 123,
-            "options": 9223372036854775808
-        },
-        "resolved_ip": [
-            "10.10.10.10",
-            "10.10.10.11"
-        ],
-        "question": {
-            "name": "foo",
-            "type": "A"
-        }
-    },
-    "message": "Endpoint network event",
-    "network": {
-        "transport": "tcp",
-        "type": "ipv4",
-        "direction": "egress"
-    },
-    "@timestamp": "2022-04-04T18:52:00.6007809Z",
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "logs",
-        "dataset": "endpoint.events.network"
-    },
-    "host": {
-        "hostname": "mgmt-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.32",
-            "fe80::f8e6:a511:69ea:27c4",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "mgmt-win-1",
-        "id": "51b19c6c-27e3-4c80-ac2a-b72ed52c40c9",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "sequence": 36090,
-        "ingested": "2022-04-04T18:52:21Z",
-        "created": "2022-04-04T18:52:00.6007809Z",
-        "kind": "event",
-        "module": "endpoint",
-        "action": "disconnect_received",
-        "id": "MYfZG5h8j1qej16H+++++CFe",
-        "category": [
-            "network"
-        ],
-        "type": [
-            "end"
-        ],
-        "dataset": "endpoint.events.network"
-    },
-    "user": {
-        "domain": "NT AUTHORITY",
-        "name": "SYSTEM",
-        "id": "S-1-5-18"
-    }
-}
-```
-</details>
-
-### [Fields](network.md)
-- [@timestamp](network.md#@timestamp)
-- [message](network.md#message)
-- [agent](network.md#agent)
-- [data_stream](network.md#data_stream)
-- [destination](network.md#destination)
-- [dns](network.md#dns)
-- [ecs](network.md#ecs)
-- [event](network.md#event)
-- [group](network.md#group)
-- [host](network.md#host)
-- [http](network.md#http)
-- [network](network.md#network)
-- [process](network.md#process)
-- [source](network.md#source)
-- [user](network.md#user)
-# metrics
-### Sample Event
-<details>
-<summary>
-Click to expand
-</summary>
-
-```json
-{
-    "agent": {
-        "build": {
-            "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-        },
-        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-        "type": "endpoint",
-        "version": "8.3.0-SNAPSHOT"
-    },
-    "message": "Endpoint metrics",
-    "@timestamp": "2022-04-04T18:38:15.7178887Z",
-    "Endpoint": {
-        "metrics": {
-            "system_impact": [
-                {
-                    "file_events": {
-                        "week_ms": 418
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows Publisher",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Windows\\System32\\svchost.exe"
-                    },
-                    "malware": {
-                        "week_ms": 7483
-                    },
-                    "process_events": {
-                        "week_ms": 78
-                    },
-                    "registry_events": {
-                        "week_ms": 248
-                    },
-                    "dns_events": {
-                        "week_ms": 16
-                    },
-                    "network_events": {
-                        "week_ms": 8
-                    },
-                    "overall": {
-                        "week_ms": 11744
-                    },
-                    "authentication_events": {
-                        "week_ms": 155
-                    },
-                    "library_load_events": {
-                        "week_ms": 3028
-                    },
-                    "cred_access_events": {
-                        "week_ms": 10
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 250
-                    },
-                    "win32k_events": {
-                        "week_ms": 50
-                    }
-                },
-                {
-                    "file_events": {
-                        "week_ms": 46
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
-                    },
-                    "malware": {
-                        "week_ms": 2
-                    },
-                    "process_events": {
-                        "week_ms": 19
-                    },
-                    "registry_events": {
-                        "week_ms": 3
-                    },
-                    "overall": {
-                        "week_ms": 8290
-                    },
-                    "library_load_events": {
-                        "week_ms": 7890
-                    },
-                    "cred_access_events": {
-                        "week_ms": 20
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 300
-                    },
-                    "win32k_events": {
-                        "week_ms": 10
-                    }
-                },
-                {
-                    "file_events": {
-                        "week_ms": 1641
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Elasticsearch, Inc.",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
-                    },
-                    "malware": {
-                        "week_ms": 2589
-                    },
-                    "process_events": {
-                        "week_ms": 419
-                    },
-                    "registry_events": {
-                        "week_ms": 1
-                    },
-                    "network_events": {
-                        "week_ms": 32
-                    },
-                    "overall": {
-                        "week_ms": 5046
-                    },
-                    "library_load_events": {
-                        "week_ms": 4
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 360
-                    }
-                },
-                {
-                    "file_events": {
-                        "week_ms": 2
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows Publisher",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Windows\\System32\\lsass.exe"
-                    },
-                    "process_events": {
-                        "week_ms": 3
-                    },
-                    "registry_events": {
-                        "week_ms": 83
-                    },
-                    "overall": {
-                        "week_ms": 4761
-                    },
-                    "authentication_events": {
-                        "week_ms": 3177
-                    },
-                    "library_load_events": {
-                        "week_ms": 26
-                    },
-                    "cred_access_events": {
-                        "week_ms": 1350
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 120
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Windows\\System32\\conhost.exe"
-                    },
-                    "malware": {
-                        "week_ms": 16
-                    },
-                    "process_events": {
-                        "week_ms": 26
-                    },
-                    "registry_events": {
-                        "week_ms": 3
-                    },
-                    "overall": {
-                        "week_ms": 3261
-                    },
-                    "library_load_events": {
-                        "week_ms": 2966
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 250
-                    }
-                },
-                {
-                    "file_events": {
-                        "week_ms": 51
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "exists": false,
-                                "status": "errorCode_endpoint: Initital state, no attempt to load signature was made"
-                            }
-                        ],
-                        "executable": "System"
-                    },
-                    "malware": {
-                        "week_ms": 1978
-                    },
-                    "overall": {
-                        "week_ms": 2029
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "exists": false
-                            }
-                        ],
-                        "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\e266326169887aa7cb26b9e2aa421ee4\\System.Web.ni.dll"
-                    },
-                    "malware": {
-                        "week_ms": 1015
-                    },
-                    "overall": {
-                        "week_ms": 1015
-                    }
-                },
-                {
-                    "file_events": {
-                        "week_ms": 8
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Elasticsearch, Inc.",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\metricbeat-8.3.0-SNAPSHOT-windows-x86_64\\metricbeat.exe"
-                    },
-                    "process_events": {
-                        "week_ms": 502
-                    },
-                    "dns_events": {
-                        "week_ms": 84
-                    },
-                    "network_events": {
-                        "week_ms": 1
-                    },
-                    "overall": {
-                        "week_ms": 1162
-                    },
-                    "library_load_events": {
-                        "week_ms": 417
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 150
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": false,
-                                "subject_name": "Google LLC",
-                                "exists": true,
-                                "status": "errorExpired"
-                            }
-                        ],
-                        "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
-                    },
-                    "malware": {
-                        "week_ms": 627
-                    },
-                    "process_events": {
-                        "week_ms": 89
-                    },
-                    "registry_events": {
-                        "week_ms": 2
-                    },
-                    "dns_events": {
-                        "week_ms": 7
-                    },
-                    "network_events": {
-                        "week_ms": 8
-                    },
-                    "overall": {
-                        "week_ms": 1068
-                    },
-                    "library_load_events": {
-                        "week_ms": 85
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 250
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "exists": false
-                            }
-                        ],
-                        "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\39ce4aafe1a3bc56fb1435f6550dd7a3\\Microsoft.PowerShell.Commands.Utility.ni.dll"
-                    },
-                    "malware": {
-                        "week_ms": 760
-                    },
-                    "overall": {
-                        "week_ms": 760
-                    }
-                },
-                {
-                    "file_events": {
-                        "week_ms": 15
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "exists": false
-                            }
-                        ],
-                        "executable": "C:\\Program Files\\metricbeat-7.10.0-windows-x86_64\\metricbeat.exe"
-                    },
-                    "malware": {
-                        "week_ms": 29
-                    },
-                    "process_events": {
-                        "week_ms": 634
-                    },
-                    "registry_events": {
-                        "week_ms": 1
-                    },
-                    "dns_events": {
-                        "week_ms": 8
-                    },
-                    "network_events": {
-                        "week_ms": 4
-                    },
-                    "overall": {
-                        "week_ms": 744
-                    },
-                    "library_load_events": {
-                        "week_ms": 3
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 50
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Windows\\System32\\spoolsv.exe"
-                    },
-                    "process_events": {
-                        "week_ms": 8
-                    },
-                    "registry_events": {
-                        "week_ms": 40
-                    },
-                    "overall": {
-                        "week_ms": 795
-                    },
-                    "library_load_events": {
-                        "week_ms": 627
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 120
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Elasticsearch, Inc.",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Program Files\\Packetbeat\\packetbeat.exe"
-                    },
-                    "malware": {
-                        "week_ms": 74
-                    },
-                    "process_events": {
-                        "week_ms": 432
-                    },
-                    "registry_events": {
-                        "week_ms": 1
-                    },
-                    "network_events": {
-                        "week_ms": 1
-                    },
-                    "overall": {
-                        "week_ms": 599
-                    },
-                    "library_load_events": {
-                        "week_ms": 61
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 30
-                    }
-                },
-                {
-                    "file_events": {
-                        "week_ms": 20
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Corporation",
-                                "exists": true,
-                                "status": "trusted"
-                            },
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Corporation",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"
-                    },
-                    "malware": {
-                        "week_ms": 350
-                    },
-                    "process_events": {
-                        "week_ms": 19
-                    },
-                    "registry_events": {
-                        "week_ms": 1
-                    },
-                    "overall": {
-                        "week_ms": 480
-                    },
-                    "library_load_events": {
-                        "week_ms": 70
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 20
-                    }
-                },
-                {
-                    "file_events": {
-                        "week_ms": 6
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Elasticsearch, Inc.",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\filebeat-8.3.0-SNAPSHOT-windows-x86_64\\filebeat.exe"
-                    },
-                    "process_events": {
-                        "week_ms": 395
-                    },
-                    "dns_events": {
-                        "week_ms": 51
-                    },
-                    "network_events": {
-                        "week_ms": 2
-                    },
-                    "overall": {
-                        "week_ms": 494
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 40
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Google LLC",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Program Files\\Google\\Compute Engine\\vss\\GoogleVssProvider.dll"
-                    },
-                    "malware": {
-                        "week_ms": 439
-                    },
-                    "overall": {
-                        "week_ms": 439
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Windows\\System32\\VSSVC.exe"
-                    },
-                    "malware": {
-                        "week_ms": 45
-                    },
-                    "process_events": {
-                        "week_ms": 13
-                    },
-                    "registry_events": {
-                        "week_ms": 124
-                    },
-                    "overall": {
-                        "week_ms": 476
-                    },
-                    "authentication_events": {
-                        "week_ms": 8
-                    },
-                    "library_load_events": {
-                        "week_ms": 216
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 70
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Windows\\SYSTEM32\\mispace.dll"
-                    },
-                    "malware": {
-                        "week_ms": 353
-                    },
-                    "overall": {
-                        "week_ms": 353
-                    }
-                },
-                {
-                    "process": {
-                        "code_signature": [
-                            {
-                                "exists": false
-                            }
-                        ],
-                        "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\b1cbeb46534d9974961496306f2f1a28\\System.Web.Extensions.ni.dll"
-                    },
-                    "malware": {
-                        "week_ms": 305
-                    },
-                    "overall": {
-                        "week_ms": 305
-                    }
-                },
-                {
-                    "file_events": {
-                        "week_ms": 25
-                    },
-                    "process": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "executable": "C:\\Windows\\System32\\wbem\\WMIADAP.exe"
-                    },
-                    "malware": {
-                        "week_ms": 247
-                    },
-                    "process_events": {
-                        "week_ms": 4
-                    },
-                    "registry_events": {
-                        "week_ms": 5
-                    },
-                    "overall": {
-                        "week_ms": 345
-                    },
-                    "library_load_events": {
-                        "week_ms": 14
-                    },
-                    "threat_intelligence_events": {
-                        "week_ms": 50
-                    }
-                }
-            ],
-            "memory": {
-                "endpoint": {
-                    "private": {
-                        "mean": 288590259,
-                        "latest": 493723648
-                    }
-                }
-            },
-            "disks": [
-                {
-                    "endpoint_drive": true,
-                    "total": 53564403712,
-                    "free": 25891106816,
-                    "device": "\\Device\\HarddiskVolume3",
-                    "mount": "C:\\",
-                    "fstype": "NTFS"
-                },
-                {
-                    "total": 100663296,
-                    "free": 73579520,
-                    "device": "\\Device\\HarddiskVolume2",
-                    "mount": "",
-                    "fstype": "FAT32"
-                }
-            ],
-            "documents_volume": {
-                "file_events": {
-                    "suppressed_count": 0,
-                    "suppressed_bytes": 0,
-                    "sent_count": 3485,
-                    "sent_bytes": 7302875
-                },
-                "security_events": {
-                    "suppressed_count": 0,
-                    "suppressed_bytes": 0,
-                    "sent_count": 259,
-                    "sent_bytes": 422247
-                },
-                "library_events": {
-                    "suppressed_count": 0,
-                    "suppressed_bytes": 0,
-                    "sent_count": 114,
-                    "sent_bytes": 287954
-                },
-                "process_events": {
-                    "suppressed_count": 0,
-                    "suppressed_bytes": 0,
-                    "sent_count": 201,
-                    "sent_bytes": 602914
-                },
-                "registry_events": {
-                    "suppressed_count": 0,
-                    "suppressed_bytes": 0,
-                    "sent_count": 605,
-                    "sent_bytes": 1288593
-                },
-                "dns_events": {
-                    "suppressed_count": 0,
-                    "suppressed_bytes": 0,
-                    "sent_count": 5250,
-                    "sent_bytes": 11364752
-                },
-                "network_events": {
-                    "suppressed_count": 0,
-                    "suppressed_bytes": 0,
-                    "sent_count": 1753,
-                    "sent_bytes": 3479631
-                },
-                "overall": {
-                    "suppressed_count": 0,
-                    "suppressed_bytes": 0,
-                    "sent_count": 11667,
-                    "sent_bytes": 24748966
-                }
-            },
-            "cpu": {
-                "endpoint": {
-                    "mean": 0.324235176435677,
-                    "latest": 62.6406111450215
-                }
-            },
-            "threads": [
-                {
-                    "name": "actionsAPIThread",
-                    "cpu": {
-                        "mean": 0.00456829602558246
-                    }
-                },
-                {
-                    "name": "stateReportThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "checkinAPIThread",
-                    "cpu": {
-                        "mean": 0.0365463682046597
-                    }
-                },
-                {
-                    "name": "KernelAsyncMessageQueueConsumerThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "Cron",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "File Cache",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "FileLogThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "LoggingLimitThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "CredentialAccessEventDispatcherThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelPortConsumerThread",
-                    "cpu": {
-                        "mean": 0.00456454263282819
-                    }
-                },
-                {
-                    "name": "KernelPortConsumerThread",
-                    "cpu": {
-                        "mean": 0.00456454263282819
-                    }
-                },
-                {
-                    "name": "RulesEngineThread",
-                    "cpu": {
-                        "mean": 0.0091324200913242
-                    }
-                },
-                {
-                    "name": "KernelPortConsumerThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelAsyncMessageQueueConsumerThread",
-                    "cpu": {
-                        "mean": 0.00456454263282819
-                    }
-                },
-                {
-                    "name": "KernelSyncQueueConsumerThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "DocumentLoggingThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "DocumentLoggingMaintenance",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "BulkConsumerThread",
-                    "cpu": {
-                        "mean": 0.00455871626549964
-                    }
-                },
-                {
-                    "name": "DocumentLoggingConsumerThread",
-                    "cpu": {
-                        "mean": 0.113967906637491
-                    }
-                },
-                {
-                    "name": "DocumentLoggingLimitThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.022822713164141
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.022822713164141
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelSyncMessageThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "ArtifactManifestDownload",
-                    "cpu": {
-                        "mean": 0.12311901504788
-                    }
-                },
-                {
-                    "name": "PolicyReloadThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "CredentialAccessClassifierThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "KernelPortConsumerThread",
-                    "cpu": {
-                        "mean": 0.0136936278984846
-                    }
-                },
-                {
-                    "name": "PerformanceMonitorWorkerThread",
-                    "cpu": {
-                        "mean": 0.00912200684150513
-                    }
-                },
-                {
-                    "name": "MetadataThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "EventsQueueThread",
-                    "cpu": {
-                        "mean": 0.0729760547320411
-                    }
-                },
-                {
-                    "name": "DelayedAlertEnrichment",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "MaintainProcessMap",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "FileScoreThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "DiagnosticMalwareThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "QuarantineManagerWorkerThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "EventProcessingThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "HostIsolationMonitorThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "serviceCommsThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "grpcConnectionManagerThread",
-                    "cpu": {
-                        "mean": 0.0
-                    }
-                },
-                {
-                    "name": "RansomwareGlobalUserThread"
-                },
-                {
-                    "name": "RansomwareProcessMonitorThread"
-                },
-                {
-                    "name": "RansomwareFileCacheCleanupThread"
-                },
-                {
-                    "name": "RansomwareParseUnverifiedThread"
-                },
-                {
-                    "name": "RansomwareLuaVerifiedThread"
-                }
-            ],
-            "uptime": {
-                "endpoint": 21930,
-                "system": 21992
-            }
-        }
-    },
-    "ecs": {
-        "version": "1.11.0"
-    },
-    "data_stream": {
-        "namespace": "default",
-        "type": "metrics",
-        "dataset": "endpoint.metrics"
-    },
-    "host": {
-        "hostname": "data-viz-win-1",
-        "os": {
-            "Ext": {
-                "variant": "Windows Server 2019 Datacenter"
-            },
-            "kernel": "1809 (10.0.17763.2686)",
-            "name": "Windows",
-            "family": "windows",
-            "type": "windows",
-            "version": "1809 (10.0.17763.2686)",
-            "platform": "windows",
-            "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-        },
-        "ip": [
-            "10.201.0.13",
-            "fe80::f40a:aed0:618a:972d",
-            "127.0.0.1",
-            "::1"
-        ],
-        "name": "data-viz-win-1",
-        "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-        "mac": [
-            "00-00-5E-00-53-23"
-        ],
-        "architecture": "x86_64"
-    },
-    "event": {
-        "agent_id_status": "verified",
-        "sequence": 35124,
-        "ingested": "2022-04-04T18:38:16Z",
-        "created": "2022-04-04T18:38:15.7178887Z",
-        "kind": "metric",
-        "module": "endpoint",
-        "action": "endpoint_metrics",
-        "id": "MYfZG00oEwD2/fqT+++++Byi",
-        "category": [
-            "host"
-        ],
-        "type": [
-            "info"
-        ],
-        "dataset": "endpoint.metrics"
-    }
-}
-```
-</details>
-
-### [Fields](metrics.md)
-- [@timestamp](metrics.md#@timestamp)
-- [message](metrics.md#message)
-- [Endpoint](metrics.md#Endpoint)
-- [agent](metrics.md#agent)
-- [data_stream](metrics.md#data_stream)
-- [ecs](metrics.md#ecs)
-- [event](metrics.md#event)
-- [host](metrics.md#host)
diff --git a/scripts/generate-docs/output/action_responses.md b/scripts/generate-docs/output/action_responses.md
deleted file mode 100644
index 773a9d851..000000000
--- a/scripts/generate-docs/output/action_responses.md
+++ /dev/null
@@ -1,249 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `action_id`
-
-### Description
-The action id
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent_id`
-
-### Description
-Alias field that maps to {agent: {id}}
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `completed_at`
-
-### Description
-Request completion timestamp when the response is done executing. Usually matches with @timestamp.
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data.alert_id`
-
-### Description
-List of alert ids that triggered the action
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data.command`
-
-### Description
-The action that is requested
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data.comment`
-
-### Description
-A comment that describes the action that is requested
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `started_at`
-
-### Description
-Timestamp of start of request
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `status`
-
-### Description
-The status of the request that distinguishes if the request is queued, running or completed.
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `EndpointActions`
-
-### Description
-Fields to describe the endpoint  action requests and responses.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action_id` | The action id | None |
-| `completed_at` | Request completion timestamp when the response is done executing. Usually matches with @timestamp. | None |
-| `data` | The action request information | None |
-| `data.alert_id` | List of alert ids that triggered the action | None |
-| `data.command` | The action that is requested | isolate |
-| `data.comment` | A comment that describes the action that is requested | None |
-| `started_at` | Timestamp of start of request | None |
-| `status` | The status of the request that distinguishes if the request is queued, running or completed. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `error`
-
-### Description
-These fields can represent errors of any kind.
-Use them for errors that happen while fetching events or in cases where the event itself contains an error.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `code` | Error code describing the error. | None |
-| `id` | Unique identifier for the error. | None |
-| `message` | Error message. | None |
-| `stack_trace` | The stack trace of this error in plain text. | None |
-| `type` | The type of the error, for example the class name of the exception. | java.lang.NullPointerException |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `end` | `event.end` contains the date when the event ended or when the activity was last observed. | None |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `start` | `event.start` contains the date when the event started or when the activity was first observed. | None |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/actions.md b/scripts/generate-docs/output/actions.md
deleted file mode 100644
index 0ff390b22..000000000
--- a/scripts/generate-docs/output/actions.md
+++ /dev/null
@@ -1,296 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `action_id`
-
-### Description
-The action id
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agents`
-
-### Description
-Alias field that maps to {agent: {id}}
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data.alert_id`
-
-### Description
-List of alert ids that triggered the action
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data.command`
-
-### Description
-The action that is requested
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data.comment`
-
-### Description
-A comment that describes the action that is requested
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `expiration`
-
-### Description
-Request expiration timestamp
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `input_type`
-
-### Description
-The input type of the action, distinguishes endpoint actions as `endpoint`
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `type`
-
-### Description
-Distinguishes the type of input. Usually set to `INPUT_ACTION`
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user_id`
-
-### Description
-The user id
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `EndpointActions`
-
-### Description
-Fields to describe the endpoint  action requests and responses.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action_id` | The action id | None |
-| `data` | The action request information | None |
-| `data.alert_id` | List of alert ids that triggered the action | None |
-| `data.command` | The action that is requested | isolate |
-| `data.comment` | A comment that describes the action that is requested | None |
-| `expiration` | Request expiration timestamp | None |
-| `input_type` | The input type of the action, distinguishes endpoint actions as `endpoint` | None |
-| `type` | Distinguishes the type of input. Usually set to `INPUT_ACTION` | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `error`
-
-### Description
-These fields can represent errors of any kind.
-Use them for errors that happen while fetching events or in cases where the event itself contains an error.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `code` | Error code describing the error. | None |
-| `id` | Unique identifier for the error. | None |
-| `message` | Error message. | None |
-| `stack_trace` | The stack trace of this error in plain text. | None |
-| `type` | The type of the error, for example the class name of the exception. | java.lang.NullPointerException |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `end` | `event.end` contains the date when the event ended or when the activity was last observed. | None |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `start` | `event.start` contains the date when the event started or when the activity was first observed. | None |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `rule`
-
-### Description
-Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
-Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | 101 |
-| `name` | The name of the rule or signature generating the event. | BLOCK_DNS_over_TLS |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user`
-
-### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/alerts.md b/scripts/generate-docs/output/alerts.md
deleted file mode 100644
index cc4b15e87..000000000
--- a/scripts/generate-docs/output/alerts.md
+++ /dev/null
@@ -1,2373 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `Events`
-
-### Description
-events array
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `Endpoint`
-
-### Description
-Fields describing the state of the Elastic Endpoint when an event occurs.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `policy` | The policy fields are used to hold information about applied policy. | None |
-| `policy.applied` | information about the policy that is applied | None |
-| `policy.applied.artifacts` | information about protection artifacts applied. | None |
-| `policy.applied.artifacts.global` | information about global protection artifacts applied. | None |
-| `policy.applied.artifacts.global.channel` | global artifacts rollout channel | None |
-| `policy.applied.artifacts.global.identifiers` | the identifiers of global artifacts applied. | None |
-| `policy.applied.artifacts.global.identifiers.name` | the name of global artifact applied. | None |
-| `policy.applied.artifacts.global.identifiers.sha256` | the sha256 of global artifacts applied. | None |
-| `policy.applied.artifacts.global.snapshot` | the snapshot date of applied global artifacts or 'latest' | None |
-| `policy.applied.artifacts.global.update_age` | number of days since global artifacts were made up-to-date | None |
-| `policy.applied.artifacts.global.version` | the version of global artifacts applied. | None |
-| `policy.applied.artifacts.user` | information about user protection artifacts applied. | None |
-| `policy.applied.artifacts.user.identifiers` | the identifiers of user artifacts applied. | None |
-| `policy.applied.artifacts.user.identifiers.name` | the name of user artifact applied. | None |
-| `policy.applied.artifacts.user.identifiers.sha256` | the sha256 of user artifacts applied. | None |
-| `policy.applied.artifacts.user.version` | the version of user artifacts applied. | None |
-| `policy.applied.id` | the id of the applied policy | None |
-| `policy.applied.name` | the name of this applied policy | None |
-| `policy.applied.status` | the status of the applied policy | None |
-| `policy.applied.version` | the version of this applied policy | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `Memory_protection`
-
-### Description
-These fields contain information specific to Memory Protection alerts.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `cross_session` | Is this process injecting across operating system sessions? | None |
-| `feature` | Memory Protection feature which triggered the alert. | shellcode_thread |
-| `parent_to_child` | Is this process injecting into its child? | None |
-| `self_injection` | Is this alert about a process injecting into itself? | None |
-| `thread_count` | The number of threads that this alert applies to. If several alerts occur in a short period of time, they can be combined into a single alert with thread_count > 1. | None |
-| `unique_key_v1` | A unique key created by hashing several characteristics of this alert. | None |
-| `unique_key_v2` | A unique key created by hashing several characteristics of this alert. | 00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `Ransomware`
-
-### Description
-These fields contain information specific to ransomware alerts.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `child_processes.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `child_processes.feature` | Ransomware feature which triggered the alert. | None |
-| `child_processes.files` | Information about each file event attributed to the ransomware. Expected to be an array. | None |
-| `child_processes.files.data` | File header or MBR bytes. | None |
-| `child_processes.files.entropy` | Entropy of file contents. | None |
-| `child_processes.files.extension` | File extension, excluding the leading dot. | None |
-| `child_processes.files.metrics` | Suspicious ransomware behaviours associated with the file event. | None |
-| `child_processes.files.operation` | Operation applied to file. | None |
-| `child_processes.files.original.extension` | Original file extension prior to the file event. | None |
-| `child_processes.files.original.path` | Original file path prior to the file event. | None |
-| `child_processes.files.path` | Full path to the file, including the file name. | None |
-| `child_processes.files.score` | Ransomware score for this particular file event. | None |
-| `child_processes.pid` | Process id. | 4242 |
-| `child_processes.score` | Total ransomware score for aggregated file events. | None |
-| `child_processes.version` | Ransomware artifact version. | None |
-| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `feature` | Ransomware feature which triggered the alert. | None |
-| `files` | Information about each file event attributed to the ransomware. Expected to be an array. | None |
-| `files.data` | File header or MBR bytes. | None |
-| `files.entropy` | Entropy of file contents. | None |
-| `files.extension` | File extension, excluding the leading dot. | None |
-| `files.metrics` | Suspicious ransomware behaviours associated with the file event. | None |
-| `files.operation` | Operation applied to file. | None |
-| `files.original.extension` | Original file extension prior to the file event. | None |
-| `files.original.path` | Original file path prior to the file event. | None |
-| `files.path` | Full path to the file, including the file name. | None |
-| `files.score` | Ransomware score for this particular file event. | None |
-| `pid` | Process id. | 4242 |
-| `score` | Total ransomware score for aggregated file events. | None |
-| `version` | Ransomware artifact version. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `Responses`
-
-### Description
-responses array contains rule response action results
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `@timestamp` | Timestamp in which action was taken | None |
-| `action` | Dictionary representing requested response action | None |
-| `action.action` | Response action name | None |
-| `action.field` | Field in the triggering event to use as input for action | None |
-| `action.file.attributes` | Destination file attributes | None |
-| `action.file.path` | Destination file path | None |
-| `action.file.reason` | Combined USN file modification reason | None |
-| `action.key.actions` | Actions taken by Registry Rollback for key | None |
-| `action.key.path` | NT path of registry key recovered by Rollback | None |
-| `action.key.values` | Values modified | None |
-| `action.key.values.actions` | Actions taken by Registry Rollback for value | None |
-| `action.key.values.name` | Value name recovered by Rollback | None |
-| `action.process.message` | Status message for Process Rollback | None |
-| `action.process.path` | Path of process killed by Process Rollback | None |
-| `action.process.result` | Result code for Process Rollback | None |
-| `action.source.attributes` | Source file attributes | None |
-| `action.source.path` | Source file path | None |
-| `action.state` | Index of event in events array to use for field lookup | None |
-| `action.tree` | Indicates whether or not an action was taken against an entire process tree | None |
-| `message` | Result message | None |
-| `process` | Dictionary representing process information | None |
-| `process.entity_id` | Entity id of actionable process | None |
-| `process.name` | Name of actionable process | None |
-| `process.pid` | pid of actionable process | None |
-| `result` | Response action result code | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `Target`
-
-### Description
-These fields contain information about a target.
-These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dll.Ext` | Object for all custom defined fields to live in. | None |
-| `dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `dll.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
-| `dll.Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
-| `dll.Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
-| `dll.Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
-| `dll.Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
-| `dll.Ext.malware_classification.identifier` | The model's unique identifier. | None |
-| `dll.Ext.malware_classification.score` | The score produced by the classification model. | None |
-| `dll.Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
-| `dll.Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
-| `dll.Ext.malware_classification.version` | The version of the model used. | None |
-| `dll.Ext.mapped_address` | The base address where this module is loaded. | None |
-| `dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
-| `dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `dll.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `dll.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `dll.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `dll.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `dll.hash.md5` | MD5 hash. | None |
-| `dll.hash.sha1` | SHA1 hash. | None |
-| `dll.hash.sha256` | SHA256 hash. | None |
-| `dll.hash.sha512` | SHA512 hash. | None |
-| `dll.name` | Name of the library.
-This generally maps to the name of the file on disk. | kernel32.dll |
-| `dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
-| `dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `process.Ext` | Object for all custom defined fields to live in. | None |
-| `process.Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
-| `process.Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
-| `process.Ext.authentication_id` | Process authentication ID | None |
-| `process.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `process.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `process.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `process.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `process.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `process.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `process.Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
-| `process.Ext.dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `process.Ext.dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `process.Ext.dll.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `process.Ext.dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `process.Ext.dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `process.Ext.dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `process.Ext.dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
-| `process.Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
-| `process.Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
-| `process.Ext.dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `process.Ext.dll.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `process.Ext.dll.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `process.Ext.dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `process.Ext.dll.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `process.Ext.dll.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `process.Ext.dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `process.Ext.dll.hash.md5` | MD5 hash. | None |
-| `process.Ext.dll.hash.sha1` | SHA1 hash. | None |
-| `process.Ext.dll.hash.sha256` | SHA256 hash. | None |
-| `process.Ext.dll.hash.sha512` | SHA512 hash. | None |
-| `process.Ext.dll.name` | Name of the library.
-This generally maps to the name of the file on disk. | kernel32.dll |
-| `process.Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
-| `process.Ext.dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `process.Ext.dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `process.Ext.dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `process.Ext.dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `process.Ext.dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `process.Ext.dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `process.Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
-| `process.Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
-| `process.Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
-| `process.Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
-| `process.Ext.malware_classification.identifier` | The model's unique identifier. | None |
-| `process.Ext.malware_classification.score` | The score produced by the classification model. | None |
-| `process.Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
-| `process.Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
-| `process.Ext.malware_classification.version` | The version of the model used. | None |
-| `process.Ext.memory_region.allocation_base` | Base address of the memory allocation containing the memory region. | 2431737462784 |
-| `process.Ext.memory_region.allocation_protection` | Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X". | RWX |
-| `process.Ext.memory_region.allocation_size` | Original memory size requested when the memory was allocated. | 4096 |
-| `process.Ext.memory_region.allocation_type` | The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE". | PRIVATE |
-| `process.Ext.memory_region.bytes_address` | The address where bytes_compressed begins. | 2431737462784 |
-| `process.Ext.memory_region.bytes_allocation_offset` | Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base. | 0 |
-| `process.Ext.memory_region.bytes_compressed` | Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | eJzzSM3JyVcIzy/KSVEEABxJBD4= |
-| `process.Ext.memory_region.bytes_compressed_present` | Whether bytes_compressed is present in this event. | False |
-| `process.Ext.memory_region.malware_signature.all_names` | A sequence of signature names matched. | Windows.EICAR.Not-a-virus |
-| `process.Ext.memory_region.malware_signature.identifier` | malware signature identifier | None |
-| `process.Ext.memory_region.malware_signature.primary` | The first matching details. | None |
-| `process.Ext.memory_region.malware_signature.primary.matches` | The first matching details. | None |
-| `process.Ext.memory_region.malware_signature.primary.signature.hash` | hash of file matching signature. | None |
-| `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256` | sha256 hash of file matching signature. | None |
-| `process.Ext.memory_region.malware_signature.primary.signature.id` | The id of the first yara rule matched. | None |
-| `process.Ext.memory_region.malware_signature.primary.signature.name` | The name of the first yara rule matched. | None |
-| `process.Ext.memory_region.malware_signature.version` | malware signature version | None |
-| `process.Ext.memory_region.mapped_path` | If the memory corresponds to a file mapping, this is the file's path. | C:\Windows\System32\mshtml.dll |
-| `process.Ext.memory_region.mapped_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `process.Ext.memory_region.mapped_pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `process.Ext.memory_region.mapped_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `process.Ext.memory_region.mapped_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `process.Ext.memory_region.mapped_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `process.Ext.memory_region.mapped_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `process.Ext.memory_region.mapped_pe_detected` | Whether the file at mapped_path is an executable. | False |
-| `process.Ext.memory_region.memory_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `process.Ext.memory_region.memory_pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `process.Ext.memory_region.memory_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `process.Ext.memory_region.memory_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `process.Ext.memory_region.memory_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `process.Ext.memory_region.memory_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `process.Ext.memory_region.memory_pe_detected` | Whether an executable file was found in memory. | False |
-| `process.Ext.memory_region.region_base` | Base address of the memory region. | 2431737462784 |
-| `process.Ext.memory_region.region_protection` | Memory protection of the memory region. Example values include "RWX" and "R-X". | RWX |
-| `process.Ext.memory_region.region_size` | Size of the memory region. | 4096 |
-| `process.Ext.memory_region.region_start_bytes` | First 64 bytes at the region base address. | 4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000 |
-| `process.Ext.memory_region.region_state` | State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE". | COMMIT |
-| `process.Ext.memory_region.strings` | Array of strings found within the memory region. | None |
-| `process.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
-| `process.Ext.services` | Services running in this process. | None |
-| `process.Ext.session` | Session information for the current process | None |
-| `process.Ext.token.domain` | Domain of token user. | None |
-| `process.Ext.token.elevation` | Whether the token is elevated or not | None |
-| `process.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
-| `process.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
-| `process.Ext.token.integrity_level` | Numeric integrity level. | None |
-| `process.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
-| `process.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
-| `process.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
-| `process.Ext.token.privileges.description` | Description of the privilege. | None |
-| `process.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
-| `process.Ext.token.privileges.name` | Name of the privilege. | None |
-| `process.Ext.token.sid` | Token user's Security Identifier (SID). | None |
-| `process.Ext.token.type` | Type of the token, either primary or impersonation. | None |
-| `process.Ext.token.user` | Username of token owner. | None |
-| `process.Ext.user` | User associated with the running process. | None |
-| `process.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `process.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `process.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `process.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `process.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `process.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `process.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `process.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `process.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `process.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `process.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `process.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `process.exit_code` | The exit code of the process, if this is a termination event.
-The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
-| `process.hash.md5` | MD5 hash. | None |
-| `process.hash.sha1` | SHA1 hash. | None |
-| `process.hash.sha256` | SHA256 hash. | None |
-| `process.hash.sha512` | SHA512 hash. | None |
-| `process.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `process.parent.Ext` | Object for all custom defined fields to live in. | None |
-| `process.parent.Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
-| `process.parent.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `process.parent.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `process.parent.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `process.parent.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `process.parent.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `process.parent.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `process.parent.Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
-| `process.parent.Ext.dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `process.parent.Ext.dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `process.parent.Ext.dll.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `process.parent.Ext.dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `process.parent.Ext.dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `process.parent.Ext.dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `process.parent.Ext.dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
-| `process.parent.Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
-| `process.parent.Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
-| `process.parent.Ext.dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `process.parent.Ext.dll.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `process.parent.Ext.dll.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `process.parent.Ext.dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `process.parent.Ext.dll.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `process.parent.Ext.dll.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `process.parent.Ext.dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `process.parent.Ext.dll.hash.md5` | MD5 hash. | None |
-| `process.parent.Ext.dll.hash.sha1` | SHA1 hash. | None |
-| `process.parent.Ext.dll.hash.sha256` | SHA256 hash. | None |
-| `process.parent.Ext.dll.hash.sha512` | SHA512 hash. | None |
-| `process.parent.Ext.dll.name` | Name of the library.
-This generally maps to the name of the file on disk. | kernel32.dll |
-| `process.parent.Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
-| `process.parent.Ext.dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `process.parent.Ext.dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `process.parent.Ext.dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `process.parent.Ext.dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `process.parent.Ext.dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `process.parent.Ext.dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `process.parent.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
-| `process.parent.Ext.real` | The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent. | None |
-| `process.parent.Ext.real.pid` | For process.parent this will be the ppid of the process that actually spawned the current process. | None |
-| `process.parent.Ext.token.domain` | Domain of token user. | None |
-| `process.parent.Ext.token.elevation` | Whether the token is elevated or not | None |
-| `process.parent.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
-| `process.parent.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
-| `process.parent.Ext.token.integrity_level` | Numeric integrity level. | None |
-| `process.parent.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
-| `process.parent.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
-| `process.parent.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
-| `process.parent.Ext.token.privileges.description` | Description of the privilege. | None |
-| `process.parent.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
-| `process.parent.Ext.token.privileges.name` | Name of the privilege. | None |
-| `process.parent.Ext.token.sid` | Token user's Security Identifier (SID). | None |
-| `process.parent.Ext.token.type` | Type of the token, either primary or impersonation. | None |
-| `process.parent.Ext.token.user` | Username of token owner. | None |
-| `process.parent.Ext.user` | User associated with the running process. | None |
-| `process.parent.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `process.parent.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `process.parent.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `process.parent.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `process.parent.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `process.parent.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `process.parent.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `process.parent.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `process.parent.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `process.parent.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `process.parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `process.parent.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `process.parent.exit_code` | The exit code of the process, if this is a termination event.
-The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
-| `process.parent.hash.md5` | MD5 hash. | None |
-| `process.parent.hash.sha1` | SHA1 hash. | None |
-| `process.parent.hash.sha256` | SHA256 hash. | None |
-| `process.parent.hash.sha512` | SHA512 hash. | None |
-| `process.parent.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `process.parent.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `process.parent.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `process.parent.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `process.parent.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `process.parent.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `process.parent.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `process.parent.pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
-Identifier of the group of processes the process belongs to. | None |
-| `process.parent.pid` | Process id. | 4242 |
-| `process.parent.ppid` | Parent process' pid. | 4241 |
-| `process.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `process.parent.thread.id` | Thread ID. | 4242 |
-| `process.parent.thread.name` | Thread name. | thread-0 |
-| `process.parent.title` | Process title.
-The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
-| `process.parent.uptime` | Seconds the process has been up. | 1325 |
-| `process.parent.working_directory` | The working directory of the process. | /home/alice |
-| `process.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `process.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `process.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `process.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `process.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `process.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `process.pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
-Identifier of the group of processes the process belongs to. | None |
-| `process.pid` | Process id. | 4242 |
-| `process.ppid` | Parent process' pid. | 4241 |
-| `process.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `process.thread.Ext` | Object for all custom defined fields to live in. | None |
-| `process.thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
-| `process.thread.Ext.call_stack.instruction_pointer` | The return address of this stack frame. | None |
-| `process.thread.Ext.call_stack.memory_section.memory_address` | Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress` | None |
-| `process.thread.Ext.call_stack.memory_section.memory_size` | Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize` | None |
-| `process.thread.Ext.call_stack.memory_section.protection` | Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | None |
-| `process.thread.Ext.call_stack.module_name` | The name of the DLL/module containing `instruction_pointer`. | None |
-| `process.thread.Ext.call_stack.module_path` | The path to the DLL/module containing `instruction_pointer`. | None |
-| `process.thread.Ext.call_stack.rva` | The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`. | None |
-| `process.thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
-| `process.thread.Ext.call_stack_final_user_module` | The final non-win32 module in the call stack. | None |
-| `process.thread.Ext.call_stack_final_user_module.code_signature` | Code signature of the call_stack_final_user_module. | None |
-| `process.thread.Ext.call_stack_final_user_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `process.thread.Ext.call_stack_final_user_module.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `process.thread.Ext.call_stack_final_user_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `process.thread.Ext.call_stack_final_user_module.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `process.thread.Ext.call_stack_final_user_module.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `process.thread.Ext.call_stack_final_user_module.hash` | Hashes of the call_stack_final_user_module. | None |
-| `process.thread.Ext.call_stack_final_user_module.hash.sha256` | The sha256 of the call_stack_final_user_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
-| `process.thread.Ext.call_stack_final_user_module.name` | The file name of the call_stack_final_user_module. | example.dll |
-| `process.thread.Ext.call_stack_final_user_module.path` | The file path of the call_stack_final_user_module. | C:\Program Files\Example\example.dll |
-| `process.thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
-| `process.thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
-| `process.thread.Ext.original_start_address` | When a trampoline was detected, this indicates the original content for the thread start address in memory. | 4194304 |
-| `process.thread.Ext.original_start_address_allocation_offset` | When a trampoline was detected, this indicates the offset of original_start_address from the allocation base. | 0 |
-| `process.thread.Ext.original_start_address_bytes` | When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address. | 48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc |
-| `process.thread.Ext.original_start_address_bytes_disasm` | When a trampoline was detected, this holds the disassembled code at the original thread start address. | mov rax, 0x4141414141414141\njmp rax |
-| `process.thread.Ext.original_start_address_bytes_disasm_hash` | When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed. | aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c |
-| `process.thread.Ext.original_start_address_module` | When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution. | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe |
-| `process.thread.Ext.parameter` | When a thread is created, this is the raw numerical value of its parameter. | None |
-| `process.thread.Ext.parameter_bytes_compressed` | Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | None |
-| `process.thread.Ext.parameter_bytes_compressed_present` | Whether parameter_bytes_compressed is present in this event. | None |
-| `process.thread.Ext.service` | Service associated with the thread. | VaultSvc |
-| `process.thread.Ext.start` | The time the thread started. | 2016-05-23T08:05:34.853Z |
-| `process.thread.Ext.start_address` | Memory address where the thread began execution. | 4194304 |
-| `process.thread.Ext.start_address_allocation_offset` | Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base. | 0 |
-| `process.thread.Ext.start_address_bytes` | A few (typically 32) raw opcode bytes at the thread start address, hex-encoded. | c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc |
-| `process.thread.Ext.start_address_bytes_disasm` | The bytes at the thread start address, disassembled into human-readable assembly code. | ret\nint3 |
-| `process.thread.Ext.start_address_bytes_disasm_hash` | The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed. | aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c |
-| `process.thread.Ext.start_address_module` | The dll/module where the thread began execution. | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe |
-| `process.thread.Ext.token.domain` | Domain of token user. | None |
-| `process.thread.Ext.token.elevation` | Whether the token is elevated or not | None |
-| `process.thread.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
-| `process.thread.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
-| `process.thread.Ext.token.integrity_level` | Numeric integrity level. | None |
-| `process.thread.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
-| `process.thread.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
-| `process.thread.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
-| `process.thread.Ext.token.privileges.description` | Description of the privilege. | None |
-| `process.thread.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
-| `process.thread.Ext.token.privileges.name` | Name of the privilege. | None |
-| `process.thread.Ext.token.sid` | Token user's Security Identifier (SID). | None |
-| `process.thread.Ext.token.type` | Type of the token, either primary or impersonation. | None |
-| `process.thread.Ext.token.user` | Username of token owner. | None |
-| `process.thread.Ext.uptime` | Seconds since thread started. | None |
-| `process.thread.id` | Thread ID. | 4242 |
-| `process.thread.name` | Thread name. | thread-0 |
-| `process.title` | Process title.
-The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
-| `process.uptime` | Seconds the process has been up. | 1325 |
-| `process.working_directory` | The working directory of the process. | /home/alice |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `ephemeral_id` | Ephemeral identifier of this agent (if one exists).
-This id normally changes across restarts, but `agent.id` does not. | 8a4f500f |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `name` | Custom name of the agent.
-This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | foo |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `cloud`
-
-### Description
-Fields related to the cloud or infrastructure the events are coming from.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `account.id` | The cloud account or organization id used to identify different entities in a multi-tenant environment.
-Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | 666777888999 |
-| `instance.name` | Instance name of the host machine. | None |
-| `project.id` | The cloud project identifier.
-Examples: Google Cloud Project id, Azure Project id. | my-project |
-| `provider` | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | aws |
-| `region` | Region in which this host, resource, or service is located. | us-east-1 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `container`
-
-### Description
-Container fields are used for meta information about the specific container that is the source of information.
-These fields help correlate data based containers from any runtime.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique container id. | None |
-| `image.name` | Name of the image the container was built on. | None |
-| `image.tag` | Container image tags. | None |
-| `name` | Container name. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `destination`
-
-### Description
-Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-| `ip` | IP address of the destination (IPv4 or IPv6). | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `dll`
-
-### Description
-These fields contain information about code libraries dynamically loaded into processes.
-
-Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
-* Dynamic-link library (`.dll`) commonly used on Windows
-* Shared Object (`.so`) commonly used on Unix-like operating systems
-* Dynamic library (`.dylib`) commonly used on macOS
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `Ext.compile_time` | Timestamp from when the module was compiled. | None |
-| `Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
-| `Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
-| `Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
-| `Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
-| `Ext.malware_classification.identifier` | The model's unique identifier. | None |
-| `Ext.malware_classification.score` | The score produced by the classification model. | None |
-| `Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
-| `Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
-| `Ext.malware_classification.version` | The version of the model used. | None |
-| `Ext.mapped_address` | The base address where this module is loaded. | None |
-| `Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `hash.md5` | MD5 hash. | None |
-| `hash.sha1` | SHA1 hash. | None |
-| `hash.sha256` | SHA256 hash. | None |
-| `hash.sha512` | SHA512 hash. | None |
-| `name` | Name of the library.
-This generally maps to the name of the file on disk. | kernel32.dll |
-| `path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
-| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `dns`
-
-### Description
-Fields describing DNS queries and answers.
-DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `question.name` | The name being queried.
-If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | www.example.com |
-| `question.type` | The type of record being queried. | AAAA |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `elastic`
-
-### Description
-Holds fields and properties of data points and concepts in the elastic domain or namespace.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `agent` | The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host. | None |
-| `agent.id` | Unique identifier of this elastic agent (if one exists). | c2a9093e-e289-4c0a-aa44-8c32a414fa7a |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `risk_score` | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | None |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `file`
-
-### Description
-A file is defined as a set of information that has been created on, or has existed on a filesystem.
-File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `Ext.entry_modified` | Time of last status change.  See `st_ctim` member of `struct stat`. | None |
-| `Ext.macro.code_page` | Identifies the character encoding used for this macro.  https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers | None |
-| `Ext.macro.collection` | Object containing hashes for the macro collection. | None |
-| `Ext.macro.collection.hash.md5` | MD5 hash. | None |
-| `Ext.macro.collection.hash.sha1` | SHA1 hash. | None |
-| `Ext.macro.collection.hash.sha256` | SHA256 hash. | None |
-| `Ext.macro.collection.hash.sha512` | SHA512 hash. | None |
-| `Ext.macro.errors` | Errors that occurred when parsing this document file. | None |
-| `Ext.macro.errors.count` | Number of times this error that occurred. | None |
-| `Ext.macro.errors.error_type` | The type of parsing error that occurred. | None |
-| `Ext.macro.file_extension` | The extension of the file containing this macro (e.g. .docm) | None |
-| `Ext.macro.project_file` | Metadata about the corresponding VBA project file | None |
-| `Ext.macro.project_file.hash.md5` | MD5 hash. | None |
-| `Ext.macro.project_file.hash.sha1` | SHA1 hash. | None |
-| `Ext.macro.project_file.hash.sha256` | SHA256 hash. | None |
-| `Ext.macro.project_file.hash.sha512` | SHA512 hash. | None |
-| `Ext.macro.stream` | Streams associated with the document. | None |
-| `Ext.macro.stream.hash.md5` | MD5 hash. | None |
-| `Ext.macro.stream.hash.sha1` | SHA1 hash. | None |
-| `Ext.macro.stream.hash.sha256` | SHA256 hash. | None |
-| `Ext.macro.stream.hash.sha512` | SHA512 hash. | None |
-| `Ext.macro.stream.name` | Name of the stream. | None |
-| `Ext.macro.stream.raw_code` | First 100KB of raw stream binary.  Can be useful to analyze false positives and malicious payloads. | None |
-| `Ext.macro.stream.raw_code_size` | The original stream size.  Indicates whether stream.raw_code was truncated. | None |
-| `Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
-| `Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
-| `Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
-| `Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
-| `Ext.malware_classification.identifier` | The model's unique identifier. | None |
-| `Ext.malware_classification.score` | The score produced by the classification model. | None |
-| `Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
-| `Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
-| `Ext.malware_classification.version` | The version of the model used. | None |
-| `Ext.original` | Original file information during a modification event. | None |
-| `Ext.original.gid` | Primary group ID (GID) of the file. | 1001 |
-| `Ext.original.group` | Primary group name of the file. | alice |
-| `Ext.original.mode` | Original file mode prior to a modification event | None |
-| `Ext.original.name` | Original file name prior to a modification event | None |
-| `Ext.original.owner` | File owner's username. | alice |
-| `Ext.original.path` | Original file path prior to a modification event | None |
-| `Ext.original.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
-| `Ext.quarantine_message` | Message describing quarantine results. | None |
-| `Ext.quarantine_path` | Path on endpoint the quarantined file was originally. | None |
-| `Ext.quarantine_result` | Boolean representing whether or not file quarantine succeeded. | None |
-| `Ext.temp_file_path` | Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable. | None |
-| `Ext.windows` | Platform-specific Windows fields | None |
-| `Ext.windows.zone_identifier` | Windows zone identifier for a file | None |
-| `accessed` | Last time the file was accessed.
-Note that not all filesystems keep track of access time. | None |
-| `attributes` | Array of file attributes.
-Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | ["readonly", "system"] |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `created` | File creation time.
-Note that not all filesystems store the creation time. | None |
-| `ctime` | Last time the file attributes or metadata changed.
-Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | None |
-| `device` | Device that is the source of the file. | sda |
-| `directory` | Directory where the file is located. It should include the drive letter, when appropriate. | /home/alice |
-| `drive_letter` | Drive letter where the file is located. This field is only relevant on Windows.
-The value should be uppercase, and not include the colon. | C |
-| `extension` | File extension, excluding the leading dot.
-Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
-| `gid` | Primary group ID (GID) of the file. | 1001 |
-| `group` | Primary group name of the file. | alice |
-| `hash.md5` | MD5 hash. | None |
-| `hash.sha1` | SHA1 hash. | None |
-| `hash.sha256` | SHA256 hash. | None |
-| `hash.sha512` | SHA512 hash. | None |
-| `inode` | Inode representing the file in the filesystem. | 256383 |
-| `mime_type` | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | None |
-| `mode` | Mode of the file in octal representation. | 0640 |
-| `mtime` | Last time the file content was modified. | None |
-| `name` | Name of the file including the extension, without the directory. | example.png |
-| `owner` | File owner's username. | alice |
-| `path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
-| `pe.Ext.dotnet` | Whether this file is a .NET PE | true |
-| `pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
-| `pe.Ext.sections.hash.md5` | MD5 hash. | None |
-| `pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
-| `pe.Ext.sections.name` | The section's name | .reloc |
-| `pe.Ext.streams` | The file's streams, if it is a PE | None |
-| `pe.Ext.streams.hash.md5` | MD5 hash. | None |
-| `pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
-| `pe.Ext.streams.name` | The stream's name | .reloc |
-| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `size` | File size in bytes.
-Only relevant when `file.type` is "file". | 16384 |
-| `target_path` | Target path for symlinks. | None |
-| `type` | File type (file, dir, or symlink). | file |
-| `uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `group`
-
-### Description
-The group fields are meant to represent groups that are relevant to the event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | Group info prior to any setgid operations. | None |
-| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `Ext.real.name` | Name of the group. | None |
-| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `id` | Unique identifier for the group on the system/platform. | None |
-| `name` | Name of the group. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `boot.id` | Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container. | 88a1f0ed-5ae5-41ee-af6b-41921c311872 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `pid_ns_ino` | This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. | 256383 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-| `user.Ext` | Object for all custom defined fields to live in. | None |
-| `user.Ext.real` | User info prior to any setuid operations. | None |
-| `user.Ext.real.id` | One or multiple unique identifiers of the user. | None |
-| `user.Ext.real.name` | Short name or login of the user. | None |
-| `user.domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `user.email` | User email address. | None |
-| `user.full_name` | User's full name, if available. | Albert Einstein |
-| `user.group.Ext` | Object for all custom defined fields to live in. | None |
-| `user.group.Ext.real` | Group info prior to any setgid operations. | None |
-| `user.group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `user.group.Ext.real.name` | Name of the group. | None |
-| `user.group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `user.group.id` | Unique identifier for the group on the system/platform. | None |
-| `user.group.name` | Name of the group. | None |
-| `user.hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `user.name` | Short name or login of the user. | a.einstein |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `orchestrator`
-
-### Description
-Fields that describe the resources which container orchestrators manage or act upon.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `cluster.name` | Name of the cluster. | None |
-| `namespace` | Namespace in which the action is taking place. | kube-system |
-| `resource.name` | Name of the resource being acted upon. | test-pod-cdcws |
-| `resource.type` | Type of resource being acted upon. | service |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `process`
-
-### Description
-These fields contain information about a process.
-These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
-| `Ext.api.behaviors` | A list of observed behaviors.
-  "cross-process" - the observed activity was between two processes
-  "parent-child" - the observed activity was between a parent process and its child
-  "native_api" - a call was made directly to the Native API rather than the Win32 API
-  "direct_syscall" - a syscall instruction originated outside of the Native API layer
-  "proxy_call" - the call stack may indicate of a proxied API call to mask the true source
-  "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API
-  "shellcode" - suspicious executable non-image memory is calling a sensitive API
-  "image_hooked" - an entry in the callstack appears to have been hooked
-  "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function
-  "image_rop" - no call instruction preceded an entry in the call stack
-  "image_rwx" - an entry in the callstack is writable
-  "unbacked_rwx" - an entry in the callstack is non-image and writable
-  "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load
-  "allocate_shellcode" - a region of non-image executable memory allocated more executable memory
-  "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating
-  "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating
-  "hook_api" - a change to the memory protection of a small executable image memory region was made
-  "hollow_image" - a change to the memory protection of a large executable image memory region was made
-  "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made
-  "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made
-  "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD
-  "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS
-  "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control
-  "hardware_breakpoint_set" - a hardware breakpoint was set
-  "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed
-  "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed
-  "pid_spoofing" - The acting process details may have been spoofed to hide the true origin
-  "legacy_api" - a deprecated or superseded API was called | [ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ] |
-| `Ext.api.name` | The name of the API, usually the name of the function or system call. | VirtualAlloc |
-| `Ext.api.summary` | The summary of the API call and its parameters. | VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX ) |
-| `Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
-| `Ext.authentication_id` | Process authentication ID | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `Ext.created_suspended` | A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls. | true |
-| `Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.dll.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `Ext.dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
-| `Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
-| `Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
-| `Ext.dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.dll.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `Ext.dll.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.dll.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `Ext.dll.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `Ext.dll.hash.md5` | MD5 hash. | None |
-| `Ext.dll.hash.sha1` | SHA1 hash. | None |
-| `Ext.dll.hash.sha256` | SHA256 hash. | None |
-| `Ext.dll.hash.sha512` | SHA512 hash. | None |
-| `Ext.dll.name` | Name of the library.
-This generally maps to the name of the file on disk. | kernel32.dll |
-| `Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
-| `Ext.dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `Ext.dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `Ext.dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `Ext.dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `Ext.dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `Ext.dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `Ext.malware_classification.features` | Intermediate field included by adding option with subset | None |
-| `Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
-| `Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
-| `Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
-| `Ext.malware_classification.identifier` | The model's unique identifier. | None |
-| `Ext.malware_classification.score` | The score produced by the classification model. | None |
-| `Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
-| `Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
-| `Ext.malware_classification.version` | The version of the model used. | None |
-| `Ext.memory_region.allocation_base` | Base address of the memory allocation containing the memory region. | 2431737462784 |
-| `Ext.memory_region.allocation_protection` | Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X". | RWX |
-| `Ext.memory_region.allocation_size` | Original memory size requested when the memory was allocated. | 4096 |
-| `Ext.memory_region.allocation_type` | The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE". | PRIVATE |
-| `Ext.memory_region.bytes_address` | The address where bytes_compressed begins. | 2431737462784 |
-| `Ext.memory_region.bytes_allocation_offset` | Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base. | 0 |
-| `Ext.memory_region.bytes_compressed` | Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | eJzzSM3JyVcIzy/KSVEEABxJBD4= |
-| `Ext.memory_region.bytes_compressed_present` | Whether bytes_compressed is present in this event. | False |
-| `Ext.memory_region.malware_signature.all_names` | A sequence of signature names matched. | Windows.EICAR.Not-a-virus |
-| `Ext.memory_region.malware_signature.identifier` | malware signature identifier | None |
-| `Ext.memory_region.malware_signature.primary` | The first matching details. | None |
-| `Ext.memory_region.malware_signature.primary.matches` | The first matching details. | None |
-| `Ext.memory_region.malware_signature.primary.signature.hash` | hash of file matching signature. | None |
-| `Ext.memory_region.malware_signature.primary.signature.hash.sha256` | sha256 hash of file matching signature. | None |
-| `Ext.memory_region.malware_signature.primary.signature.id` | The id of the first yara rule matched. | None |
-| `Ext.memory_region.malware_signature.primary.signature.name` | The name of the first yara rule matched. | None |
-| `Ext.memory_region.malware_signature.version` | malware signature version | None |
-| `Ext.memory_region.mapped_path` | If the memory corresponds to a file mapping, this is the file's path. | C:\Windows\System32\mshtml.dll |
-| `Ext.memory_region.mapped_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `Ext.memory_region.mapped_pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `Ext.memory_region.mapped_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `Ext.memory_region.mapped_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `Ext.memory_region.mapped_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `Ext.memory_region.mapped_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `Ext.memory_region.mapped_pe_detected` | Whether the file at mapped_path is an executable. | False |
-| `Ext.memory_region.memory_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `Ext.memory_region.memory_pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `Ext.memory_region.memory_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `Ext.memory_region.memory_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `Ext.memory_region.memory_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `Ext.memory_region.memory_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `Ext.memory_region.memory_pe_detected` | Whether an executable file was found in memory. | False |
-| `Ext.memory_region.region_base` | Base address of the memory region. | 2431737462784 |
-| `Ext.memory_region.region_protection` | Memory protection of the memory region. Example values include "RWX" and "R-X". | RWX |
-| `Ext.memory_region.region_size` | Size of the memory region. | 4096 |
-| `Ext.memory_region.region_start_bytes` | First 64 bytes at the region base address. | 4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000 |
-| `Ext.memory_region.region_state` | State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE". | COMMIT |
-| `Ext.memory_region.strings` | Array of strings found within the memory region. | None |
-| `Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
-| `Ext.services` | Services running in this process. | None |
-| `Ext.session` | Session information for the current process | None |
-| `Ext.token.domain` | Domain of token user. | None |
-| `Ext.token.elevation` | Whether the token is elevated or not | None |
-| `Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
-| `Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
-| `Ext.token.integrity_level` | Numeric integrity level. | None |
-| `Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
-| `Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
-| `Ext.token.privileges` | Array describing the privileges associated with the token. | None |
-| `Ext.token.privileges.description` | Description of the privilege. | None |
-| `Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
-| `Ext.token.privileges.name` | Name of the privilege. | None |
-| `Ext.token.sid` | Token user's Security Identifier (SID). | None |
-| `Ext.token.type` | Type of the token, either primary or impersonation. | None |
-| `Ext.token.user` | Username of token owner. | None |
-| `Ext.user` | User associated with the running process. | None |
-| `args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `entry_leader.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `entry_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `entry_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.entry_meta.source.ip` | IP address of the source (IPv4 or IPv6). | None |
-| `entry_leader.entry_meta.type` | The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console
-Note: This field is only set on process.session_leader. | None |
-| `entry_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `entry_leader.group.id` | Unique identifier for the group on the system/platform. | None |
-| `entry_leader.group.name` | Name of the group. | None |
-| `entry_leader.interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `entry_leader.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `entry_leader.parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.parent.pid` | Process id. | 4242 |
-| `entry_leader.parent.session_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.parent.session_leader.pid` | Process id. | 4242 |
-| `entry_leader.parent.session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `entry_leader.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `entry_leader.pid` | Process id. | 4242 |
-| `entry_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `entry_leader.real_group.name` | Name of the group. | None |
-| `entry_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `entry_leader.real_user.name` | Short name or login of the user. | a.einstein |
-| `entry_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
-For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
-This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
-Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
-Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
-| `entry_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `entry_leader.saved_group.name` | Name of the group. | None |
-| `entry_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `entry_leader.saved_user.name` | Short name or login of the user. | a.einstein |
-| `entry_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `entry_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `entry_leader.supplemental_groups.name` | Name of the group. | None |
-| `entry_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `entry_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `entry_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `entry_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `entry_leader.user.name` | Short name or login of the user. | a.einstein |
-| `entry_leader.working_directory` | The working directory of the process. | /home/alice |
-| `env_vars` | Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.
-May be filtered to protect sensitive information. | ["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"] |
-| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `exit_code` | The exit code of the process, if this is a termination event.
-The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
-| `group_leader.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `group_leader.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `group_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `group_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `group_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `group_leader.group.id` | Unique identifier for the group on the system/platform. | None |
-| `group_leader.group.name` | Name of the group. | None |
-| `group_leader.interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `group_leader.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `group_leader.pid` | Process id. | 4242 |
-| `group_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `group_leader.real_group.name` | Name of the group. | None |
-| `group_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `group_leader.real_user.name` | Short name or login of the user. | a.einstein |
-| `group_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
-For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
-This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
-Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
-Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
-| `group_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `group_leader.saved_group.name` | Name of the group. | None |
-| `group_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `group_leader.saved_user.name` | Short name or login of the user. | a.einstein |
-| `group_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `group_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `group_leader.supplemental_groups.name` | Name of the group. | None |
-| `group_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `group_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `group_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `group_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `group_leader.user.name` | Short name or login of the user. | a.einstein |
-| `group_leader.working_directory` | The working directory of the process. | /home/alice |
-| `hash.md5` | MD5 hash. | None |
-| `hash.sha1` | SHA1 hash. | None |
-| `hash.sha256` | SHA256 hash. | None |
-| `hash.sha512` | SHA512 hash. | None |
-| `interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `parent.Ext` | Object for all custom defined fields to live in. | None |
-| `parent.Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
-| `parent.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `parent.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `parent.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `parent.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `parent.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `parent.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `parent.Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
-| `parent.Ext.dll.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `parent.Ext.dll.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `parent.Ext.dll.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `parent.Ext.dll.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `parent.Ext.dll.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `parent.Ext.dll.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `parent.Ext.dll.Ext.compile_time` | Timestamp from when the module was compiled. | None |
-| `parent.Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
-| `parent.Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
-| `parent.Ext.dll.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `parent.Ext.dll.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `parent.Ext.dll.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `parent.Ext.dll.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `parent.Ext.dll.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `parent.Ext.dll.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `parent.Ext.dll.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `parent.Ext.dll.hash.md5` | MD5 hash. | None |
-| `parent.Ext.dll.hash.sha1` | SHA1 hash. | None |
-| `parent.Ext.dll.hash.sha256` | SHA256 hash. | None |
-| `parent.Ext.dll.hash.sha512` | SHA512 hash. | None |
-| `parent.Ext.dll.name` | Name of the library.
-This generally maps to the name of the file on disk. | kernel32.dll |
-| `parent.Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
-| `parent.Ext.dll.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `parent.Ext.dll.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `parent.Ext.dll.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `parent.Ext.dll.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `parent.Ext.dll.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `parent.Ext.dll.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `parent.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
-| `parent.Ext.real` | The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent. | None |
-| `parent.Ext.real.pid` | For process.parent this will be the ppid of the process that actually spawned the current process. | None |
-| `parent.Ext.token.domain` | Domain of token user. | None |
-| `parent.Ext.token.elevation` | Whether the token is elevated or not | None |
-| `parent.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
-| `parent.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
-| `parent.Ext.token.integrity_level` | Numeric integrity level. | None |
-| `parent.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
-| `parent.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
-| `parent.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
-| `parent.Ext.token.privileges.description` | Description of the privilege. | None |
-| `parent.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
-| `parent.Ext.token.privileges.name` | Name of the privilege. | None |
-| `parent.Ext.token.sid` | Token user's Security Identifier (SID). | None |
-| `parent.Ext.token.type` | Type of the token, either primary or impersonation. | None |
-| `parent.Ext.token.user` | Username of token owner. | None |
-| `parent.Ext.user` | User associated with the running process. | None |
-| `parent.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `parent.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `parent.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `parent.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `parent.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `parent.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `parent.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `parent.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `parent.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `parent.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `parent.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `parent.exit_code` | The exit code of the process, if this is a termination event.
-The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
-| `parent.group.id` | Unique identifier for the group on the system/platform. | None |
-| `parent.group.name` | Name of the group. | None |
-| `parent.group_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `parent.group_leader.pid` | Process id. | 4242 |
-| `parent.group_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `parent.hash.md5` | MD5 hash. | None |
-| `parent.hash.sha1` | SHA1 hash. | None |
-| `parent.hash.sha256` | SHA256 hash. | None |
-| `parent.hash.sha512` | SHA512 hash. | None |
-| `parent.interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `parent.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `parent.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `parent.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `parent.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `parent.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `parent.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `parent.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `parent.pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
-Identifier of the group of processes the process belongs to. | None |
-| `parent.pid` | Process id. | 4242 |
-| `parent.ppid` | Parent process' pid. | 4241 |
-| `parent.real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `parent.real_group.name` | Name of the group. | None |
-| `parent.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `parent.real_user.name` | Short name or login of the user. | a.einstein |
-| `parent.saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `parent.saved_group.name` | Name of the group. | None |
-| `parent.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `parent.saved_user.name` | Short name or login of the user. | a.einstein |
-| `parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `parent.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `parent.supplemental_groups.name` | Name of the group. | None |
-| `parent.thread.id` | Thread ID. | 4242 |
-| `parent.thread.name` | Thread name. | thread-0 |
-| `parent.title` | Process title.
-The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
-| `parent.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `parent.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `parent.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `parent.uptime` | Seconds the process has been up. | 1325 |
-| `parent.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `parent.user.name` | Short name or login of the user. | a.einstein |
-| `parent.working_directory` | The working directory of the process. | /home/alice |
-| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
-Identifier of the group of processes the process belongs to. | None |
-| `pid` | Process id. | 4242 |
-| `ppid` | Parent process' pid. | 4241 |
-| `previous.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `previous.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `previous.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `real_group.name` | Name of the group. | None |
-| `real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `real_user.name` | Short name or login of the user. | a.einstein |
-| `saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `saved_group.name` | Name of the group. | None |
-| `saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `saved_user.name` | Short name or login of the user. | a.einstein |
-| `session_leader.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `session_leader.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `session_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `session_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `session_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `session_leader.group.id` | Unique identifier for the group on the system/platform. | None |
-| `session_leader.group.name` | Name of the group. | None |
-| `session_leader.interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `session_leader.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `session_leader.parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `session_leader.parent.pid` | Process id. | 4242 |
-| `session_leader.parent.session_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `session_leader.parent.session_leader.pid` | Process id. | 4242 |
-| `session_leader.parent.session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `session_leader.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `session_leader.pid` | Process id. | 4242 |
-| `session_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `session_leader.real_group.name` | Name of the group. | None |
-| `session_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `session_leader.real_user.name` | Short name or login of the user. | a.einstein |
-| `session_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
-For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
-This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
-Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
-Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
-| `session_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `session_leader.saved_group.name` | Name of the group. | None |
-| `session_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `session_leader.saved_user.name` | Short name or login of the user. | a.einstein |
-| `session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `session_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `session_leader.supplemental_groups.name` | Name of the group. | None |
-| `session_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `session_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `session_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `session_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `session_leader.user.name` | Short name or login of the user. | a.einstein |
-| `session_leader.working_directory` | The working directory of the process. | /home/alice |
-| `start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `supplemental_groups.name` | Name of the group. | None |
-| `thread.Ext` | Object for all custom defined fields to live in. | None |
-| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
-| `thread.Ext.call_stack.instruction_pointer` | The return address of this stack frame. | None |
-| `thread.Ext.call_stack.memory_section.memory_address` | Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress` | None |
-| `thread.Ext.call_stack.memory_section.memory_size` | Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize` | None |
-| `thread.Ext.call_stack.memory_section.protection` | Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | None |
-| `thread.Ext.call_stack.module_name` | The name of the DLL/module containing `instruction_pointer`. | None |
-| `thread.Ext.call_stack.module_path` | The path to the DLL/module containing `instruction_pointer`. | None |
-| `thread.Ext.call_stack.rva` | The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`. | None |
-| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
-| `thread.Ext.call_stack_final_hook_module` | The module that installed the final API hook in the call stack. | None |
-| `thread.Ext.call_stack_final_hook_module.code_signature` | Code signature of the call_stack_final_hook_module. | None |
-| `thread.Ext.call_stack_final_hook_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `thread.Ext.call_stack_final_hook_module.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `thread.Ext.call_stack_final_hook_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `thread.Ext.call_stack_final_hook_module.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `thread.Ext.call_stack_final_hook_module.hash` | Hashes of the call_stack_final_hook_module. | None |
-| `thread.Ext.call_stack_final_hook_module.hash.sha256` | The sha256 of the call_stack_final_hook_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
-| `thread.Ext.call_stack_final_hook_module.path` | The file path of the call_stack_final_hook_module. | C:\Program Files\Example\example.dll |
-| `thread.Ext.call_stack_final_user_module` | The final non-win32 module in the call stack. | None |
-| `thread.Ext.call_stack_final_user_module.code_signature` | Code signature of the call_stack_final_user_module. | None |
-| `thread.Ext.call_stack_final_user_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `thread.Ext.call_stack_final_user_module.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `thread.Ext.call_stack_final_user_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `thread.Ext.call_stack_final_user_module.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `thread.Ext.call_stack_final_user_module.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `thread.Ext.call_stack_final_user_module.hash` | Hashes of the call_stack_final_user_module. | None |
-| `thread.Ext.call_stack_final_user_module.hash.sha256` | The sha256 of the call_stack_final_user_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
-| `thread.Ext.call_stack_final_user_module.name` | The file name of the call_stack_final_user_module. | example.dll |
-| `thread.Ext.call_stack_final_user_module.path` | The file path of the call_stack_final_user_module. | C:\Program Files\Example\example.dll |
-| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
-| `thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
-| `thread.Ext.original_start_address` | When a trampoline was detected, this indicates the original content for the thread start address in memory. | 4194304 |
-| `thread.Ext.original_start_address_allocation_offset` | When a trampoline was detected, this indicates the offset of original_start_address from the allocation base. | 0 |
-| `thread.Ext.original_start_address_bytes` | When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address. | 48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc |
-| `thread.Ext.original_start_address_bytes_disasm` | When a trampoline was detected, this holds the disassembled code at the original thread start address. | mov rax, 0x4141414141414141\njmp rax |
-| `thread.Ext.original_start_address_bytes_disasm_hash` | When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed. | aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c |
-| `thread.Ext.original_start_address_module` | When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution. | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe |
-| `thread.Ext.parameter` | When a thread is created, this is the raw numerical value of its parameter. | None |
-| `thread.Ext.parameter_bytes_compressed` | Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | None |
-| `thread.Ext.parameter_bytes_compressed_present` | Whether parameter_bytes_compressed is present in this event. | None |
-| `thread.Ext.service` | Service associated with the thread. | VaultSvc |
-| `thread.Ext.start` | The time the thread started. | 2016-05-23T08:05:34.853Z |
-| `thread.Ext.start_address` | Memory address where the thread began execution. | 4194304 |
-| `thread.Ext.start_address_allocation_offset` | Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base. | 0 |
-| `thread.Ext.start_address_bytes` | A few (typically 32) raw opcode bytes at the thread start address, hex-encoded. | c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc |
-| `thread.Ext.start_address_bytes_disasm` | The bytes at the thread start address, disassembled into human-readable assembly code. | ret\nint3 |
-| `thread.Ext.start_address_bytes_disasm_hash` | The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed. | aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c |
-| `thread.Ext.start_address_module` | The dll/module where the thread began execution. | C:\Program Files\VMware\VMware Tools\vmtoolsd.exe |
-| `thread.Ext.token.domain` | Domain of token user. | None |
-| `thread.Ext.token.elevation` | Whether the token is elevated or not | None |
-| `thread.Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
-| `thread.Ext.token.impersonation_level` | Impersonation level. Only valid for impersonation tokens. | None |
-| `thread.Ext.token.integrity_level` | Numeric integrity level. | None |
-| `thread.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
-| `thread.Ext.token.is_appcontainer` | Whether or not this is an appcontainer token. | None |
-| `thread.Ext.token.privileges` | Array describing the privileges associated with the token. | None |
-| `thread.Ext.token.privileges.description` | Description of the privilege. | None |
-| `thread.Ext.token.privileges.enabled` | Whether or not the privilege is enabled. | None |
-| `thread.Ext.token.privileges.name` | Name of the privilege. | None |
-| `thread.Ext.token.sid` | Token user's Security Identifier (SID). | None |
-| `thread.Ext.token.type` | Type of the token, either primary or impersonation. | None |
-| `thread.Ext.token.user` | Username of token owner. | None |
-| `thread.Ext.uptime` | Seconds since thread started. | None |
-| `thread.id` | Thread ID. | 4242 |
-| `thread.name` | Thread name. | thread-0 |
-| `title` | Process title.
-The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
-| `tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `uptime` | Seconds the process has been up. | 1325 |
-| `user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `user.name` | Short name or login of the user. | a.einstein |
-| `working_directory` | The working directory of the process. | /home/alice |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `registry`
-
-### Description
-Fields related to Windows Registry operations.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `data.strings` | Content when writing string types.
-Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | ["C:\rta\red_ttp\bin\myapp.exe"] |
-| `path` | Full path, including hive, key and value | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger |
-| `value` | Name of the value written. | Debugger |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `rule`
-
-### Description
-Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.
-Examples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `author` | Name, organization, or pseudonym of the author or authors who created the rule used to generate this event. | ["Star-Lord"] |
-| `category` | A categorization value keyword used by the entity using the rule for detection of this event. | Attempted Information Leak |
-| `description` | The description of the rule generating the event. | Block requests to public DNS over HTTPS / TLS protocols |
-| `id` | A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event. | 101 |
-| `license` | Name of the license under which the rule used to generate this event is made available. | Apache 2.0 |
-| `name` | The name of the rule or signature generating the event. | BLOCK_DNS_over_TLS |
-| `reference` | Reference URL to additional information about the rule used to generate this event.
-The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert. | https://en.wikipedia.org/wiki/DNS_over_TLS |
-| `ruleset` | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | Standard_Protocol_Filters |
-| `uuid` | A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event. | 1100110011 |
-| `version` | The version / revision of the rule being used for analysis. | 1.1 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `source`
-
-### Description
-Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-| `ip` | IP address of the source (IPv4 or IPv6). | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `threat`
-
-### Description
-Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.
-These fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. "impact"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. "endpoint denial of service").
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `enrichments` | A list of associated indicators objects enriching the event, and the context of that association/enrichment. | None |
-| `enrichments.indicator` | Object containing associated indicators enriching the event. | None |
-| `enrichments.indicator.file.Ext` | Object for all custom defined fields to live in. | None |
-| `enrichments.indicator.file.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `enrichments.indicator.file.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `enrichments.indicator.file.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `enrichments.indicator.file.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `enrichments.indicator.file.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `enrichments.indicator.file.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `enrichments.indicator.file.Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
-| `enrichments.indicator.file.Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
-| `enrichments.indicator.file.Ext.device.file_system_type` | Volume device file system type.
-Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
-| `enrichments.indicator.file.Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
-| `enrichments.indicator.file.Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
-| `enrichments.indicator.file.Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
-| `enrichments.indicator.file.Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
-| `enrichments.indicator.file.Ext.device.volume_device_type` | Volume device type.
-Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
-| `enrichments.indicator.file.Ext.entropy` | Entropy calculation of file's header and footer used to check file integrity. | None |
-| `enrichments.indicator.file.Ext.entry_modified` | Time of last status change.  See `st_ctim` member of `struct stat`. | None |
-| `enrichments.indicator.file.Ext.header_bytes` | First 16 bytes of file used to check file integrity. | None |
-| `enrichments.indicator.file.Ext.header_data` | First 16 bytes of file used to check file integrity. | None |
-| `enrichments.indicator.file.Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
-| `enrichments.indicator.file.Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
-| `enrichments.indicator.file.Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
-| `enrichments.indicator.file.Ext.malware_classification.identifier` | The model's unique identifier. | None |
-| `enrichments.indicator.file.Ext.malware_classification.score` | The score produced by the classification model. | None |
-| `enrichments.indicator.file.Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
-| `enrichments.indicator.file.Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
-| `enrichments.indicator.file.Ext.malware_classification.version` | The version of the model used. | None |
-| `enrichments.indicator.file.Ext.malware_signature` | Nested version of malware_signature fieldset. | None |
-| `enrichments.indicator.file.Ext.malware_signature.all_names` | The concatenated names of all yara signatures | None |
-| `enrichments.indicator.file.Ext.malware_signature.identifier` | Malware artifact identifier. | None |
-| `enrichments.indicator.file.Ext.malware_signature.primary` | Primary malware signature match. | None |
-| `enrichments.indicator.file.Ext.malware_signature.primary.matches` | An array of bytes representing yara signature matches | None |
-| `enrichments.indicator.file.Ext.malware_signature.primary.signature` | Primary malware signature match. | None |
-| `enrichments.indicator.file.Ext.malware_signature.primary.signature.hash` | Primary malware signature hash. | None |
-| `enrichments.indicator.file.Ext.malware_signature.primary.signature.hash.sha256` | Primary malware signature sha256. | None |
-| `enrichments.indicator.file.Ext.malware_signature.primary.signature.id` | Primary malware signature id. | None |
-| `enrichments.indicator.file.Ext.malware_signature.primary.signature.name` | Primary malware signature name. | None |
-| `enrichments.indicator.file.Ext.malware_signature.secondary` | An array of malware signature matches | None |
-| `enrichments.indicator.file.Ext.malware_signature.version` | Primary malware signature version. | None |
-| `enrichments.indicator.file.Ext.monotonic_id` | File event monotonic ID. | None |
-| `enrichments.indicator.file.Ext.original` | Original file information during a modification event. | None |
-| `enrichments.indicator.file.Ext.original.gid` | Primary group ID (GID) of the file. | 1001 |
-| `enrichments.indicator.file.Ext.original.group` | Primary group name of the file. | alice |
-| `enrichments.indicator.file.Ext.original.mode` | Original file mode prior to a modification event | None |
-| `enrichments.indicator.file.Ext.original.name` | Original file name prior to a modification event | None |
-| `enrichments.indicator.file.Ext.original.owner` | File owner's username. | alice |
-| `enrichments.indicator.file.Ext.original.path` | Original file path prior to a modification event | None |
-| `enrichments.indicator.file.Ext.original.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
-| `enrichments.indicator.file.Ext.quarantine_message` | Message describing quarantine results. | None |
-| `enrichments.indicator.file.Ext.quarantine_path` | Path on endpoint the quarantined file was originally. | None |
-| `enrichments.indicator.file.Ext.quarantine_result` | Boolean representing whether or not file quarantine succeeded. | None |
-| `enrichments.indicator.file.Ext.temp_file_path` | Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable. | None |
-| `enrichments.indicator.file.Ext.windows` | Platform-specific Windows fields | None |
-| `enrichments.indicator.file.Ext.windows.zone_identifier` | Windows zone identifier for a file | None |
-| `enrichments.indicator.file.accessed` | Last time the file was accessed.
-Note that not all filesystems keep track of access time. | None |
-| `enrichments.indicator.file.attributes` | Array of file attributes.
-Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | ["readonly", "system"] |
-| `enrichments.indicator.file.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `enrichments.indicator.file.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `enrichments.indicator.file.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `enrichments.indicator.file.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `enrichments.indicator.file.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `enrichments.indicator.file.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `enrichments.indicator.file.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `enrichments.indicator.file.created` | File creation time.
-Note that not all filesystems store the creation time. | None |
-| `enrichments.indicator.file.ctime` | Last time the file attributes or metadata changed.
-Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | None |
-| `enrichments.indicator.file.device` | Device that is the source of the file. | sda |
-| `enrichments.indicator.file.directory` | Directory where the file is located. It should include the drive letter, when appropriate. | /home/alice |
-| `enrichments.indicator.file.drive_letter` | Drive letter where the file is located. This field is only relevant on Windows.
-The value should be uppercase, and not include the colon. | C |
-| `enrichments.indicator.file.elf.architecture` | Machine architecture of the ELF file. | x86-64 |
-| `enrichments.indicator.file.elf.byte_order` | Byte sequence of ELF file. | Little Endian |
-| `enrichments.indicator.file.elf.cpu_type` | CPU type of the ELF file. | Intel |
-| `enrichments.indicator.file.elf.creation_date` | Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. | None |
-| `enrichments.indicator.file.elf.exports` | List of exported element names and types. | None |
-| `enrichments.indicator.file.elf.go_import_hash` | A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
-| `enrichments.indicator.file.elf.go_imports` | List of imported Go language element names and types. | None |
-| `enrichments.indicator.file.elf.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
-| `enrichments.indicator.file.elf.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
-| `enrichments.indicator.file.elf.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
-| `enrichments.indicator.file.elf.header.abi_version` | Version of the ELF Application Binary Interface (ABI). | None |
-| `enrichments.indicator.file.elf.header.class` | Header class of the ELF file. | None |
-| `enrichments.indicator.file.elf.header.data` | Data table of the ELF header. | None |
-| `enrichments.indicator.file.elf.header.entrypoint` | Header entrypoint of the ELF file. | None |
-| `enrichments.indicator.file.elf.header.object_version` | "0x1" for original ELF files. | None |
-| `enrichments.indicator.file.elf.header.os_abi` | Application Binary Interface (ABI) of the Linux OS. | None |
-| `enrichments.indicator.file.elf.header.type` | Header type of the ELF file. | None |
-| `enrichments.indicator.file.elf.header.version` | Version of the ELF header. | None |
-| `enrichments.indicator.file.elf.import_hash` | A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-This is an ELF implementation of the Windows PE imphash. | d41d8cd98f00b204e9800998ecf8427e |
-| `enrichments.indicator.file.elf.imports` | List of imported element names and types. | None |
-| `enrichments.indicator.file.elf.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
-| `enrichments.indicator.file.elf.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
-| `enrichments.indicator.file.elf.sections` | An array containing an object for each section of the ELF file.
-The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`. | None |
-| `enrichments.indicator.file.elf.sections.chi2` | Chi-square probability distribution of the section. | None |
-| `enrichments.indicator.file.elf.sections.entropy` | Shannon entropy calculation from the section. | None |
-| `enrichments.indicator.file.elf.sections.flags` | ELF Section List flags. | None |
-| `enrichments.indicator.file.elf.sections.name` | ELF Section List name. | None |
-| `enrichments.indicator.file.elf.sections.physical_offset` | ELF Section List offset. | None |
-| `enrichments.indicator.file.elf.sections.physical_size` | ELF Section List physical size. | None |
-| `enrichments.indicator.file.elf.sections.type` | ELF Section List type. | None |
-| `enrichments.indicator.file.elf.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
-| `enrichments.indicator.file.elf.sections.virtual_address` | ELF Section List virtual address. | None |
-| `enrichments.indicator.file.elf.sections.virtual_size` | ELF Section List virtual size. | None |
-| `enrichments.indicator.file.elf.segments` | An array containing an object for each segment of the ELF file.
-The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`. | None |
-| `enrichments.indicator.file.elf.segments.sections` | ELF object segment sections. | None |
-| `enrichments.indicator.file.elf.segments.type` | ELF object segment type. | None |
-| `enrichments.indicator.file.elf.shared_libraries` | List of shared libraries used by this ELF object. | None |
-| `enrichments.indicator.file.elf.telfhash` | telfhash symbol hash for ELF file. | None |
-| `enrichments.indicator.file.extension` | File extension, excluding the leading dot.
-Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
-| `enrichments.indicator.file.gid` | Primary group ID (GID) of the file. | 1001 |
-| `enrichments.indicator.file.group` | Primary group name of the file. | alice |
-| `enrichments.indicator.file.hash.md5` | MD5 hash. | None |
-| `enrichments.indicator.file.hash.sha1` | SHA1 hash. | None |
-| `enrichments.indicator.file.hash.sha256` | SHA256 hash. | None |
-| `enrichments.indicator.file.hash.sha512` | SHA512 hash. | None |
-| `enrichments.indicator.file.hash.ssdeep` | SSDEEP hash. | None |
-| `enrichments.indicator.file.inode` | Inode representing the file in the filesystem. | 256383 |
-| `enrichments.indicator.file.mime_type` | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | None |
-| `enrichments.indicator.file.mode` | Mode of the file in octal representation. | 0640 |
-| `enrichments.indicator.file.mtime` | Last time the file content was modified. | None |
-| `enrichments.indicator.file.name` | Name of the file including the extension, without the directory. | example.png |
-| `enrichments.indicator.file.owner` | File owner's username. | alice |
-| `enrichments.indicator.file.path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
-| `enrichments.indicator.file.pe.architecture` | CPU architecture target for the file. | x64 |
-| `enrichments.indicator.file.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `enrichments.indicator.file.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `enrichments.indicator.file.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `enrichments.indicator.file.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `enrichments.indicator.file.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `enrichments.indicator.file.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `enrichments.indicator.file.size` | File size in bytes.
-Only relevant when `file.type` is "file". | 16384 |
-| `enrichments.indicator.file.target_path` | Target path for symlinks. | None |
-| `enrichments.indicator.file.type` | File type (file, dir, or symlink). | file |
-| `enrichments.indicator.file.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
-| `enrichments.indicator.first_seen` | The date and time when intelligence source first reported sighting this indicator. | 2020-11-05T17:25:47.000Z |
-| `enrichments.indicator.geo.city_name` | City name. | Montreal |
-| `enrichments.indicator.geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `enrichments.indicator.geo.continent_name` | Name of the continent. | North America |
-| `enrichments.indicator.geo.country_iso_code` | Country ISO code. | CA |
-| `enrichments.indicator.geo.country_name` | Country name. | Canada |
-| `enrichments.indicator.geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `enrichments.indicator.geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `enrichments.indicator.geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `enrichments.indicator.geo.region_iso_code` | Region ISO code. | CA-QC |
-| `enrichments.indicator.geo.region_name` | Region name. | Quebec |
-| `enrichments.indicator.geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-| `enrichments.indicator.ip` | Identifies a threat indicator as an IP address (irrespective of direction). | 1.2.3.4 |
-| `enrichments.indicator.last_seen` | The date and time when intelligence source last reported sighting this indicator. | 2020-11-05T17:25:47.000Z |
-| `enrichments.indicator.marking.tlp` | Traffic Light Protocol sharing markings. | CLEAR |
-| `enrichments.indicator.modified_at` | The date and time when intelligence source last modified information for this indicator. | 2020-11-05T17:25:47.000Z |
-| `enrichments.indicator.port` | Identifies a threat indicator as a port number (irrespective of direction). | 443 |
-| `enrichments.indicator.provider` | The name of the indicator's provider. | lrz_urlhaus |
-| `enrichments.indicator.reference` | Reference URL linking to additional information about this indicator. | https://system.example.com/indicator/0001234 |
-| `enrichments.indicator.registry.data.bytes` | Original bytes written with base64 encoding.
-For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. | ZQBuAC0AVQBTAAAAZQBuAAAAAAA= |
-| `enrichments.indicator.registry.data.strings` | Content when writing string types.
-Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | ["C:\rta\red_ttp\bin\myapp.exe"] |
-| `enrichments.indicator.registry.data.type` | Standard registry type for encoding contents | REG_SZ |
-| `enrichments.indicator.registry.hive` | Abbreviated name for the hive. | HKLM |
-| `enrichments.indicator.registry.key` | Hive-relative path of keys. | SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe |
-| `enrichments.indicator.registry.path` | Full path, including hive, key and value | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger |
-| `enrichments.indicator.registry.value` | Name of the value written. | Debugger |
-| `enrichments.indicator.scanner_stats` | Count of AV/EDR vendors that successfully detected malicious file or URL. | 4 |
-| `enrichments.indicator.sightings` | Number of times this indicator was observed conducting threat activity. | 20 |
-| `enrichments.indicator.type` | Type of indicator as represented by Cyber Observable in STIX 2.0. | ipv4-addr |
-| `enrichments.indicator.url.domain` | Domain of the url, such as "www.elastic.co".
-In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.
-If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | www.elastic.co |
-| `enrichments.indicator.url.extension` | The field contains the file extension from the original request url, excluding the leading dot.
-The file extension is only set if it exists, as not every url has a file extension.
-The leading period must not be included. For example, the value must be "png", not ".png".
-Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
-| `enrichments.indicator.url.fragment` | Portion of the url after the `#`, such as "top".
-The `#` is not part of the fragment. | None |
-| `enrichments.indicator.url.full` | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | https://www.elastic.co:443/search?q=elasticsearch#top |
-| `enrichments.indicator.url.original` | Unmodified original url as seen in the event source.
-Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.
-This field is meant to represent the URL as it was observed, complete or not. | https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch |
-| `enrichments.indicator.url.password` | Password of the request. | None |
-| `enrichments.indicator.url.path` | Path of the request, such as "/search". | None |
-| `enrichments.indicator.url.port` | Port of the request, such as 443. | 443 |
-| `enrichments.indicator.url.query` | The query field describes the query string of the request, such as "q=elasticsearch".
-The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | None |
-| `enrichments.indicator.url.registered_domain` | The highest registered url domain, stripped of the subdomain.
-For example, the registered domain for "foo.example.com" is "example.com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
-| `enrichments.indicator.url.scheme` | Scheme of the request, such as "https".
-Note: The `:` is not part of the scheme. | https |
-| `enrichments.indicator.url.subdomain` | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
-For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | east |
-| `enrichments.indicator.url.top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
-| `enrichments.indicator.url.username` | Username of the request. | None |
-| `enrichments.indicator.x509.alternative_names` | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | *.elastic.co |
-| `enrichments.indicator.x509.issuer.common_name` | List of common name (CN) of issuing certificate authority. | Example SHA2 High Assurance Server CA |
-| `enrichments.indicator.x509.issuer.country` | List of country \(C) codes | US |
-| `enrichments.indicator.x509.issuer.distinguished_name` | Distinguished name (DN) of issuing certificate authority. | C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA |
-| `enrichments.indicator.x509.issuer.locality` | List of locality names (L) | Mountain View |
-| `enrichments.indicator.x509.issuer.organization` | List of organizations (O) of issuing certificate authority. | Example Inc |
-| `enrichments.indicator.x509.issuer.organizational_unit` | List of organizational units (OU) of issuing certificate authority. | www.example.com |
-| `enrichments.indicator.x509.issuer.state_or_province` | List of state or province names (ST, S, or P) | California |
-| `enrichments.indicator.x509.not_after` | Time at which the certificate is no longer considered valid. | 2020-07-16T03:15:39Z |
-| `enrichments.indicator.x509.not_before` | Time at which the certificate is first considered valid. | 2019-08-16T01:40:25Z |
-| `enrichments.indicator.x509.public_key_algorithm` | Algorithm used to generate the public key. | RSA |
-| `enrichments.indicator.x509.public_key_curve` | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | nistp521 |
-| `enrichments.indicator.x509.public_key_exponent` | Exponent used to derive the public key. This is algorithm specific. | 65537 |
-| `enrichments.indicator.x509.public_key_size` | The size of the public key space in bits. | 2048 |
-| `enrichments.indicator.x509.serial_number` | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | 55FBB9C7DEBF09809D12CCAA |
-| `enrichments.indicator.x509.signature_algorithm` | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | SHA256-RSA |
-| `enrichments.indicator.x509.subject.common_name` | List of common names (CN) of subject. | shared.global.example.net |
-| `enrichments.indicator.x509.subject.country` | List of country \(C) code | US |
-| `enrichments.indicator.x509.subject.distinguished_name` | Distinguished name (DN) of the certificate subject entity. | C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net |
-| `enrichments.indicator.x509.subject.locality` | List of locality names (L) | San Francisco |
-| `enrichments.indicator.x509.subject.organization` | List of organizations (O) of subject. | Example, Inc. |
-| `enrichments.indicator.x509.subject.organizational_unit` | List of organizational units (OU) of subject. | None |
-| `enrichments.indicator.x509.subject.state_or_province` | List of state or province names (ST, S, or P) | California |
-| `enrichments.indicator.x509.version_number` | Version of x509 format. | 3 |
-| `enrichments.matched.atomic` | Identifies the atomic indicator value that matched a local environment endpoint or network event. | bad-domain.com |
-| `enrichments.matched.field` | Identifies the field of the atomic indicator that matched a local environment endpoint or network event. | file.hash.sha256 |
-| `enrichments.matched.id` | Identifies the _id of the indicator document enriching the event. | ff93aee5-86a1-4a61-b0e6-0cdc313d01b5 |
-| `enrichments.matched.index` | Identifies the _index of the indicator document enriching the event. | filebeat-8.0.0-2021.05.23-000011 |
-| `enrichments.matched.type` | Identifies the type of match that caused the event to be enriched with the given indicator | indicator_match_rule |
-| `framework` | Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events. | MITRE ATT&CK |
-| `group.alias` | The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.
-While not required, you can use a MITRE ATT&CK® group alias(es). | [ "Magecart Group 6" ] |
-| `group.id` | The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.
-While not required, you can use a MITRE ATT&CK® group id. | G0037 |
-| `group.name` | The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.
-While not required, you can use a MITRE ATT&CK® group name. | FIN6 |
-| `group.reference` | The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.
-While not required, you can use a MITRE ATT&CK® group reference URL. | https://attack.mitre.org/groups/G0037/ |
-| `indicator.as.number` | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | 15169 |
-| `indicator.as.organization.name` | Organization name. | Google LLC |
-| `indicator.confidence` | Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields. | Medium |
-| `indicator.description` | Describes the type of action conducted by the threat. | IP x.x.x.x was observed delivering the Angler EK. |
-| `indicator.email.address` | Identifies a threat indicator as an email address (irrespective of direction). | phish@example.com |
-| `indicator.file.Ext` | Object for all custom defined fields to live in. | None |
-| `indicator.file.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `indicator.file.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `indicator.file.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `indicator.file.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `indicator.file.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `indicator.file.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `indicator.file.Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
-| `indicator.file.Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
-| `indicator.file.Ext.device.file_system_type` | Volume device file system type.
-Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
-| `indicator.file.Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
-| `indicator.file.Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
-| `indicator.file.Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
-| `indicator.file.Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
-| `indicator.file.Ext.device.volume_device_type` | Volume device type.
-Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
-| `indicator.file.Ext.entropy` | Entropy calculation of file's header and footer used to check file integrity. | None |
-| `indicator.file.Ext.entry_modified` | Time of last status change.  See `st_ctim` member of `struct stat`. | None |
-| `indicator.file.Ext.header_bytes` | First 16 bytes of file used to check file integrity. | None |
-| `indicator.file.Ext.header_data` | First 16 bytes of file used to check file integrity. | None |
-| `indicator.file.Ext.malware_classification.features.data.buffer` | The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded. | None |
-| `indicator.file.Ext.malware_classification.features.data.decompressed_size` | The decompressed size of buffer. | None |
-| `indicator.file.Ext.malware_classification.features.data.encoding` | The encoding of buffer (e.g. zlib). | None |
-| `indicator.file.Ext.malware_classification.identifier` | The model's unique identifier. | None |
-| `indicator.file.Ext.malware_classification.score` | The score produced by the classification model. | None |
-| `indicator.file.Ext.malware_classification.threshold` | The score threshold for the model.  Files that score above this threshold are considered malicious. | None |
-| `indicator.file.Ext.malware_classification.upx_packed` | Whether UPX packing was detected. | None |
-| `indicator.file.Ext.malware_classification.version` | The version of the model used. | None |
-| `indicator.file.Ext.malware_signature` | Nested version of malware_signature fieldset. | None |
-| `indicator.file.Ext.malware_signature.all_names` | The concatenated names of all yara signatures | None |
-| `indicator.file.Ext.malware_signature.identifier` | Malware artifact identifier. | None |
-| `indicator.file.Ext.malware_signature.primary` | Primary malware signature match. | None |
-| `indicator.file.Ext.malware_signature.primary.matches` | An array of bytes representing yara signature matches | None |
-| `indicator.file.Ext.malware_signature.primary.signature` | Primary malware signature match. | None |
-| `indicator.file.Ext.malware_signature.primary.signature.hash` | Primary malware signature hash. | None |
-| `indicator.file.Ext.malware_signature.primary.signature.hash.sha256` | Primary malware signature sha256. | None |
-| `indicator.file.Ext.malware_signature.primary.signature.id` | Primary malware signature id. | None |
-| `indicator.file.Ext.malware_signature.primary.signature.name` | Primary malware signature name. | None |
-| `indicator.file.Ext.malware_signature.secondary` | An array of malware signature matches | None |
-| `indicator.file.Ext.malware_signature.version` | Primary malware signature version. | None |
-| `indicator.file.Ext.monotonic_id` | File event monotonic ID. | None |
-| `indicator.file.Ext.original` | Original file information during a modification event. | None |
-| `indicator.file.Ext.original.gid` | Primary group ID (GID) of the file. | 1001 |
-| `indicator.file.Ext.original.group` | Primary group name of the file. | alice |
-| `indicator.file.Ext.original.mode` | Original file mode prior to a modification event | None |
-| `indicator.file.Ext.original.name` | Original file name prior to a modification event | None |
-| `indicator.file.Ext.original.owner` | File owner's username. | alice |
-| `indicator.file.Ext.original.path` | Original file path prior to a modification event | None |
-| `indicator.file.Ext.original.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
-| `indicator.file.Ext.quarantine_message` | Message describing quarantine results. | None |
-| `indicator.file.Ext.quarantine_path` | Path on endpoint the quarantined file was originally. | None |
-| `indicator.file.Ext.quarantine_result` | Boolean representing whether or not file quarantine succeeded. | None |
-| `indicator.file.Ext.temp_file_path` | Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable. | None |
-| `indicator.file.Ext.windows` | Platform-specific Windows fields | None |
-| `indicator.file.Ext.windows.zone_identifier` | Windows zone identifier for a file | None |
-| `indicator.file.accessed` | Last time the file was accessed.
-Note that not all filesystems keep track of access time. | None |
-| `indicator.file.attributes` | Array of file attributes.
-Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | ["readonly", "system"] |
-| `indicator.file.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `indicator.file.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `indicator.file.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `indicator.file.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `indicator.file.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `indicator.file.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `indicator.file.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `indicator.file.created` | File creation time.
-Note that not all filesystems store the creation time. | None |
-| `indicator.file.ctime` | Last time the file attributes or metadata changed.
-Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | None |
-| `indicator.file.device` | Device that is the source of the file. | sda |
-| `indicator.file.directory` | Directory where the file is located. It should include the drive letter, when appropriate. | /home/alice |
-| `indicator.file.drive_letter` | Drive letter where the file is located. This field is only relevant on Windows.
-The value should be uppercase, and not include the colon. | C |
-| `indicator.file.elf.architecture` | Machine architecture of the ELF file. | x86-64 |
-| `indicator.file.elf.byte_order` | Byte sequence of ELF file. | Little Endian |
-| `indicator.file.elf.cpu_type` | CPU type of the ELF file. | Intel |
-| `indicator.file.elf.creation_date` | Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators. | None |
-| `indicator.file.elf.exports` | List of exported element names and types. | None |
-| `indicator.file.elf.go_import_hash` | A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
-| `indicator.file.elf.go_imports` | List of imported Go language element names and types. | None |
-| `indicator.file.elf.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
-| `indicator.file.elf.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
-| `indicator.file.elf.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
-| `indicator.file.elf.header.abi_version` | Version of the ELF Application Binary Interface (ABI). | None |
-| `indicator.file.elf.header.class` | Header class of the ELF file. | None |
-| `indicator.file.elf.header.data` | Data table of the ELF header. | None |
-| `indicator.file.elf.header.entrypoint` | Header entrypoint of the ELF file. | None |
-| `indicator.file.elf.header.object_version` | "0x1" for original ELF files. | None |
-| `indicator.file.elf.header.os_abi` | Application Binary Interface (ABI) of the Linux OS. | None |
-| `indicator.file.elf.header.type` | Header type of the ELF file. | None |
-| `indicator.file.elf.header.version` | Version of the ELF header. | None |
-| `indicator.file.elf.import_hash` | A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-This is an ELF implementation of the Windows PE imphash. | d41d8cd98f00b204e9800998ecf8427e |
-| `indicator.file.elf.imports` | List of imported element names and types. | None |
-| `indicator.file.elf.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
-| `indicator.file.elf.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
-| `indicator.file.elf.sections` | An array containing an object for each section of the ELF file.
-The keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`. | None |
-| `indicator.file.elf.sections.chi2` | Chi-square probability distribution of the section. | None |
-| `indicator.file.elf.sections.entropy` | Shannon entropy calculation from the section. | None |
-| `indicator.file.elf.sections.flags` | ELF Section List flags. | None |
-| `indicator.file.elf.sections.name` | ELF Section List name. | None |
-| `indicator.file.elf.sections.physical_offset` | ELF Section List offset. | None |
-| `indicator.file.elf.sections.physical_size` | ELF Section List physical size. | None |
-| `indicator.file.elf.sections.type` | ELF Section List type. | None |
-| `indicator.file.elf.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
-| `indicator.file.elf.sections.virtual_address` | ELF Section List virtual address. | None |
-| `indicator.file.elf.sections.virtual_size` | ELF Section List virtual size. | None |
-| `indicator.file.elf.segments` | An array containing an object for each segment of the ELF file.
-The keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`. | None |
-| `indicator.file.elf.segments.sections` | ELF object segment sections. | None |
-| `indicator.file.elf.segments.type` | ELF object segment type. | None |
-| `indicator.file.elf.shared_libraries` | List of shared libraries used by this ELF object. | None |
-| `indicator.file.elf.telfhash` | telfhash symbol hash for ELF file. | None |
-| `indicator.file.extension` | File extension, excluding the leading dot.
-Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
-| `indicator.file.gid` | Primary group ID (GID) of the file. | 1001 |
-| `indicator.file.group` | Primary group name of the file. | alice |
-| `indicator.file.hash.md5` | MD5 hash. | None |
-| `indicator.file.hash.sha1` | SHA1 hash. | None |
-| `indicator.file.hash.sha256` | SHA256 hash. | None |
-| `indicator.file.hash.sha512` | SHA512 hash. | None |
-| `indicator.file.hash.ssdeep` | SSDEEP hash. | None |
-| `indicator.file.inode` | Inode representing the file in the filesystem. | 256383 |
-| `indicator.file.mime_type` | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | None |
-| `indicator.file.mode` | Mode of the file in octal representation. | 0640 |
-| `indicator.file.mtime` | Last time the file content was modified. | None |
-| `indicator.file.name` | Name of the file including the extension, without the directory. | example.png |
-| `indicator.file.owner` | File owner's username. | alice |
-| `indicator.file.path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
-| `indicator.file.pe.architecture` | CPU architecture target for the file. | x64 |
-| `indicator.file.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `indicator.file.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `indicator.file.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `indicator.file.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `indicator.file.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `indicator.file.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `indicator.file.size` | File size in bytes.
-Only relevant when `file.type` is "file". | 16384 |
-| `indicator.file.target_path` | Target path for symlinks. | None |
-| `indicator.file.type` | File type (file, dir, or symlink). | file |
-| `indicator.file.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
-| `indicator.first_seen` | The date and time when intelligence source first reported sighting this indicator. | 2020-11-05T17:25:47.000Z |
-| `indicator.geo.city_name` | City name. | Montreal |
-| `indicator.geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `indicator.geo.continent_name` | Name of the continent. | North America |
-| `indicator.geo.country_iso_code` | Country ISO code. | CA |
-| `indicator.geo.country_name` | Country name. | Canada |
-| `indicator.geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `indicator.geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `indicator.geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `indicator.geo.region_iso_code` | Region ISO code. | CA-QC |
-| `indicator.geo.region_name` | Region name. | Quebec |
-| `indicator.geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-| `indicator.ip` | Identifies a threat indicator as an IP address (irrespective of direction). | 1.2.3.4 |
-| `indicator.last_seen` | The date and time when intelligence source last reported sighting this indicator. | 2020-11-05T17:25:47.000Z |
-| `indicator.marking.tlp` | Traffic Light Protocol sharing markings. | CLEAR |
-| `indicator.modified_at` | The date and time when intelligence source last modified information for this indicator. | 2020-11-05T17:25:47.000Z |
-| `indicator.port` | Identifies a threat indicator as a port number (irrespective of direction). | 443 |
-| `indicator.provider` | The name of the indicator's provider. | lrz_urlhaus |
-| `indicator.reference` | Reference URL linking to additional information about this indicator. | https://system.example.com/indicator/0001234 |
-| `indicator.registry.data.bytes` | Original bytes written with base64 encoding.
-For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. | ZQBuAC0AVQBTAAAAZQBuAAAAAAA= |
-| `indicator.registry.data.strings` | Content when writing string types.
-Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | ["C:\rta\red_ttp\bin\myapp.exe"] |
-| `indicator.registry.data.type` | Standard registry type for encoding contents | REG_SZ |
-| `indicator.registry.hive` | Abbreviated name for the hive. | HKLM |
-| `indicator.registry.key` | Hive-relative path of keys. | SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe |
-| `indicator.registry.path` | Full path, including hive, key and value | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger |
-| `indicator.registry.value` | Name of the value written. | Debugger |
-| `indicator.scanner_stats` | Count of AV/EDR vendors that successfully detected malicious file or URL. | 4 |
-| `indicator.sightings` | Number of times this indicator was observed conducting threat activity. | 20 |
-| `indicator.type` | Type of indicator as represented by Cyber Observable in STIX 2.0. | ipv4-addr |
-| `indicator.url.domain` | Domain of the url, such as "www.elastic.co".
-In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.
-If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | www.elastic.co |
-| `indicator.url.extension` | The field contains the file extension from the original request url, excluding the leading dot.
-The file extension is only set if it exists, as not every url has a file extension.
-The leading period must not be included. For example, the value must be "png", not ".png".
-Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
-| `indicator.url.fragment` | Portion of the url after the `#`, such as "top".
-The `#` is not part of the fragment. | None |
-| `indicator.url.full` | If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source. | https://www.elastic.co:443/search?q=elasticsearch#top |
-| `indicator.url.original` | Unmodified original url as seen in the event source.
-Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.
-This field is meant to represent the URL as it was observed, complete or not. | https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch |
-| `indicator.url.password` | Password of the request. | None |
-| `indicator.url.path` | Path of the request, such as "/search". | None |
-| `indicator.url.port` | Port of the request, such as 443. | 443 |
-| `indicator.url.query` | The query field describes the query string of the request, such as "q=elasticsearch".
-The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | None |
-| `indicator.url.registered_domain` | The highest registered url domain, stripped of the subdomain.
-For example, the registered domain for "foo.example.com" is "example.com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
-| `indicator.url.scheme` | Scheme of the request, such as "https".
-Note: The `:` is not part of the scheme. | https |
-| `indicator.url.subdomain` | The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.
-For example the subdomain portion of "www.east.mydomain.co.uk" is "east". If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | east |
-| `indicator.url.top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
-| `indicator.url.username` | Username of the request. | None |
-| `indicator.x509.alternative_names` | List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses. | *.elastic.co |
-| `indicator.x509.issuer.common_name` | List of common name (CN) of issuing certificate authority. | Example SHA2 High Assurance Server CA |
-| `indicator.x509.issuer.country` | List of country \(C) codes | US |
-| `indicator.x509.issuer.distinguished_name` | Distinguished name (DN) of issuing certificate authority. | C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA |
-| `indicator.x509.issuer.locality` | List of locality names (L) | Mountain View |
-| `indicator.x509.issuer.organization` | List of organizations (O) of issuing certificate authority. | Example Inc |
-| `indicator.x509.issuer.organizational_unit` | List of organizational units (OU) of issuing certificate authority. | www.example.com |
-| `indicator.x509.issuer.state_or_province` | List of state or province names (ST, S, or P) | California |
-| `indicator.x509.not_after` | Time at which the certificate is no longer considered valid. | 2020-07-16T03:15:39Z |
-| `indicator.x509.not_before` | Time at which the certificate is first considered valid. | 2019-08-16T01:40:25Z |
-| `indicator.x509.public_key_algorithm` | Algorithm used to generate the public key. | RSA |
-| `indicator.x509.public_key_curve` | The curve used by the elliptic curve public key algorithm. This is algorithm specific. | nistp521 |
-| `indicator.x509.public_key_exponent` | Exponent used to derive the public key. This is algorithm specific. | 65537 |
-| `indicator.x509.public_key_size` | The size of the public key space in bits. | 2048 |
-| `indicator.x509.serial_number` | Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters. | 55FBB9C7DEBF09809D12CCAA |
-| `indicator.x509.signature_algorithm` | Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353. | SHA256-RSA |
-| `indicator.x509.subject.common_name` | List of common names (CN) of subject. | shared.global.example.net |
-| `indicator.x509.subject.country` | List of country \(C) code | US |
-| `indicator.x509.subject.distinguished_name` | Distinguished name (DN) of the certificate subject entity. | C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net |
-| `indicator.x509.subject.locality` | List of locality names (L) | San Francisco |
-| `indicator.x509.subject.organization` | List of organizations (O) of subject. | Example, Inc. |
-| `indicator.x509.subject.organizational_unit` | List of organizational units (OU) of subject. | None |
-| `indicator.x509.subject.state_or_province` | List of state or province names (ST, S, or P) | California |
-| `indicator.x509.version_number` | Version of x509 format. | 3 |
-| `software.id` | The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
-While not required, you can use a MITRE ATT&CK® software id. | S0552 |
-| `software.name` | The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
-While not required, you can use a MITRE ATT&CK® software name. | AdFind |
-| `software.platforms` | The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
-While not required, you can use MITRE ATT&CK® software platform values. | [ "Windows" ] |
-| `software.reference` | The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
-While not required, you can use a MITRE ATT&CK® software reference URL. | https://attack.mitre.org/software/S0552/ |
-| `software.type` | The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.
-While not required, you can use a MITRE ATT&CK® software type. | Tool |
-| `tactic.id` | The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | TA0002 |
-| `tactic.name` | Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/) | Execution |
-| `tactic.reference` | The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ ) | https://attack.mitre.org/tactics/TA0002/ |
-| `technique.id` | The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | T1059 |
-| `technique.name` | The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter |
-| `technique.reference` | The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/) | https://attack.mitre.org/techniques/T1059/ |
-| `technique.subtechnique.id` | The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) | T1059.001 |
-| `technique.subtechnique.name` | The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) | PowerShell |
-| `technique.subtechnique.reference` | The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/) | https://attack.mitre.org/techniques/T1059/001/ |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user`
-
-### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | User info prior to any setuid operations. | None |
-| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
-| `Ext.real.name` | Short name or login of the user. | None |
-| `domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `email` | User email address. | None |
-| `full_name` | User's full name, if available. | Albert Einstein |
-| `group.Ext` | Object for all custom defined fields to live in. | None |
-| `group.Ext.real` | Group info prior to any setgid operations. | None |
-| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `group.Ext.real.name` | Name of the group. | None |
-| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `group.id` | Unique identifier for the group on the system/platform. | None |
-| `group.name` | Name of the group. | None |
-| `hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `name` | Short name or login of the user. | a.einstein |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/api.md b/scripts/generate-docs/output/api.md
deleted file mode 100644
index b2b9ef731..000000000
--- a/scripts/generate-docs/output/api.md
+++ /dev/null
@@ -1,715 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `Target`
-
-### Description
-These fields contain information about a target.
-These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `process.Ext` | Object for all custom defined fields to live in. | None |
-| `process.Ext.created_suspended` | A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls. | true |
-| `process.Ext.memory_region.allocation_base` | Base address of the memory allocation containing the memory region. | 2431737462784 |
-| `process.Ext.memory_region.allocation_protection` | Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X". | RWX |
-| `process.Ext.memory_region.allocation_size` | Original memory size requested when the memory was allocated. | 4096 |
-| `process.Ext.memory_region.allocation_type` | The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE". | PRIVATE |
-| `process.Ext.memory_region.bytes_address` | The address where bytes_compressed begins. | 2431737462784 |
-| `process.Ext.memory_region.bytes_allocation_offset` | Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base. | 0 |
-| `process.Ext.memory_region.bytes_compressed` | Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | eJzzSM3JyVcIzy/KSVEEABxJBD4= |
-| `process.Ext.memory_region.bytes_compressed_present` | Whether bytes_compressed is present in this event. | False |
-| `process.Ext.memory_region.hash.sha256` | The sha256 of the memory region. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
-| `process.Ext.memory_region.malware_signature.all_names` | A sequence of signature names matched. | Windows.EICAR.Not-a-virus |
-| `process.Ext.memory_region.malware_signature.identifier` | malware signature identifier | None |
-| `process.Ext.memory_region.malware_signature.primary` | The first matching details. | None |
-| `process.Ext.memory_region.malware_signature.primary.matches` | The first matching details. | None |
-| `process.Ext.memory_region.malware_signature.primary.signature.hash` | hash of file matching signature. | None |
-| `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256` | sha256 hash of file matching signature. | None |
-| `process.Ext.memory_region.malware_signature.primary.signature.id` | The id of the first yara rule matched. | None |
-| `process.Ext.memory_region.malware_signature.primary.signature.name` | The name of the first yara rule matched. | None |
-| `process.Ext.memory_region.malware_signature.secondary` | Additional matching details if available. | None |
-| `process.Ext.memory_region.malware_signature.secondary.matches` | The second matching details. | None |
-| `process.Ext.memory_region.malware_signature.secondary.signature.hash` | hash of second file matching signature. | None |
-| `process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256` | sha256 hash of second file matching signature. | None |
-| `process.Ext.memory_region.malware_signature.secondary.signature.id` | The id of the second yara rule matched. | None |
-| `process.Ext.memory_region.malware_signature.secondary.signature.name` | The name of the second yara rule matched. | None |
-| `process.Ext.memory_region.malware_signature.version` | malware signature version | None |
-| `process.Ext.memory_region.mapped_path` | If the memory corresponds to a file mapping, this is the file's path. | C:\Windows\System32\mshtml.dll |
-| `process.Ext.memory_region.mapped_pe.Ext.dotnet` | Whether this file is a .NET PE | true |
-| `process.Ext.memory_region.mapped_pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
-| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5` | MD5 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1` | SHA1 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384` | SHA384 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512` | SHA512 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep` | SSDEEP hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh` | TLSH hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.sections.name` | The section's name | .reloc |
-| `process.Ext.memory_region.mapped_pe.Ext.streams` | The file's streams, if it is a PE | None |
-| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5` | MD5 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1` | SHA1 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384` | SHA384 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512` | SHA512 hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep` | SSDEEP hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh` | TLSH hash. | None |
-| `process.Ext.memory_region.mapped_pe.Ext.streams.name` | The stream's name | .reloc |
-| `process.Ext.memory_region.mapped_pe.architecture` | CPU architecture target for the file. | x64 |
-| `process.Ext.memory_region.mapped_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `process.Ext.memory_region.mapped_pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `process.Ext.memory_region.mapped_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `process.Ext.memory_region.mapped_pe.go_import_hash` | A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
-| `process.Ext.memory_region.mapped_pe.go_imports` | List of imported Go language element names and types. | None |
-| `process.Ext.memory_region.mapped_pe.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
-| `process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
-| `process.Ext.memory_region.mapped_pe.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
-| `process.Ext.memory_region.mapped_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `process.Ext.memory_region.mapped_pe.import_hash` | A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-This is a synonym for imphash. | d41d8cd98f00b204e9800998ecf8427e |
-| `process.Ext.memory_region.mapped_pe.imports` | List of imported element names and types. | None |
-| `process.Ext.memory_region.mapped_pe.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
-| `process.Ext.memory_region.mapped_pe.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
-| `process.Ext.memory_region.mapped_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `process.Ext.memory_region.mapped_pe.pehash` | A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.
-Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. | 73ff189b63cd6be375a7ff25179a38d347651975 |
-| `process.Ext.memory_region.mapped_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `process.Ext.memory_region.mapped_pe.sections` | An array containing an object for each section of the PE file.
-The keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`. | None |
-| `process.Ext.memory_region.mapped_pe.sections.entropy` | Shannon entropy calculation from the section. | None |
-| `process.Ext.memory_region.mapped_pe.sections.name` | PE Section List name. | None |
-| `process.Ext.memory_region.mapped_pe.sections.physical_size` | PE Section List physical size. | None |
-| `process.Ext.memory_region.mapped_pe.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
-| `process.Ext.memory_region.mapped_pe.sections.virtual_size` | PE Section List virtual size. This is always the same as `physical_size`. | None |
-| `process.Ext.memory_region.mapped_pe_detected` | Whether the file at mapped_path is an executable. | False |
-| `process.Ext.memory_region.memory_pe.Ext.dotnet` | Whether this file is a .NET PE | true |
-| `process.Ext.memory_region.memory_pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
-| `process.Ext.memory_region.memory_pe.Ext.sections.hash.md5` | MD5 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1` | SHA1 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384` | SHA384 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512` | SHA512 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep` | SSDEEP hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh` | TLSH hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.sections.name` | The section's name | .reloc |
-| `process.Ext.memory_region.memory_pe.Ext.streams` | The file's streams, if it is a PE | None |
-| `process.Ext.memory_region.memory_pe.Ext.streams.hash.md5` | MD5 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1` | SHA1 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384` | SHA384 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512` | SHA512 hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep` | SSDEEP hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh` | TLSH hash. | None |
-| `process.Ext.memory_region.memory_pe.Ext.streams.name` | The stream's name | .reloc |
-| `process.Ext.memory_region.memory_pe.architecture` | CPU architecture target for the file. | x64 |
-| `process.Ext.memory_region.memory_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `process.Ext.memory_region.memory_pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `process.Ext.memory_region.memory_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `process.Ext.memory_region.memory_pe.go_import_hash` | A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
-| `process.Ext.memory_region.memory_pe.go_imports` | List of imported Go language element names and types. | None |
-| `process.Ext.memory_region.memory_pe.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
-| `process.Ext.memory_region.memory_pe.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
-| `process.Ext.memory_region.memory_pe.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
-| `process.Ext.memory_region.memory_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `process.Ext.memory_region.memory_pe.import_hash` | A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-This is a synonym for imphash. | d41d8cd98f00b204e9800998ecf8427e |
-| `process.Ext.memory_region.memory_pe.imports` | List of imported element names and types. | None |
-| `process.Ext.memory_region.memory_pe.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
-| `process.Ext.memory_region.memory_pe.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
-| `process.Ext.memory_region.memory_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `process.Ext.memory_region.memory_pe.pehash` | A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.
-Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. | 73ff189b63cd6be375a7ff25179a38d347651975 |
-| `process.Ext.memory_region.memory_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `process.Ext.memory_region.memory_pe.sections` | An array containing an object for each section of the PE file.
-The keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`. | None |
-| `process.Ext.memory_region.memory_pe.sections.entropy` | Shannon entropy calculation from the section. | None |
-| `process.Ext.memory_region.memory_pe.sections.name` | PE Section List name. | None |
-| `process.Ext.memory_region.memory_pe.sections.physical_size` | PE Section List physical size. | None |
-| `process.Ext.memory_region.memory_pe.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
-| `process.Ext.memory_region.memory_pe.sections.virtual_size` | PE Section List virtual size. This is always the same as `physical_size`. | None |
-| `process.Ext.memory_region.memory_pe_detected` | Whether an executable file was found in memory. | False |
-| `process.Ext.memory_region.region_base` | Base address of the memory region. | 2431737462784 |
-| `process.Ext.memory_region.region_protection` | Memory protection of the memory region. Example values include "RWX" and "R-X". | RWX |
-| `process.Ext.memory_region.region_size` | Size of the memory region. | 4096 |
-| `process.Ext.memory_region.region_start_bytes` | First 64 bytes at the region base address. | 4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000 |
-| `process.Ext.memory_region.region_state` | State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE". | COMMIT |
-| `process.Ext.memory_region.strings` | Array of strings found within the memory region. | None |
-| `process.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
-| `process.Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
-| `process.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `process.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `process.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `process.pid` | Process id. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `destination`
-
-### Description
-Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `ip` | IP address of the destination (IPv4 or IPv6). | None |
-| `port` | Port of the destination. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `dll`
-
-### Description
-These fields contain information about code libraries dynamically loaded into processes.
-
-Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
-* Dynamic-link library (`.dll`) commonly used on Windows
-* Shared Object (`.so`) commonly used on Unix-like operating systems
-* Dynamic library (`.dylib`) commonly used on macOS
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `hash.sha256` | SHA256 hash. | None |
-| `path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `end` | `event.end` contains the date when the event ended or when the activity was last observed. | None |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `start` | `event.start` contains the date when the event started or when the activity was first observed. | None |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `network`
-
-### Description
-The network is defined as the communication path over which a host or network event happens.
-The network.* fields should be populated with details about the network activity associated with an event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `transport` | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
-The field value must be normalized to lowercase for querying. | tcp |
-| `type` | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
-The field value must be normalized to lowercase for querying. | ipv4 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `process`
-
-### Description
-These fields contain information about a process.
-These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
-| `Ext.api.behaviors` | A list of observed behaviors.
-  "cross-process" - the observed activity was between two processes
-  "parent-child" - the observed activity was between a parent process and its child
-  "native_api" - a call was made directly to the Native API rather than the Win32 API
-  "direct_syscall" - a syscall instruction originated outside of the Native API layer
-  "proxy_call" - the call stack may indicate of a proxied API call to mask the true source
-  "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API
-  "shellcode" - suspicious executable non-image memory is calling a sensitive API
-  "image_hooked" - an entry in the callstack appears to have been hooked
-  "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function
-  "image_rop" - no call instruction preceded an entry in the call stack
-  "image_rwx" - an entry in the callstack is writable
-  "unbacked_rwx" - an entry in the callstack is non-image and writable
-  "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load
-  "allocate_shellcode" - a region of non-image executable memory allocated more executable memory
-  "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating
-  "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating
-  "hook_api" - a change to the memory protection of a small executable image memory region was made
-  "hollow_image" - a change to the memory protection of a large executable image memory region was made
-  "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made
-  "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made
-  "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD
-  "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS
-  "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control
-  "hardware_breakpoint_set" - a hardware breakpoint was set
-  "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed
-  "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed
-  "pid_spoofing" - The acting process details may have been spoofed to hide the true origin
-  "legacy_api" - a deprecated or superseded API was called | [ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ] |
-| `Ext.api.metadata` | Information related to the API call. | None |
-| `Ext.api.metadata.amsi_filenames` | A list of filenames previously scanned by AMSI. | [ "C:\script.ps1" ] |
-| `Ext.api.metadata.amsi_logs` | Information related to previous AMSI scans. | None |
-| `Ext.api.metadata.amsi_logs.entries` | A subset of the AMSI content buffers scanned prior to this event. | [ "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport("kernel32.dll")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}" ] |
-| `Ext.api.metadata.amsi_logs.type` | The AMSI content type scanned prior to this event. | PowerShell |
-| `Ext.api.metadata.background_callcount` | This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call. | 6021 |
-| `Ext.api.metadata.client_is_local` | Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely. | true |
-| `Ext.api.metadata.client_machine` | Client process's machine name (provided by the client and potentially untrustworthy). | DESKTOP-EXAMPLE |
-| `Ext.api.metadata.client_machine_fqdn` | Client process's machine name FQDN (provided by the client and potentially untrustworthy). | DESKTOP-EXAMPLE.elastic.co |
-| `Ext.api.metadata.client_process_id` | Client process id | 3600 |
-| `Ext.api.metadata.ms_since_last_keyevent` | This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event. | 94 |
-| `Ext.api.metadata.procedure_symbol` | Summary of the hook procedure. | taskbar.dll |
-| `Ext.api.metadata.return_value` | Return value of RegisterRawInputDevices API call. | 1 |
-| `Ext.api.metadata.security_descriptor` | The security descriptor of the device. | O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW) |
-| `Ext.api.metadata.start_address_allocation_protection` | Memory protection attributes associated with the starting address of a thread. | RCX |
-| `Ext.api.metadata.start_address_module` | Name of the module associated with the starting address of a thread. | C:\Windows\System32\DellTPad\ApMsgFwd.exe |
-| `Ext.api.metadata.target_address_name` | The name of the memory region targeted by the API call. | Unbacked |
-| `Ext.api.metadata.target_address_path` | The path of the memory region targeted by the API call. | C:\programdata\example.dll |
-| `Ext.api.metadata.thread_info_flags` | Thread info flags. | 16 |
-| `Ext.api.metadata.visible_windows_count` | Number of visible windows owned by the caller thread. | 0 |
-| `Ext.api.metadata.windows_count` | Number of windows owned by the caller thread. | 2 |
-| `Ext.api.name` | The name of the API, usually the name of the function or system call. | VirtualAlloc |
-| `Ext.api.parameters` | Parameter values passed to the API call. | None |
-| `Ext.api.parameters.address` | The target memory address. | 2431737462784 |
-| `Ext.api.parameters.allocation_type` | The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State` | COMMIT|RESERVE |
-| `Ext.api.parameters.app_name` | The application name requesting the AMSI scan. | PowerShell |
-| `Ext.api.parameters.argument1` | The first argument to the procedure. | 1 |
-| `Ext.api.parameters.argument2` | The second argument to the procedure. | 2 |
-| `Ext.api.parameters.argument3` | The third argument to the procedure. | 3 |
-| `Ext.api.parameters.buffer` | The content associated with an AMSI scan. | [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport("kernel32.dll")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20); |
-| `Ext.api.parameters.consumer_details` | Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name. | None |
-| `Ext.api.parameters.consumer_name` | Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered. | ExampleConsumer |
-| `Ext.api.parameters.consumer_type` | An example list of consumer type.
-  "ActiveScriptEventConsumer" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.
-  "CommandLineEventConsumer" - Launches an arbitrary process in the local system context when an event is delivered to it.
-  "LogFileEventConsumer" - Writes customized strings to a text log file when events are delivered to it.
-  "NTEventLogEventConsumer" - Logs a specific message to the Windows event log when an event is delivered to it.
-  "SMTPEventConsumer" - Sends an email message using SMTP each time an event is delivered to it. | CommandLineEventConsumer |
-| `Ext.api.parameters.content_name` | The content name, typically a filename, associated with an AMSI scan. | C:\script.ps1 |
-| `Ext.api.parameters.context_flags` | The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags` | 1048607 |
-| `Ext.api.parameters.desired_access` | This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`. | None |
-| `Ext.api.parameters.desired_access_numeric` | This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`. | None |
-| `Ext.api.parameters.device` | The name of the device object. | \Device\NPCAP |
-| `Ext.api.parameters.driver` | The name of the driver object. | \Driver\npcap |
-| `Ext.api.parameters.eax` | The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall. | 0 |
-| `Ext.api.parameters.ebp` | The x86 EBP frame pointer register. | 15006644 |
-| `Ext.api.parameters.ebx` | The x86 EBX general purpose register. | 0 |
-| `Ext.api.parameters.ecx` | The x86 ECX general purpose register. First argument in __fastcall and __thiscall. | 0 |
-| `Ext.api.parameters.edi` | The x86 EDI general purpose register. | 0 |
-| `Ext.api.parameters.edx` | The x86 EDX general purpose register. Second argument in a __fastcall. | 0 |
-| `Ext.api.parameters.eip` | The x86 EIP instruction pointer register. | 1472790528 |
-| `Ext.api.parameters.esi` | The x86 ESI general purpose register. | 0 |
-| `Ext.api.parameters.esp` | The x86 ESP stack pointer register. | 15007744 |
-| `Ext.api.parameters.event_filter_details` | Provide an overview of the query that define when an event should be triggered. | None |
-| `Ext.api.parameters.event_filter_name` | Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer. | ExampleFilter |
-| `Ext.api.parameters.flags` | Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure. | INPUTSINK |
-| `Ext.api.parameters.handle_type` | This parameter indicates whether the detected access was attempt against a process or a thread. | process |
-| `Ext.api.parameters.hook_module` | DLL containing the hook procedure. | c:\windows\system32\taskbar.dll |
-| `Ext.api.parameters.hook_type` | Type of hook procedure to be installed. | WH_KEYBOARD_LL |
-| `Ext.api.parameters.io_control_code` | The I/O control code for the requested device operation. | 27365 |
-| `Ext.api.parameters.namespace` | WMI namespace to which the connection is made. | root\Microsoft\Windows\DeviceGuard |
-| `Ext.api.parameters.operation` | Specifies the connection or request to WMI | Win32_Process::Create |
-| `Ext.api.parameters.procedure` | The memory address of the procedure or function. | 2431737462784 |
-| `Ext.api.parameters.protection` | The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | RWX|GUARD |
-| `Ext.api.parameters.protection_old` | The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | RCX |
-| `Ext.api.parameters.r8` | The x64 R8 general purpose register. Third argument in a __fastcall. | 3 |
-| `Ext.api.parameters.r9` | The x64 R9 general purpose register. Fourth argument in a __fastcall. | 4 |
-| `Ext.api.parameters.rax` | The x64 RAX general purpose register. Return value in a __fastcall. | 0 |
-| `Ext.api.parameters.rbp` | The x64 RBP general purpose register. | 0 |
-| `Ext.api.parameters.rbx` | The x64 RBX general purpose register. | 0 |
-| `Ext.api.parameters.rcx` | The x64 RCX general purpose register. First argument in a __fastcall. | 1 |
-| `Ext.api.parameters.rdi` | The x64 RDI general purpose register. | 0 |
-| `Ext.api.parameters.rdx` | The x64 RDX general purpose register. Second argument in a __fastcall. | 2 |
-| `Ext.api.parameters.rip` | The x64 RIP instruction pointer register. | 140706153693184 |
-| `Ext.api.parameters.rsi` | The x64 RSI general purpose register. | 0 |
-| `Ext.api.parameters.rsp` | The x64 RSP stack pointer register. | 2431737462784 |
-| `Ext.api.parameters.size` | The size. | 4096 |
-| `Ext.api.parameters.usage` | This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure. | KEYBOARD |
-| `Ext.api.parameters.usage_page` | This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure. | GENERIC |
-| `Ext.api.summary` | The summary of the API call and its parameters. | VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX ) |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.created_suspended` | A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls. | true |
-| `Ext.memory_region.allocation_base` | Base address of the memory allocation containing the memory region. | 2431737462784 |
-| `Ext.memory_region.allocation_protection` | Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X". | RWX |
-| `Ext.memory_region.allocation_size` | Original memory size requested when the memory was allocated. | 4096 |
-| `Ext.memory_region.allocation_type` | The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE". | PRIVATE |
-| `Ext.memory_region.bytes_address` | The address where bytes_compressed begins. | 2431737462784 |
-| `Ext.memory_region.bytes_allocation_offset` | Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base. | 0 |
-| `Ext.memory_region.bytes_compressed` | Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times. | eJzzSM3JyVcIzy/KSVEEABxJBD4= |
-| `Ext.memory_region.bytes_compressed_present` | Whether bytes_compressed is present in this event. | False |
-| `Ext.memory_region.hash.sha256` | The sha256 of the memory region. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
-| `Ext.memory_region.malware_signature.all_names` | A sequence of signature names matched. | Windows.EICAR.Not-a-virus |
-| `Ext.memory_region.malware_signature.identifier` | malware signature identifier | None |
-| `Ext.memory_region.malware_signature.primary` | The first matching details. | None |
-| `Ext.memory_region.malware_signature.primary.matches` | The first matching details. | None |
-| `Ext.memory_region.malware_signature.primary.signature.hash` | hash of file matching signature. | None |
-| `Ext.memory_region.malware_signature.primary.signature.hash.sha256` | sha256 hash of file matching signature. | None |
-| `Ext.memory_region.malware_signature.primary.signature.id` | The id of the first yara rule matched. | None |
-| `Ext.memory_region.malware_signature.primary.signature.name` | The name of the first yara rule matched. | None |
-| `Ext.memory_region.malware_signature.secondary` | Additional matching details if available. | None |
-| `Ext.memory_region.malware_signature.secondary.matches` | The second matching details. | None |
-| `Ext.memory_region.malware_signature.secondary.signature.hash` | hash of second file matching signature. | None |
-| `Ext.memory_region.malware_signature.secondary.signature.hash.sha256` | sha256 hash of second file matching signature. | None |
-| `Ext.memory_region.malware_signature.secondary.signature.id` | The id of the second yara rule matched. | None |
-| `Ext.memory_region.malware_signature.secondary.signature.name` | The name of the second yara rule matched. | None |
-| `Ext.memory_region.malware_signature.version` | malware signature version | None |
-| `Ext.memory_region.mapped_path` | If the memory corresponds to a file mapping, this is the file's path. | C:\Windows\System32\mshtml.dll |
-| `Ext.memory_region.mapped_pe.Ext.dotnet` | Whether this file is a .NET PE | true |
-| `Ext.memory_region.mapped_pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
-| `Ext.memory_region.mapped_pe.Ext.sections.hash.md5` | MD5 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.sections.hash.sha1` | SHA1 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.sections.hash.sha384` | SHA384 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.sections.hash.sha512` | SHA512 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep` | SSDEEP hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh` | TLSH hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.sections.name` | The section's name | .reloc |
-| `Ext.memory_region.mapped_pe.Ext.streams` | The file's streams, if it is a PE | None |
-| `Ext.memory_region.mapped_pe.Ext.streams.hash.md5` | MD5 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.streams.hash.sha1` | SHA1 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.streams.hash.sha384` | SHA384 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.streams.hash.sha512` | SHA512 hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep` | SSDEEP hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh` | TLSH hash. | None |
-| `Ext.memory_region.mapped_pe.Ext.streams.name` | The stream's name | .reloc |
-| `Ext.memory_region.mapped_pe.architecture` | CPU architecture target for the file. | x64 |
-| `Ext.memory_region.mapped_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `Ext.memory_region.mapped_pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `Ext.memory_region.mapped_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `Ext.memory_region.mapped_pe.go_import_hash` | A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
-| `Ext.memory_region.mapped_pe.go_imports` | List of imported Go language element names and types. | None |
-| `Ext.memory_region.mapped_pe.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
-| `Ext.memory_region.mapped_pe.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
-| `Ext.memory_region.mapped_pe.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
-| `Ext.memory_region.mapped_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `Ext.memory_region.mapped_pe.import_hash` | A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-This is a synonym for imphash. | d41d8cd98f00b204e9800998ecf8427e |
-| `Ext.memory_region.mapped_pe.imports` | List of imported element names and types. | None |
-| `Ext.memory_region.mapped_pe.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
-| `Ext.memory_region.mapped_pe.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
-| `Ext.memory_region.mapped_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `Ext.memory_region.mapped_pe.pehash` | A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.
-Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. | 73ff189b63cd6be375a7ff25179a38d347651975 |
-| `Ext.memory_region.mapped_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `Ext.memory_region.mapped_pe.sections` | An array containing an object for each section of the PE file.
-The keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`. | None |
-| `Ext.memory_region.mapped_pe.sections.entropy` | Shannon entropy calculation from the section. | None |
-| `Ext.memory_region.mapped_pe.sections.name` | PE Section List name. | None |
-| `Ext.memory_region.mapped_pe.sections.physical_size` | PE Section List physical size. | None |
-| `Ext.memory_region.mapped_pe.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
-| `Ext.memory_region.mapped_pe.sections.virtual_size` | PE Section List virtual size. This is always the same as `physical_size`. | None |
-| `Ext.memory_region.mapped_pe_detected` | Whether the file at mapped_path is an executable. | False |
-| `Ext.memory_region.memory_pe.Ext.dotnet` | Whether this file is a .NET PE | true |
-| `Ext.memory_region.memory_pe.Ext.sections` | The file's relevant sections, if it is a PE | None |
-| `Ext.memory_region.memory_pe.Ext.sections.hash.md5` | MD5 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.sections.hash.sha1` | SHA1 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.sections.hash.sha256` | SHA256 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.sections.hash.sha384` | SHA384 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.sections.hash.sha512` | SHA512 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep` | SSDEEP hash. | None |
-| `Ext.memory_region.memory_pe.Ext.sections.hash.tlsh` | TLSH hash. | None |
-| `Ext.memory_region.memory_pe.Ext.sections.name` | The section's name | .reloc |
-| `Ext.memory_region.memory_pe.Ext.streams` | The file's streams, if it is a PE | None |
-| `Ext.memory_region.memory_pe.Ext.streams.hash.md5` | MD5 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.streams.hash.sha1` | SHA1 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.streams.hash.sha256` | SHA256 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.streams.hash.sha384` | SHA384 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.streams.hash.sha512` | SHA512 hash. | None |
-| `Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep` | SSDEEP hash. | None |
-| `Ext.memory_region.memory_pe.Ext.streams.hash.tlsh` | TLSH hash. | None |
-| `Ext.memory_region.memory_pe.Ext.streams.name` | The stream's name | .reloc |
-| `Ext.memory_region.memory_pe.architecture` | CPU architecture target for the file. | x64 |
-| `Ext.memory_region.memory_pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `Ext.memory_region.memory_pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `Ext.memory_region.memory_pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `Ext.memory_region.memory_pe.go_import_hash` | A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-The algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma). | 10bddcb4cee42080f76c88d9ff964491 |
-| `Ext.memory_region.memory_pe.go_imports` | List of imported Go language element names and types. | None |
-| `Ext.memory_region.memory_pe.go_imports_names_entropy` | Shannon entropy calculation from the list of Go imports. | None |
-| `Ext.memory_region.memory_pe.go_imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of Go imports. | None |
-| `Ext.memory_region.memory_pe.go_stripped` | Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable. | None |
-| `Ext.memory_region.memory_pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `Ext.memory_region.memory_pe.import_hash` | A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-This is a synonym for imphash. | d41d8cd98f00b204e9800998ecf8427e |
-| `Ext.memory_region.memory_pe.imports` | List of imported element names and types. | None |
-| `Ext.memory_region.memory_pe.imports_names_entropy` | Shannon entropy calculation from the list of imported element names and types. | None |
-| `Ext.memory_region.memory_pe.imports_names_var_entropy` | Variance for Shannon entropy calculation from the list of imported element names and types. | None |
-| `Ext.memory_region.memory_pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `Ext.memory_region.memory_pe.pehash` | A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.
-Learn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html. | 73ff189b63cd6be375a7ff25179a38d347651975 |
-| `Ext.memory_region.memory_pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `Ext.memory_region.memory_pe.sections` | An array containing an object for each section of the PE file.
-The keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`. | None |
-| `Ext.memory_region.memory_pe.sections.entropy` | Shannon entropy calculation from the section. | None |
-| `Ext.memory_region.memory_pe.sections.name` | PE Section List name. | None |
-| `Ext.memory_region.memory_pe.sections.physical_size` | PE Section List physical size. | None |
-| `Ext.memory_region.memory_pe.sections.var_entropy` | Variance for Shannon entropy calculation from the section. | None |
-| `Ext.memory_region.memory_pe.sections.virtual_size` | PE Section List virtual size. This is always the same as `physical_size`. | None |
-| `Ext.memory_region.memory_pe_detected` | Whether an executable file was found in memory. | False |
-| `Ext.memory_region.region_base` | Base address of the memory region. | 2431737462784 |
-| `Ext.memory_region.region_protection` | Memory protection of the memory region. Example values include "RWX" and "R-X". | RWX |
-| `Ext.memory_region.region_size` | Size of the memory region. | 4096 |
-| `Ext.memory_region.region_start_bytes` | First 64 bytes at the region base address. | 4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000 |
-| `Ext.memory_region.region_state` | State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE". | COMMIT |
-| `Ext.memory_region.strings` | Array of strings found within the memory region. | None |
-| `Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
-| `Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `pid` | Process id. | 4242 |
-| `thread.Ext` | Object for all custom defined fields to live in. | None |
-| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
-| `thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
-| `thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
-| `thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
-| `thread.Ext.call_stack.instruction_pointer` | The return address of this stack frame. | None |
-| `thread.Ext.call_stack.module_path` | The path to the DLL/module containing `instruction_pointer`. | None |
-| `thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
-| `thread.Ext.call_stack.protection_provenance` | The name of the memory region that last modified the protection of this page.  "Unbacked" can indicate shellcode. | None |
-| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
-| `thread.Ext.call_stack_contains_unbacked` | Indicates whether the creating thread's stack contains frames pointing outside any known executable image. | None |
-| `thread.Ext.call_stack_final_hook_module` | The module that installed the final API hook in the call stack. | None |
-| `thread.Ext.call_stack_final_hook_module.code_signature` | Code signature of the call_stack_final_hook_module. | None |
-| `thread.Ext.call_stack_final_hook_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `thread.Ext.call_stack_final_hook_module.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `thread.Ext.call_stack_final_hook_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `thread.Ext.call_stack_final_hook_module.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `thread.Ext.call_stack_final_hook_module.hash` | Hashes of the call_stack_final_hook_module. | None |
-| `thread.Ext.call_stack_final_hook_module.hash.sha256` | The sha256 of the call_stack_final_hook_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
-| `thread.Ext.call_stack_final_hook_module.path` | The file path of the call_stack_final_hook_module. | C:\Program Files\Example\example.dll |
-| `thread.Ext.call_stack_final_user_module` | The final non-win32 module in the call stack. | None |
-| `thread.Ext.call_stack_final_user_module.allocation_private_bytes` | The number of bytes in this memory region that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
-| `thread.Ext.call_stack_final_user_module.code_signature` | Code signature of the call_stack_final_user_module. | None |
-| `thread.Ext.call_stack_final_user_module.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `thread.Ext.call_stack_final_user_module.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `thread.Ext.call_stack_final_user_module.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `thread.Ext.call_stack_final_user_module.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `thread.Ext.call_stack_final_user_module.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `thread.Ext.call_stack_final_user_module.hash` | Hashes of the call_stack_final_user_module. | None |
-| `thread.Ext.call_stack_final_user_module.hash.sha256` | The sha256 of the call_stack_final_user_module. | d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0 |
-| `thread.Ext.call_stack_final_user_module.name` | The file name of the call_stack_final_user_module. | example.dll |
-| `thread.Ext.call_stack_final_user_module.path` | The file path of the call_stack_final_user_module. | C:\Program Files\Example\example.dll |
-| `thread.Ext.call_stack_final_user_module.protection` | The memory protection for the acting region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect` | RWX |
-| `thread.Ext.call_stack_final_user_module.protection_provenance` | The name of the memory region that caused the last modification of the protection of this page. "Unbacked" may indicate shellcode. | third_party_hook.dll |
-| `thread.Ext.call_stack_final_user_module.protection_provenance_path` | The path of the module that caused the last modification the protection of this page. | C:\Program Files\Hook Inc\third_party_hook.dll |
-| `thread.Ext.call_stack_final_user_module.reason` | The unexpected call_stack_summary that led to an "Undetermined" protection_provenance. | ntdll.dll|kernelbase.dll |
-| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
-| `thread.id` | Thread ID. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user`
-
-### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `name` | Short name or login of the user. | a.einstein |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/collection.md b/scripts/generate-docs/output/collection.md
deleted file mode 100644
index 51a5b1aea..000000000
--- a/scripts/generate-docs/output/collection.md
+++ /dev/null
@@ -1,106 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/file.md b/scripts/generate-docs/output/file.md
deleted file mode 100644
index e143a9d16..000000000
--- a/scripts/generate-docs/output/file.md
+++ /dev/null
@@ -1,518 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `Effective_process`
-
-### Description
-These fields contain information about an effective process.
-The effective process is the process that requested the a specific action, without directly performing it.
-Processes can have effective parents that differ from their regular parents. For example, on Windows, "wmic process call create notepad" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.
-Events can have effective processes that differ from their regular processes. For example, on Windows, "reg add \\localhost\HKLM\Software\Foo /v Data /t REG_SZ /d 123"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `entity_id` | Unique identifier for the effective process. | c2c455d9f99375d |
-| `executable` | Executable name for the effective process. | C:\Windows\System32\wbem\WMIC.exe |
-| `name` | Process name for the effective process. | WMIC.exe |
-| `pid` | Process ID. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `Persistence`
-
-### Description
-These fields contain information about a Persistence event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `args` | Arguments used to execute the persistence item | None |
-| `executable` | The persistence item's executable | None |
-| `keepalive` | Keep alive option boolean | None |
-| `name` | The persistence item's name | None |
-| `path` | The file's path | None |
-| `runatload` | Run at load option boolean | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `destination`
-
-### Description
-Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.correlation` | Information about event this should be correlated with. | None |
-| `Ext.correlation.id` | ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event | None |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `file`
-
-### Description
-A file is defined as a set of information that has been created on, or has existed on a filesystem.
-File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
-| `Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
-| `Ext.device.file_system_type` | Volume device file system type.
-Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
-| `Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
-| `Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
-| `Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
-| `Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
-| `Ext.device.volume_device_type` | Volume device type.
-Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
-| `Ext.entropy` | Entropy calculation of file's header and footer used to check file integrity. | None |
-| `Ext.header_bytes` | First 16 bytes of file used to check file integrity. | None |
-| `Ext.header_data` | First 16 bytes of file used to check file integrity. | None |
-| `Ext.malware_signature` | Nested version of malware_signature fieldset. | None |
-| `Ext.malware_signature.all_names` | The concatenated names of all yara signatures | None |
-| `Ext.malware_signature.identifier` | Malware artifact identifier. | None |
-| `Ext.malware_signature.primary` | Primary malware signature match. | None |
-| `Ext.malware_signature.primary.matches` | An array of bytes representing yara signature matches | None |
-| `Ext.malware_signature.primary.signature` | Primary malware signature match. | None |
-| `Ext.malware_signature.primary.signature.hash` | Primary malware signature hash. | None |
-| `Ext.malware_signature.primary.signature.hash.sha256` | Primary malware signature sha256. | None |
-| `Ext.malware_signature.primary.signature.id` | Primary malware signature id. | None |
-| `Ext.malware_signature.primary.signature.name` | Primary malware signature name. | None |
-| `Ext.malware_signature.secondary` | An array of malware signature matches | None |
-| `Ext.malware_signature.version` | Primary malware signature version. | None |
-| `Ext.monotonic_id` | File event monotonic ID. | None |
-| `Ext.original` | Original file information during a modification event. | None |
-| `Ext.original.extension` | Original file extension prior to a modification event | None |
-| `Ext.original.gid` | Primary group ID (GID) of the file. | 1001 |
-| `Ext.original.group` | Primary group name of the file. | alice |
-| `Ext.original.mode` | Original file mode prior to a modification event | None |
-| `Ext.original.name` | Original file name prior to a modification event | None |
-| `Ext.original.owner` | File owner's username. | alice |
-| `Ext.original.path` | Original file path prior to a modification event | None |
-| `Ext.original.uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
-| `Ext.windows` | Platform-specific Windows fields | None |
-| `Ext.windows.zone_identifier` | Windows zone identifier for a file | None |
-| `accessed` | Last time the file was accessed.
-Note that not all filesystems keep track of access time. | None |
-| `attributes` | Array of file attributes.
-Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write. | ["readonly", "system"] |
-| `created` | File creation time.
-Note that not all filesystems store the creation time. | None |
-| `ctime` | Last time the file attributes or metadata changed.
-Note that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file. | None |
-| `device` | Device that is the source of the file. | sda |
-| `directory` | Directory where the file is located. It should include the drive letter, when appropriate. | /home/alice |
-| `drive_letter` | Drive letter where the file is located. This field is only relevant on Windows.
-The value should be uppercase, and not include the colon. | C |
-| `extension` | File extension, excluding the leading dot.
-Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | png |
-| `gid` | Primary group ID (GID) of the file. | 1001 |
-| `group` | Primary group name of the file. | alice |
-| `hash.md5` | MD5 hash. | None |
-| `hash.sha1` | SHA1 hash. | None |
-| `hash.sha256` | SHA256 hash. | None |
-| `hash.sha512` | SHA512 hash. | None |
-| `inode` | Inode representing the file in the filesystem. | 256383 |
-| `mime_type` | MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used. | None |
-| `mode` | Mode of the file in octal representation. | 0640 |
-| `mtime` | Last time the file content was modified. | None |
-| `name` | Name of the file including the extension, without the directory. | example.png |
-| `origin_referrer_url` | The url of the webpage that linked to the file. | None |
-| `origin_url` | The url where the file is hosted. | None |
-| `owner` | File owner's username. | alice |
-| `path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
-| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `size` | File size in bytes.
-Only relevant when `file.type` is "file". | 16384 |
-| `target_path` | Target path for symlinks. | None |
-| `type` | File type (file, dir, or symlink). | file |
-| `uid` | The user ID (UID) or security identifier (SID) of the file owner. | 1001 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `group`
-
-### Description
-The group fields are meant to represent groups that are relevant to the event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | Group info prior to any setgid operations. | None |
-| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `Ext.real.name` | Name of the group. | None |
-| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `id` | Unique identifier for the group on the system/platform. | None |
-| `name` | Name of the group. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `process`
-
-### Description
-These fields contain information about a process.
-These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `group_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `parent.group_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `parent.pid` | Process id. | 4242 |
-| `pid` | Process id. | 4242 |
-| `ppid` | Parent process' pid. | 4241 |
-| `session_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `thread.Ext` | Object for all custom defined fields to live in. | None |
-| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
-| `thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
-| `thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
-| `thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
-| `thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
-| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
-| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
-| `thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
-| `thread.id` | Thread ID. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `source`
-
-### Description
-Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user`
-
-### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | User info prior to any setuid operations. | None |
-| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
-| `Ext.real.name` | Short name or login of the user. | None |
-| `domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `email` | User email address. | None |
-| `full_name` | User's full name, if available. | Albert Einstein |
-| `group.Ext` | Object for all custom defined fields to live in. | None |
-| `group.Ext.real` | Group info prior to any setgid operations. | None |
-| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `group.Ext.real.name` | Name of the group. | None |
-| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `group.id` | Unique identifier for the group on the system/platform. | None |
-| `group.name` | Name of the group. | None |
-| `hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `name` | Short name or login of the user. | a.einstein |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/heartbeat.md b/scripts/generate-docs/output/heartbeat.md
deleted file mode 100644
index 77f5375af..000000000
--- a/scripts/generate-docs/output/heartbeat.md
+++ /dev/null
@@ -1,96 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `billable`
-
-### Description
-Whether document should be included in billing calculations
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/library.md b/scripts/generate-docs/output/library.md
deleted file mode 100644
index a7856e7cb..000000000
--- a/scripts/generate-docs/output/library.md
+++ /dev/null
@@ -1,501 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `Effective_process`
-
-### Description
-These fields contain information about an effective process.
-The effective process is the process that requested the a specific action, without directly performing it.
-Processes can have effective parents that differ from their regular parents. For example, on Windows, "wmic process call create notepad" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.
-Events can have effective processes that differ from their regular processes. For example, on Windows, "reg add \\localhost\HKLM\Software\Foo /v Data /t REG_SZ /d 123"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `entity_id` | Unique identifier for the effective process. | c2c455d9f99375d |
-| `executable` | Executable name for the effective process. | C:\Windows\System32\wbem\WMIC.exe |
-| `name` | Process name for the effective process. | WMIC.exe |
-| `pid` | Process ID. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `destination`
-
-### Description
-Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `dll`
-
-### Description
-These fields contain information about code libraries dynamically loaded into processes.
-
-Many operating systems refer to "shared code libraries" with different names, but this field set refers to all of the following:
-* Dynamic-link library (`.dll`) commonly used on Windows
-* Shared Object (`.so`) commonly used on Unix-like operating systems
-* Dynamic library (`.dylib`) commonly used on macOS
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `Ext.defense_evasions` | List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump. | None |
-| `Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
-| `Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
-| `Ext.device.file_system_type` | Volume device file system type.
-Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
-| `Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
-| `Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
-| `Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
-| `Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
-| `Ext.device.volume_device_type` | Volume device type.
-Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
-| `Ext.load_index` | A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.
-The first load index is 1. | None |
-| `Ext.relative_file_creation_time` | Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future. | None |
-| `Ext.relative_file_name_modify_time` | Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future. | None |
-| `Ext.size` | Size of DLL | None |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `hash.md5` | MD5 hash. | None |
-| `hash.sha1` | SHA1 hash. | None |
-| `hash.sha256` | SHA256 hash. | None |
-| `hash.sha512` | SHA512 hash. | None |
-| `name` | Name of the library.
-This generally maps to the name of the file on disk. | kernel32.dll |
-| `path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
-| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `file`
-
-### Description
-A file is defined as a set of information that has been created on, or has existed on a filesystem.
-File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `hash.md5` | MD5 hash. | None |
-| `hash.sha1` | SHA1 hash. | None |
-| `hash.sha256` | SHA256 hash. | None |
-| `hash.sha512` | SHA512 hash. | None |
-| `name` | Name of the file including the extension, without the directory. | example.png |
-| `path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
-| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `group`
-
-### Description
-The group fields are meant to represent groups that are relevant to the event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | Group info prior to any setgid operations. | None |
-| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `Ext.real.name` | Name of the group. | None |
-| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `id` | Unique identifier for the group on the system/platform. | None |
-| `name` | Name of the group. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `process`
-
-### Description
-These fields contain information about a process.
-These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `pid` | Process id. | 4242 |
-| `thread.Ext` | Object for all custom defined fields to live in. | None |
-| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
-| `thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
-| `thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
-| `thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
-| `thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
-| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
-| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
-| `thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
-| `thread.id` | Thread ID. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `source`
-
-### Description
-Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user`
-
-### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | User info prior to any setuid operations. | None |
-| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
-| `Ext.real.name` | Short name or login of the user. | None |
-| `domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `email` | User email address. | None |
-| `full_name` | User's full name, if available. | Albert Einstein |
-| `group.Ext` | Object for all custom defined fields to live in. | None |
-| `group.Ext.real` | Group info prior to any setgid operations. | None |
-| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `group.Ext.real.name` | Name of the group. | None |
-| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `group.id` | Unique identifier for the group on the system/platform. | None |
-| `group.name` | Name of the group. | None |
-| `hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `name` | Short name or login of the user. | a.einstein |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/metadata.md b/scripts/generate-docs/output/metadata.md
deleted file mode 100644
index 96fef6271..000000000
--- a/scripts/generate-docs/output/metadata.md
+++ /dev/null
@@ -1,214 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `Endpoint`
-
-### Description
-Fields describing the state of the Elastic Endpoint when an event occurs.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `capabilities` | Enabled capabilities | None |
-| `configuration` | Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state | None |
-| `configuration.isolation` | Configuration setting for Host Isolation from the network | None |
-| `policy` | The policy fields are used to hold information about applied policy. | None |
-| `policy.applied` | information about the policy that is applied | None |
-| `policy.applied.id` | the id of the applied policy | None |
-| `policy.applied.name` | the name of this applied policy | None |
-| `policy.applied.status` | the status of the applied policy | None |
-| `state` | Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration) | None |
-| `state.isolation` | Current network isolation state of the host | None |
-| `status` | The current status of the endpoint e.g. enrolled, unenrolled. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `name` | Custom name of the agent.
-This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | foo |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `elastic`
-
-### Description
-Holds fields and properties of data points and concepts in the elastic domain or namespace.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `agent` | The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host. | None |
-| `agent.id` | Unique identifier of this elastic agent (if one exists). | c2a9093e-e289-4c0a-aa44-8c32a414fa7a |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/metrics.md b/scripts/generate-docs/output/metrics.md
deleted file mode 100644
index 572e09c92..000000000
--- a/scripts/generate-docs/output/metrics.md
+++ /dev/null
@@ -1,316 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `Endpoint`
-
-### Description
-Fields describing the state of the Elastic Endpoint when an event occurs.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `metrics` | Metrics fields hold the endpoint and system's performance metrics | None |
-| `metrics.cpu` | CPU statistics | None |
-| `metrics.cpu.endpoint` | CPU metrics for the endpoint | None |
-| `metrics.cpu.endpoint.histogram` | This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket | None |
-| `metrics.cpu.endpoint.latest` | Average CPU over the last sample interval | None |
-| `metrics.cpu.endpoint.mean` | Average CPU load used by the endpoint | None |
-| `metrics.disks` | An array of disk information for the host | None |
-| `metrics.disks.device` | Device name | None |
-| `metrics.disks.endpoint_drive` | This field will be present and set to true only for the drive that holds the installed endpoint | None |
-| `metrics.disks.free` | The number of bytes marked as free on the disk | None |
-| `metrics.disks.fstype` | The file system type for the drive | None |
-| `metrics.disks.mount` | The disks mount location | None |
-| `metrics.disks.total` | The size of the disk in bytes | None |
-| `metrics.documents_volume` | Statistics about sent documents | None |
-| `metrics.documents_volume.alerts.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.alerts.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.alerts.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.alerts.suppressed_count` | Number of suppressed documents | None |
-| `metrics.documents_volume.api_events.sent_bytes` | Total size of API Event sent documents | None |
-| `metrics.documents_volume.api_events.sent_count` | Number of sent API Event documents | None |
-| `metrics.documents_volume.api_events.sources` | An array of API Event document statistics per source | None |
-| `metrics.documents_volume.api_events.sources.sent_bytes` | Total size of API Event sent documents from source | None |
-| `metrics.documents_volume.api_events.sources.sent_count` | Number of sent API Event documents from source | None |
-| `metrics.documents_volume.api_events.sources.source` | API Event document source name | None |
-| `metrics.documents_volume.api_events.sources.suppressed_bytes` | Total size of suppressed API Event documents from source | None |
-| `metrics.documents_volume.api_events.sources.suppressed_count` | Number of suppressed API Event documents from source | None |
-| `metrics.documents_volume.api_events.suppressed_bytes` | Total size of suppressed API Event documents | None |
-| `metrics.documents_volume.api_events.suppressed_count` | Number of suppressed API Event documents | None |
-| `metrics.documents_volume.diagnostic_alerts.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.diagnostic_alerts.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.diagnostic_alerts.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.diagnostic_alerts.suppressed_count` | Number of suppressed documents | None |
-| `metrics.documents_volume.dns_events.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.dns_events.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.dns_events.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.dns_events.suppressed_count` | Number of suppressed documents | None |
-| `metrics.documents_volume.file_events.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.file_events.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.file_events.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.file_events.suppressed_count` | Number of suppressed documents | None |
-| `metrics.documents_volume.library_events.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.library_events.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.library_events.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.library_events.suppressed_count` | Number of suppressed documents | None |
-| `metrics.documents_volume.network_events.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.network_events.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.network_events.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.network_events.suppressed_count` | Number of suppressed documents | None |
-| `metrics.documents_volume.overall.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.overall.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.overall.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.overall.suppressed_count` | Number of suppressed documents | None |
-| `metrics.documents_volume.process_events.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.process_events.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.process_events.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.process_events.suppressed_count` | Number of suppressed documents | None |
-| `metrics.documents_volume.registry_events.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.registry_events.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.registry_events.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.registry_events.suppressed_count` | Number of suppressed documents | None |
-| `metrics.documents_volume.security_events.sent_bytes` | Total size of sent documents | None |
-| `metrics.documents_volume.security_events.sent_count` | Number of sent documents | None |
-| `metrics.documents_volume.security_events.suppressed_bytes` | Total size of suppressed documents | None |
-| `metrics.documents_volume.security_events.suppressed_count` | Number of suppressed documents | None |
-| `metrics.event_filter.active_global_count` | The number of active global event filters | None |
-| `metrics.event_filter.active_user_count` | The number of active user event filters | None |
-| `metrics.malicious_behavior_rules` | An array of performance information about each malicious behavior rule | None |
-| `metrics.malicious_behavior_rules.endpoint_uptime_percent` | Perfect of Endpoint's update spent running the rule | None |
-| `metrics.malicious_behavior_rules.id` | The rule id | None |
-| `metrics.memory` | Memory statistics | None |
-| `metrics.memory.endpoint` | Endpoint memory utilization | None |
-| `metrics.memory.endpoint.private` | The memory private to the endpoint | None |
-| `metrics.memory.endpoint.private.latest` | The memory usage by the endpoint for the last sample interval | None |
-| `metrics.memory.endpoint.private.mean` | Average memory usage by the endpoint since its start | None |
-| `metrics.system_impact` | An array of system impact information | None |
-| `metrics.system_impact.authentication_events.week_idle_ms` | The total milliseconds spent queueing authentication events for the process over the last week | None |
-| `metrics.system_impact.authentication_events.week_ms` | The total milliseconds spent on authentication events for the process over the last week | None |
-| `metrics.system_impact.dns_events.week_idle_ms` | The total milliseconds spent queueing DNS events for the process over the last week | None |
-| `metrics.system_impact.dns_events.week_ms` | The total milliseconds spent on DNS events for the process over the last week | None |
-| `metrics.system_impact.file_events.week_idle_ms` | The total milliseconds spent queueing file events for the process over the last week | None |
-| `metrics.system_impact.file_events.week_ms` | The total milliseconds spent on file events for the process over the last week | None |
-| `metrics.system_impact.library_load_events.week_idle_ms` | The total milliseconds spent queueing library load events for the process over the last week | None |
-| `metrics.system_impact.library_load_events.week_ms` | The total milliseconds spent on library load events for the process over the last week | None |
-| `metrics.system_impact.malware.week_idle_ms` | The total milliseconds spent queueing malware scanning due to the process over the last week | None |
-| `metrics.system_impact.malware.week_ms` | The total milliseconds spent on malware scanning due to the process over the last week | None |
-| `metrics.system_impact.network_events.week_idle_ms` | The total milliseconds spent queueing network events for the process over the last week | None |
-| `metrics.system_impact.network_events.week_ms` | The total milliseconds spent on network events for the process over the last week | None |
-| `metrics.system_impact.overall.week_idle_ms` | The total milliseconds spent queueing activity for the process over the last week | None |
-| `metrics.system_impact.overall.week_ms` | The total milliseconds spent monitoring the process over the last week | None |
-| `metrics.system_impact.process.code_signature` | Code signature of the process | None |
-| `metrics.system_impact.process.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `metrics.system_impact.process.code_signature.signing_id` | 'The identifier used to sign the binary.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.' | com.apple.xpc.proxy |
-| `metrics.system_impact.process.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `metrics.system_impact.process.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `metrics.system_impact.process.code_signature.team_id` | 'The team identifier used to sign the binary.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.' | EQHXZ8M8AV |
-| `metrics.system_impact.process.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `metrics.system_impact.process.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `metrics.system_impact.process.executable` | Path to the process executable for the impact entry | None |
-| `metrics.system_impact.process_events.week_idle_ms` | The total milliseconds spent queueing process events for the process over the last week | None |
-| `metrics.system_impact.process_events.week_ms` | The total milliseconds spent on process events for the process over the last week | None |
-| `metrics.system_impact.registry_events.week_idle_ms` | The total milliseconds spent queueing registry events for the process over the last week | None |
-| `metrics.system_impact.registry_events.week_ms` | The total milliseconds spent on registry events for the process over the last week | None |
-| `metrics.system_impact.threat_intelligence_events.week_idle_ms` | The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week | None |
-| `metrics.system_impact.threat_intelligence_events.week_ms` | The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week | None |
-| `metrics.system_impact.win32k_events.week_idle_ms` | The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week | None |
-| `metrics.system_impact.win32k_events.week_ms` | The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week | None |
-| `metrics.threads` | Statistics about the individual Endpoint threads (array) | None |
-| `metrics.threads.cpu.mean` | The thread's average CPU use | None |
-| `metrics.threads.name` | The thread name | None |
-| `metrics.uptime` | Number of seconds since boot | None |
-| `metrics.uptime.endpoint` | Number of seconds since the endpoint was started | None |
-| `metrics.uptime.system` | Number of seconds since the system was started | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `end` | `event.end` contains the date when the event ended or when the activity was last observed. | None |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `start` | `event.start` contains the date when the event started or when the activity was first observed. | None |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/network.md b/scripts/generate-docs/output/network.md
deleted file mode 100644
index b5f35ce1e..000000000
--- a/scripts/generate-docs/output/network.md
+++ /dev/null
@@ -1,482 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `destination`
-
-### Description
-Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `address` | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.
-Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | None |
-| `as.number` | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | 15169 |
-| `as.organization.name` | Organization name. | Google LLC |
-| `bytes` | Bytes sent from the destination to the source. | 184 |
-| `domain` | The domain name of the destination system.
-This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | foo.example.com |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-| `ip` | IP address of the destination (IPv4 or IPv6). | None |
-| `packets` | Packets sent from the destination to the source. | 12 |
-| `port` | Port of the destination. | None |
-| `registered_domain` | The highest registered destination domain, stripped of the subdomain.
-For example, the registered domain for "foo.example.com" is "example.com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
-| `top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `dns`
-
-### Description
-Fields describing DNS queries and answers.
-DNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.options` | DNS options field, uint64, representing as a keyword to avoid overflows in ES | None |
-| `Ext.status` | DNS status field, uint32 | None |
-| `question.name` | The name being queried.
-If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | www.example.com |
-| `question.registered_domain` | The highest registered domain, stripped of the subdomain.
-For example, the registered domain for "foo.example.com" is "example.com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
-| `question.subdomain` | The subdomain is all of the labels under the registered_domain.
-If the domain has multiple levels of subdomain, such as "sub2.sub1.example.com", the subdomain field should contain "sub2.sub1", with no trailing period. | www |
-| `question.top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
-| `question.type` | The type of record being queried. | AAAA |
-| `resolved_ip` | Array containing all IPs seen in `answers.data`.
-The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for. | ["10.10.10.10", "10.10.10.11"] |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `group`
-
-### Description
-The group fields are meant to represent groups that are relevant to the event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | Group info prior to any setgid operations. | None |
-| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `Ext.real.name` | Name of the group. | None |
-| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `id` | Unique identifier for the group on the system/platform. | None |
-| `name` | Name of the group. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `http`
-
-### Description
-Fields related to HTTP activity. Use the `url` field set to store the url of the request.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `request.body.bytes` | Size in bytes of the request body. | 887 |
-| `request.body.content` | The full HTTP request body. | Hello world |
-| `request.bytes` | Total size in bytes of the request (body and headers). | 1437 |
-| `response.Ext` | Object for all custom defined fields to live in. | None |
-| `response.Ext.version` | HTTP version | None |
-| `response.body.bytes` | Size in bytes of the response body. | 887 |
-| `response.body.content` | The full HTTP response body. | Hello world |
-| `response.bytes` | Total size in bytes of the response (body and headers). | 1437 |
-| `response.status_code` | HTTP response status code. | 404 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `network`
-
-### Description
-The network is defined as the communication path over which a host or network event happens.
-The network.* fields should be populated with details about the network activity associated with an event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `bytes` | Total bytes transferred in both directions.
-If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. | 368 |
-| `community_id` | A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.
-Learn more at https://github.com/corelight/community-id-spec. | 1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0= |
-| `direction` | Direction of the network traffic.
-When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".
-When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".
-Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers. | inbound |
-| `iana_number` | IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number. | 6 |
-| `packets` | Total packets transferred in both directions.
-If `source.packets` and `destination.packets` are known, `network.packets` is their sum. | 24 |
-| `protocol` | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.
-The field value must be normalized to lowercase for querying. | http |
-| `transport` | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)
-The field value must be normalized to lowercase for querying. | tcp |
-| `type` | In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc
-The field value must be normalized to lowercase for querying. | ipv4 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `process`
-
-### Description
-These fields contain information about a process.
-These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `group_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `parent.group_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `pid` | Process id. | 4242 |
-| `session_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `thread.id` | Thread ID. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `source`
-
-### Description
-Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `address` | Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.
-Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | None |
-| `as.number` | Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet. | 15169 |
-| `as.organization.name` | Organization name. | Google LLC |
-| `bytes` | Bytes sent from the source to the destination. | 184 |
-| `domain` | The domain name of the source system.
-This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment. | foo.example.com |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-| `ip` | IP address of the source (IPv4 or IPv6). | None |
-| `packets` | Packets sent from the source to the destination. | 12 |
-| `port` | Port of the source. | None |
-| `registered_domain` | The highest registered source domain, stripped of the subdomain.
-For example, the registered domain for "foo.example.com" is "example.com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as "co.uk". | example.com |
-| `top_level_domain` | The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is "com".
-This value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as "co.uk". | co.uk |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user`
-
-### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | User info prior to any setuid operations. | None |
-| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
-| `Ext.real.name` | Short name or login of the user. | None |
-| `domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `email` | User email address. | None |
-| `full_name` | User's full name, if available. | Albert Einstein |
-| `group.Ext` | Object for all custom defined fields to live in. | None |
-| `group.Ext.real` | Group info prior to any setgid operations. | None |
-| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `group.Ext.real.name` | Name of the group. | None |
-| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `group.id` | Unique identifier for the group on the system/platform. | None |
-| `group.name` | Name of the group. | None |
-| `hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `name` | Short name or login of the user. | a.einstein |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/packages.json b/scripts/generate-docs/output/packages.json
deleted file mode 100644
index c181fcdd3..000000000
--- a/scripts/generate-docs/output/packages.json
+++ /dev/null
@@ -1,36484 +0,0 @@
-{
-    "packages": [
-        {
-            "name": "alerts",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "Events",
-                    "level": "custom",
-                    "type": "object",
-                    "description": "events array"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Endpoint",
-                    "title": "Endpoint",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
-                    "fields": [
-                        {
-                            "name": "policy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The policy fields are used to hold information about applied policy."
-                        },
-                        {
-                            "name": "policy.applied",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about the policy that is applied"
-                        },
-                        {
-                            "name": "policy.applied.artifacts",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about global protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.channel",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "global artifacts rollout channel"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "the identifiers of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of global artifact applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the sha256 of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.snapshot",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the snapshot date of applied global artifacts or 'latest'"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.update_age",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "number of days since global artifacts were made up-to-date"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about user protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "the identifiers of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of user artifact applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the sha256 of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the id of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of this applied policy"
-                        },
-                        {
-                            "name": "policy.applied.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of this applied policy"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Memory_protection",
-                    "title": "Memory Protection",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information specific to Memory Protection alerts.",
-                    "fields": [
-                        {
-                            "name": "cross_session",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Is this process injecting across operating system sessions?"
-                        },
-                        {
-                            "name": "feature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory Protection feature which triggered the alert.",
-                            "example": "shellcode_thread"
-                        },
-                        {
-                            "name": "parent_to_child",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Is this process injecting into its child?"
-                        },
-                        {
-                            "name": "self_injection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Is this alert about a process injecting into itself?"
-                        },
-                        {
-                            "name": "thread_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The number of threads that this alert applies to. If several alerts occur in a short period of time, they can be combined into a single alert with thread_count > 1."
-                        },
-                        {
-                            "name": "unique_key_v1",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A unique key created by hashing several characteristics of this alert."
-                        },
-                        {
-                            "name": "unique_key_v2",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A unique key created by hashing several characteristics of this alert.",
-                            "example": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Ransomware",
-                    "title": "Ransomware",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information specific to ransomware alerts.",
-                    "fields": [
-                        {
-                            "name": "child_processes.executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "child_processes.feature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ransomware feature which triggered the alert."
-                        },
-                        {
-                            "name": "child_processes.files",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Information about each file event attributed to the ransomware. Expected to be an array."
-                        },
-                        {
-                            "name": "child_processes.files.data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File header or MBR bytes."
-                        },
-                        {
-                            "name": "child_processes.files.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy of file contents."
-                        },
-                        {
-                            "name": "child_processes.files.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot."
-                        },
-                        {
-                            "name": "child_processes.files.metrics",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Suspicious ransomware behaviours associated with the file event."
-                        },
-                        {
-                            "name": "child_processes.files.operation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operation applied to file."
-                        },
-                        {
-                            "name": "child_processes.files.original.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file extension prior to the file event."
-                        },
-                        {
-                            "name": "child_processes.files.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to the file event."
-                        },
-                        {
-                            "name": "child_processes.files.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name."
-                        },
-                        {
-                            "name": "child_processes.files.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Ransomware score for this particular file event."
-                        },
-                        {
-                            "name": "child_processes.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "child_processes.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Total ransomware score for aggregated file events."
-                        },
-                        {
-                            "name": "child_processes.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ransomware artifact version."
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "feature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ransomware feature which triggered the alert."
-                        },
-                        {
-                            "name": "files",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Information about each file event attributed to the ransomware. Expected to be an array."
-                        },
-                        {
-                            "name": "files.data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File header or MBR bytes."
-                        },
-                        {
-                            "name": "files.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy of file contents."
-                        },
-                        {
-                            "name": "files.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot."
-                        },
-                        {
-                            "name": "files.metrics",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Suspicious ransomware behaviours associated with the file event."
-                        },
-                        {
-                            "name": "files.operation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operation applied to file."
-                        },
-                        {
-                            "name": "files.original.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file extension prior to the file event."
-                        },
-                        {
-                            "name": "files.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to the file event."
-                        },
-                        {
-                            "name": "files.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name."
-                        },
-                        {
-                            "name": "files.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Ransomware score for this particular file event."
-                        },
-                        {
-                            "name": "pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Total ransomware score for aggregated file events."
-                        },
-                        {
-                            "name": "version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ransomware artifact version."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Responses",
-                    "title": "Responses",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "responses array contains rule response action results",
-                    "fields": [
-                        {
-                            "name": "@timestamp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp in which action was taken",
-                            "format": "string"
-                        },
-                        {
-                            "name": "action",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Dictionary representing requested response action"
-                        },
-                        {
-                            "name": "action.action",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Response action name"
-                        },
-                        {
-                            "name": "action.field",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Field in the triggering event to use as input for action"
-                        },
-                        {
-                            "name": "action.file.attributes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Destination file attributes"
-                        },
-                        {
-                            "name": "action.file.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Destination file path"
-                        },
-                        {
-                            "name": "action.file.reason",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Combined USN file modification reason"
-                        },
-                        {
-                            "name": "action.key.actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Actions taken by Registry Rollback for key"
-                        },
-                        {
-                            "name": "action.key.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT path of registry key recovered by Rollback"
-                        },
-                        {
-                            "name": "action.key.values",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Values modified"
-                        },
-                        {
-                            "name": "action.key.values.actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Actions taken by Registry Rollback for value"
-                        },
-                        {
-                            "name": "action.key.values.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Value name recovered by Rollback"
-                        },
-                        {
-                            "name": "action.process.message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Status message for Process Rollback"
-                        },
-                        {
-                            "name": "action.process.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path of process killed by Process Rollback"
-                        },
-                        {
-                            "name": "action.process.result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Result code for Process Rollback"
-                        },
-                        {
-                            "name": "action.source.attributes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source file attributes"
-                        },
-                        {
-                            "name": "action.source.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source file path"
-                        },
-                        {
-                            "name": "action.state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Index of event in events array to use for field lookup"
-                        },
-                        {
-                            "name": "action.tree",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Indicates whether or not an action was taken against an entire process tree"
-                        },
-                        {
-                            "name": "message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Result message"
-                        },
-                        {
-                            "name": "process",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Dictionary representing process information"
-                        },
-                        {
-                            "name": "process.entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Entity id of actionable process"
-                        },
-                        {
-                            "name": "process.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of actionable process"
-                        },
-                        {
-                            "name": "process.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "pid of actionable process"
-                        },
-                        {
-                            "name": "result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Response action result code"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Target",
-                    "title": "Target",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
-                    "fields": [
-                        {
-                            "name": "dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "process.Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "process.Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        },
-                        {
-                            "name": "process.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "process.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "process.Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory allocation containing the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Original memory size requested when the memory was allocated.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-                            "example": "PRIVATE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The address where bytes_compressed begins.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether bytes_compressed is present in this event.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A sequence of signature names matched.",
-                            "example": "Windows.EICAR.Not-a-virus"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature identifier"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The first matching details."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The first matching details.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of file matching signature."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of file matching signature."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the first yara rule matched."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the first yara rule matched."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature version"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
-                            "example": "C:\\Windows\\System32\\mshtml.dll"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the file at mapped_path is an executable.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether an executable file was found in memory.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of the memory region.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_start_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 64 bytes at the region base address.",
-                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-                            "example": "COMMIT"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.strings",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Array of strings found within the memory region.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "process.Ext.services",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Services running in this process."
-                        },
-                        {
-                            "name": "process.Ext.session",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Session information for the current process"
-                        },
-                        {
-                            "name": "process.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "process.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "process.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "process.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "process.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "process.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "process.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "process.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "process.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "process.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "process.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "process.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "process.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "process.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "process.Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "process.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "process.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "process.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "process.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "process.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "process.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "process.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "process.exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "process.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "process.parent.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.parent.Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.parent.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "process.parent.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
-                        },
-                        {
-                            "name": "process.parent.Ext.real.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "process.parent.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "process.parent.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "process.parent.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "process.parent.Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "process.parent.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "process.parent.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "process.parent.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "process.parent.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.parent.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "process.parent.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "process.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "process.parent.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "process.parent.exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "process.parent.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.parent.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.parent.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.parent.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.parent.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "process.parent.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.parent.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.parent.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.parent.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.parent.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.parent.pgid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.parent.ppid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "process.parent.thread.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.parent.thread.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "process.parent.title",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ]
-                        },
-                        {
-                            "name": "process.parent.uptime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "process.parent.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "process.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.pgid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.ppid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "process.thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.instruction_pointer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The return address of this stack frame."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.memory_section.memory_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.memory_section.memory_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.memory_section.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.module_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The name of the DLL/module containing `instruction_pointer`.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.module_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path to the DLL/module containing `instruction_pointer`."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.rva",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The final non-win32 module in the call stack."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_user_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file name of the call_stack_final_user_module.",
-                            "example": "example.dll"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_user_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "process.thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a trampoline was detected, this indicates the original content for the thread start address in memory.",
-                            "example": 4194304
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.",
-                            "example": "48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc"
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_bytes_disasm",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the disassembled code at the original thread start address.",
-                            "example": "mov rax, 0x4141414141414141\\njmp rax"
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_bytes_disasm_hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
-                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.",
-                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
-                        },
-                        {
-                            "name": "process.thread.Ext.parameter",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a thread is created, this is the raw numerical value of its parameter."
-                        },
-                        {
-                            "name": "process.thread.Ext.parameter_bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.thread.Ext.parameter_bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether parameter_bytes_compressed is present in this event."
-                        },
-                        {
-                            "name": "process.thread.Ext.service",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Service associated with the thread.",
-                            "example": "VaultSvc"
-                        },
-                        {
-                            "name": "process.thread.Ext.start",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "The time the thread started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Memory address where the thread began execution.",
-                            "example": 4194304
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.",
-                            "example": "c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_bytes_disasm",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The bytes at the thread start address, disassembled into human-readable assembly code.",
-                            "example": "ret\\nint3"
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_bytes_disasm_hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
-                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The dll/module where the thread began execution.",
-                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
-                        },
-                        {
-                            "name": "process.thread.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "process.thread.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "process.thread.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "process.thread.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "process.thread.Ext.uptime",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Seconds since thread started."
-                        },
-                        {
-                            "name": "process.thread.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.thread.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "process.title",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ]
-                        },
-                        {
-                            "name": "process.uptime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "process.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "ephemeral_id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
-                            "example": "8a4f500f"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
-                            "example": "foo"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "cloud",
-                    "title": "Cloud",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to the cloud or infrastructure the events are coming from.",
-                    "fields": [
-                        {
-                            "name": "account.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
-                            "example": 666777888999
-                        },
-                        {
-                            "name": "instance.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Instance name of the host machine."
-                        },
-                        {
-                            "name": "project.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
-                            "example": "my-project"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
-                            "example": "aws"
-                        },
-                        {
-                            "name": "region",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region in which this host, resource, or service is located.",
-                            "example": "us-east-1"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information."
-                },
-                {
-                    "name": "container",
-                    "title": "Container",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique container id."
-                        },
-                        {
-                            "name": "image.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the image the container was built on."
-                        },
-                        {
-                            "name": "image.tag",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Container image tags."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Container name."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the destination (IPv4 or IPv6)."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dll",
-                    "title": "DLL",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dns",
-                    "title": "DNS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).",
-                    "fields": [
-                        {
-                            "name": "question.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
-                            "example": "www.example.com"
-                        },
-                        {
-                            "name": "question.type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of record being queried.",
-                            "example": "AAAA"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "elastic",
-                    "title": "Elastic",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Holds fields and properties of data points and concepts in the elastic domain or namespace.",
-                    "fields": [
-                        {
-                            "name": "agent",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
-                        },
-                        {
-                            "name": "agent.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this elastic agent (if one exists).",
-                            "example": "c2a9093e-e289-4c0a-aa44-8c32a414fa7a"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "risk_score",
-                            "level": "core",
-                            "type": "float",
-                            "description": "Risk score or priority of the event (e.g. security solutions). Use your system's original value here."
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "file",
-                    "title": "File",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.entry_modified",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
-                        },
-                        {
-                            "name": "Ext.macro.code_page",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Identifies the character encoding used for this macro.  https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers"
-                        },
-                        {
-                            "name": "Ext.macro.collection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object containing hashes for the macro collection."
-                        },
-                        {
-                            "name": "Ext.macro.collection.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.macro.collection.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.macro.collection.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.macro.collection.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.macro.errors",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Errors that occurred when parsing this document file."
-                        },
-                        {
-                            "name": "Ext.macro.errors.count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of times this error that occurred."
-                        },
-                        {
-                            "name": "Ext.macro.errors.error_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of parsing error that occurred."
-                        },
-                        {
-                            "name": "Ext.macro.file_extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The extension of the file containing this macro (e.g. .docm)"
-                        },
-                        {
-                            "name": "Ext.macro.project_file",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Metadata about the corresponding VBA project file"
-                        },
-                        {
-                            "name": "Ext.macro.project_file.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.macro.project_file.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.macro.project_file.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.macro.project_file.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Streams associated with the document."
-                        },
-                        {
-                            "name": "Ext.macro.stream.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the stream."
-                        },
-                        {
-                            "name": "Ext.macro.stream.raw_code",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 100KB of raw stream binary.  Can be useful to analyze false positives and malicious payloads."
-                        },
-                        {
-                            "name": "Ext.macro.stream.raw_code_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The original stream size.  Indicates whether stream.raw_code was truncated."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "Ext.original",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Original file information during a modification event."
-                        },
-                        {
-                            "name": "Ext.original.gid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "Ext.original.group",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "Ext.original.mode",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file mode prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file name prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.owner",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "Ext.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.uid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "Ext.quarantine_message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Message describing quarantine results."
-                        },
-                        {
-                            "name": "Ext.quarantine_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint the quarantined file was originally."
-                        },
-                        {
-                            "name": "Ext.quarantine_result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean representing whether or not file quarantine succeeded."
-                        },
-                        {
-                            "name": "Ext.temp_file_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
-                        },
-                        {
-                            "name": "Ext.windows",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Platform-specific Windows fields"
-                        },
-                        {
-                            "name": "Ext.windows.zone_identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Windows zone identifier for a file"
-                        },
-                        {
-                            "name": "accessed",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-                        },
-                        {
-                            "name": "attributes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
-                            "example": "[\"readonly\", \"system\"]"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "created",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "File creation time.\nNote that not all filesystems store the creation time."
-                        },
-                        {
-                            "name": "ctime",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-                        },
-                        {
-                            "name": "device",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device that is the source of the file.",
-                            "example": "sda"
-                        },
-                        {
-                            "name": "directory",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "drive_letter",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1,
-                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
-                            "example": "C"
-                        },
-                        {
-                            "name": "extension",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "gid",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "group",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "inode",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Inode representing the file in the filesystem.",
-                            "example": "256383"
-                        },
-                        {
-                            "name": "mime_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-                        },
-                        {
-                            "name": "mode",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode of the file in octal representation.",
-                            "example": "0640"
-                        },
-                        {
-                            "name": "mtime",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file content was modified."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "owner",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "size",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
-                            "example": 16384
-                        },
-                        {
-                            "name": "target_path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Target path for symlinks.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File type (file, dir, or symlink).",
-                            "example": "file"
-                        },
-                        {
-                            "name": "uid",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "boot.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
-                            "example": "88a1f0ed-5ae5-41ee-af6b-41921c311872"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "pid_ns_ino",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
-                            "example": 256383
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "user.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "user.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "user.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "user.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "user.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "user.email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "user.full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "user.group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "user.group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "user.group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "user.group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "user.group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "user.group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "user.group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "user.hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "user.id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "user.name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "orchestrator",
-                    "title": "Orchestrator",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields that describe the resources which container orchestrators manage or act upon.",
-                    "fields": [
-                        {
-                            "name": "cluster.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the cluster."
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Namespace in which the action is taking place.",
-                            "example": "kube-system"
-                        },
-                        {
-                            "name": "resource.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the resource being acted upon.",
-                            "example": "test-pod-cdcws"
-                        },
-                        {
-                            "name": "resource.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of resource being acted upon.",
-                            "example": "service"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.api.behaviors",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
-                            "example": "[ \"cross-process\", \"rapid_background_polling\", \"multiple_polling_processes\", \"native_api\", \"shellcode\" ]"
-                        },
-                        {
-                            "name": "Ext.api.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the API, usually the name of the function or system call.",
-                            "example": "VirtualAlloc"
-                        },
-                        {
-                            "name": "Ext.api.summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The summary of the API call and its parameters.",
-                            "example": "VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )"
-                        },
-                        {
-                            "name": "Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.created_suspended",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "Ext.dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory allocation containing the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Original memory size requested when the memory was allocated.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-                            "example": "PRIVATE"
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The address where bytes_compressed begins.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether bytes_compressed is present in this event.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A sequence of signature names matched.",
-                            "example": "Windows.EICAR.Not-a-virus"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature identifier"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The first matching details."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The first matching details.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of file matching signature."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of file matching signature."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the first yara rule matched."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the first yara rule matched."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature version"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
-                            "example": "C:\\Windows\\System32\\mshtml.dll"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the file at mapped_path is an executable.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether an executable file was found in memory.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.region_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.region_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "Ext.memory_region.region_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of the memory region.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.memory_region.region_start_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 64 bytes at the region base address.",
-                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
-                        },
-                        {
-                            "name": "Ext.memory_region.region_state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-                            "example": "COMMIT"
-                        },
-                        {
-                            "name": "Ext.memory_region.strings",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Array of strings found within the memory region.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "Ext.services",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Services running in this process."
-                        },
-                        {
-                            "name": "Ext.session",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Session information for the current process"
-                        },
-                        {
-                            "name": "Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "args",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "entry_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "entry_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "entry_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.entry_meta.source.ip",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the source (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "entry_leader.entry_meta.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
-                        },
-                        {
-                            "name": "entry_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "entry_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "entry_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "entry_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "entry_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "entry_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "entry_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "entry_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "env_vars",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"PATH=/usr/local/bin:/usr/bin\", \"USER=ubuntu\"]"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "group_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "group_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "group_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "group_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "group_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "group_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "group_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "group_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "group_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "group_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "group_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "group_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "group_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "parent.Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "parent.Ext.dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "parent.Ext.dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "parent.Ext.dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "parent.Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "parent.Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "parent.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "parent.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
-                        },
-                        {
-                            "name": "parent.Ext.real.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
-                        },
-                        {
-                            "name": "parent.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "parent.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "parent.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "parent.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "parent.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "parent.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "parent.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "parent.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "parent.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "parent.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "parent.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "parent.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "parent.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "parent.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "parent.Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "parent.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "parent.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "parent.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "parent.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "parent.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "parent.exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "parent.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.group_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.group_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "parent.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "parent.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "parent.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "parent.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "parent.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "parent.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "parent.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "parent.pgid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.ppid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "parent.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.thread.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.thread.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "parent.title",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ]
-                        },
-                        {
-                            "name": "parent.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "parent.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "parent.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "parent.uptime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "parent.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "pgid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "ppid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "previous.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "previous.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "previous.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "session_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "session_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "session_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "session_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "session_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "session_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "session_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "session_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "session_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.instruction_pointer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The return address of this stack frame."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.memory_section.memory_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.memory_section.memory_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.memory_section.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.module_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The name of the DLL/module containing `instruction_pointer`.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.module_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path to the DLL/module containing `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.rva",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The module that installed the final API hook in the call stack."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_hook_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_hook_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_hook_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_hook_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The final non-win32 module in the call stack."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_user_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file name of the call_stack_final_user_module.",
-                            "example": "example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_user_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a trampoline was detected, this indicates the original content for the thread start address in memory.",
-                            "example": 4194304
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.",
-                            "example": "48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc"
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_bytes_disasm",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the disassembled code at the original thread start address.",
-                            "example": "mov rax, 0x4141414141414141\\njmp rax"
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_bytes_disasm_hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
-                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.",
-                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
-                        },
-                        {
-                            "name": "thread.Ext.parameter",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a thread is created, this is the raw numerical value of its parameter."
-                        },
-                        {
-                            "name": "thread.Ext.parameter_bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "thread.Ext.parameter_bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether parameter_bytes_compressed is present in this event."
-                        },
-                        {
-                            "name": "thread.Ext.service",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Service associated with the thread.",
-                            "example": "VaultSvc"
-                        },
-                        {
-                            "name": "thread.Ext.start",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "The time the thread started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "thread.Ext.start_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Memory address where the thread began execution.",
-                            "example": 4194304
-                        },
-                        {
-                            "name": "thread.Ext.start_address_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "thread.Ext.start_address_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.",
-                            "example": "c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
-                        },
-                        {
-                            "name": "thread.Ext.start_address_bytes_disasm",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The bytes at the thread start address, disassembled into human-readable assembly code.",
-                            "example": "ret\\nint3"
-                        },
-                        {
-                            "name": "thread.Ext.start_address_bytes_disasm_hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
-                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
-                        },
-                        {
-                            "name": "thread.Ext.start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The dll/module where the thread began execution.",
-                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
-                        },
-                        {
-                            "name": "thread.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "thread.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "thread.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "thread.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "thread.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "thread.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "thread.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "thread.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "thread.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "thread.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "thread.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "thread.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "thread.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "thread.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "thread.Ext.uptime",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Seconds since thread started."
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "title",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "working_directory",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "registry",
-                    "title": "Registry",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to Windows Registry operations.",
-                    "fields": [
-                        {
-                            "name": "data.strings",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "wildcard",
-                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
-                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path, including hive, key and value",
-                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
-                        },
-                        {
-                            "name": "value",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the value written.",
-                            "example": "Debugger"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "rule",
-                    "title": "Rule",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.",
-                    "fields": [
-                        {
-                            "name": "author",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.",
-                            "example": "[\"Star-Lord\"]"
-                        },
-                        {
-                            "name": "category",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A categorization value keyword used by the entity using the rule for detection of this event.",
-                            "example": "Attempted Information Leak"
-                        },
-                        {
-                            "name": "description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The description of the rule generating the event.",
-                            "example": "Block requests to public DNS over HTTPS / TLS protocols"
-                        },
-                        {
-                            "name": "id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
-                            "example": 101
-                        },
-                        {
-                            "name": "license",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the license under which the rule used to generate this event is made available.",
-                            "example": "Apache 2.0"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the rule or signature generating the event.",
-                            "example": "BLOCK_DNS_over_TLS"
-                        },
-                        {
-                            "name": "reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Reference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.",
-                            "example": "https://en.wikipedia.org/wiki/DNS_over_TLS"
-                        },
-                        {
-                            "name": "ruleset",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.",
-                            "example": "Standard_Protocol_Filters"
-                        },
-                        {
-                            "name": "uuid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.",
-                            "example": 1100110011
-                        },
-                        {
-                            "name": "version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version / revision of the rule being used for analysis.",
-                            "example": 1.1
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the source (IPv4 or IPv6)."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "threat",
-                    "title": "Threat",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.\nThese fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. \"impact\"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. \"endpoint denial of service\").",
-                    "fields": [
-                        {
-                            "name": "enrichments",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "A list of associated indicators objects enriching the event, and the context of that association/enrichment."
-                        },
-                        {
-                            "name": "enrichments.indicator",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Object containing associated indicators enriching the event."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy calculation of file's header and footer used to check file integrity."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.entry_modified",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.header_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.header_data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of malware_signature fieldset."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "The concatenated names of all yara signatures"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Malware artifact identifier."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of bytes representing yara signature matches"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature sha256."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature id."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature name."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of malware signature matches"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature version."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.monotonic_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "File event monotonic ID."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Original file information during a modification event."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.gid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.group",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.mode",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file mode prior to a modification event"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file name prior to a modification event"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.owner",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to a modification event"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.uid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.quarantine_message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Message describing quarantine results."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.quarantine_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint the quarantined file was originally."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.quarantine_result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean representing whether or not file quarantine succeeded."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.temp_file_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.windows",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Platform-specific Windows fields"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.windows.zone_identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Windows zone identifier for a file"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.accessed",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.attributes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
-                            "example": "[\"readonly\", \"system\"]"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.created",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "File creation time.\nNote that not all filesystems store the creation time."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.ctime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.device",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device that is the source of the file.",
-                            "example": "sda"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.drive_letter",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1,
-                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
-                            "example": "C"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Machine architecture of the ELF file.",
-                            "example": "x86-64"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.byte_order",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Byte sequence of ELF file.",
-                            "example": "Little Endian"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.cpu_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU type of the ELF file.",
-                            "example": "Intel"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.creation_date",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.exports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of exported element names and types."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.abi_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the ELF Application Binary Interface (ABI)."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.class",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Header class of the ELF file."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.data",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Data table of the ELF header."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.entrypoint",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Header entrypoint of the ELF file.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.object_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "\"0x1\" for original ELF files."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.os_abi",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Application Binary Interface (ABI) of the Linux OS."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Header type of the ELF file."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the ELF header."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.chi2",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Chi-square probability distribution of the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.flags",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List flags."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List name."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.physical_offset",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List offset."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List type."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.virtual_address",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List virtual address.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List virtual size.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.segments",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.segments.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF object segment sections."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.segments.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF object segment type."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.shared_libraries",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of shared libraries used by this ELF object."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.telfhash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "telfhash symbol hash for ELF file."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.extension",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.gid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.group",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.inode",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Inode representing the file in the filesystem.",
-                            "example": "256383"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.mime_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.mode",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode of the file in octal representation.",
-                            "example": "0640"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.mtime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file content was modified."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.owner",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
-                            "example": 16384
-                        },
-                        {
-                            "name": "enrichments.indicator.file.target_path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Target path for symlinks.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "enrichments.indicator.file.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File type (file, dir, or symlink).",
-                            "example": "file"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.uid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "enrichments.indicator.first_seen",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source first reported sighting this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.city_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.continent_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.country_iso_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.country_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.location",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.region_iso_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.region_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "enrichments.indicator.ip",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "ip",
-                            "description": "Identifies a threat indicator as an IP address (irrespective of direction).",
-                            "example": "1.2.3.4"
-                        },
-                        {
-                            "name": "enrichments.indicator.last_seen",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source last reported sighting this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.marking.tlp",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Traffic Light Protocol sharing markings.",
-                            "example": "CLEAR"
-                        },
-                        {
-                            "name": "enrichments.indicator.modified_at",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source last modified information for this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.port",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Identifies a threat indicator as a port number (irrespective of direction).",
-                            "example": 443
-                        },
-                        {
-                            "name": "enrichments.indicator.provider",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the indicator's provider.",
-                            "example": "lrz_urlhaus"
-                        },
-                        {
-                            "name": "enrichments.indicator.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Reference URL linking to additional information about this indicator.",
-                            "example": "https://system.example.com/indicator/0001234"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.data.bytes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
-                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.data.strings",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "wildcard",
-                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
-                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.data.type",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Standard registry type for encoding contents",
-                            "example": "REG_SZ"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.hive",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Abbreviated name for the hive.",
-                            "example": "HKLM"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.key",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hive-relative path of keys.",
-                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.path",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path, including hive, key and value",
-                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.value",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the value written.",
-                            "example": "Debugger"
-                        },
-                        {
-                            "name": "enrichments.indicator.scanner_stats",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Count of AV/EDR vendors that successfully detected malicious file or URL.",
-                            "example": 4
-                        },
-                        {
-                            "name": "enrichments.indicator.sightings",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Number of times this indicator was observed conducting threat activity.",
-                            "example": 20
-                        },
-                        {
-                            "name": "enrichments.indicator.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of indicator as represented by Cyber Observable in STIX 2.0.",
-                            "example": "ipv4-addr"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.",
-                            "example": "www.elastic.co"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.extension",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.fragment",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
-                        },
-                        {
-                            "name": "enrichments.indicator.url.full",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.original",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.password",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Password of the request."
-                        },
-                        {
-                            "name": "enrichments.indicator.url.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Path of the request, such as \"/search\"."
-                        },
-                        {
-                            "name": "enrichments.indicator.url.port",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Port of the request, such as 443.",
-                            "example": 443,
-                            "format": "string"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.query",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
-                        },
-                        {
-                            "name": "enrichments.indicator.url.registered_domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.scheme",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme.",
-                            "example": "https"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.subdomain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
-                            "example": "east"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.top_level_domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.username",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of the request."
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.alternative_names",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.",
-                            "example": "*.elastic.co"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.common_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of common name (CN) of issuing certificate authority.",
-                            "example": "Example SHA2 High Assurance Server CA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.country",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of country \\(C) codes",
-                            "example": "US"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.distinguished_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguished name (DN) of issuing certificate authority.",
-                            "example": "C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.locality",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of locality names (L)",
-                            "example": "Mountain View"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.organization",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizations (O) of issuing certificate authority.",
-                            "example": "Example Inc"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.organizational_unit",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizational units (OU) of issuing certificate authority.",
-                            "example": "www.example.com"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.state_or_province",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of state or province names (ST, S, or P)",
-                            "example": "California"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.not_after",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Time at which the certificate is no longer considered valid.",
-                            "example": "2020-07-16T03:15:39Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.not_before",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Time at which the certificate is first considered valid.",
-                            "example": "2019-08-16T01:40:25Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.public_key_algorithm",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Algorithm used to generate the public key.",
-                            "example": "RSA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.public_key_curve",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The curve used by the elliptic curve public key algorithm. This is algorithm specific.",
-                            "example": "nistp521"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.public_key_exponent",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Exponent used to derive the public key. This is algorithm specific.",
-                            "example": 65537,
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.public_key_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The size of the public key space in bits.",
-                            "example": 2048
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.serial_number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.",
-                            "example": "55FBB9C7DEBF09809D12CCAA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.signature_algorithm",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.",
-                            "example": "SHA256-RSA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.common_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of common names (CN) of subject.",
-                            "example": "shared.global.example.net"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.country",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of country \\(C) code",
-                            "example": "US"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.distinguished_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguished name (DN) of the certificate subject entity.",
-                            "example": "C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.locality",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of locality names (L)",
-                            "example": "San Francisco"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.organization",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizations (O) of subject.",
-                            "example": "Example, Inc."
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.organizational_unit",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizational units (OU) of subject."
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.state_or_province",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of state or province names (ST, S, or P)",
-                            "example": "California"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.version_number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of x509 format.",
-                            "example": 3
-                        },
-                        {
-                            "name": "enrichments.matched.atomic",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the atomic indicator value that matched a local environment endpoint or network event.",
-                            "example": "bad-domain.com"
-                        },
-                        {
-                            "name": "enrichments.matched.field",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the field of the atomic indicator that matched a local environment endpoint or network event.",
-                            "example": "file.hash.sha256"
-                        },
-                        {
-                            "name": "enrichments.matched.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the _id of the indicator document enriching the event.",
-                            "example": "ff93aee5-86a1-4a61-b0e6-0cdc313d01b5"
-                        },
-                        {
-                            "name": "enrichments.matched.index",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the _index of the indicator document enriching the event.",
-                            "example": "filebeat-8.0.0-2021.05.23-000011"
-                        },
-                        {
-                            "name": "enrichments.matched.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the type of match that caused the event to be enriched with the given indicator",
-                            "example": "indicator_match_rule"
-                        },
-                        {
-                            "name": "framework",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.",
-                            "example": "MITRE ATT&CK"
-                        },
-                        {
-                            "name": "group.alias",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group alias(es).",
-                            "example": "[ \"Magecart Group 6\" ]"
-                        },
-                        {
-                            "name": "group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group id.",
-                            "example": "G0037"
-                        },
-                        {
-                            "name": "group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group name.",
-                            "example": "FIN6"
-                        },
-                        {
-                            "name": "group.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group reference URL.",
-                            "example": "https://attack.mitre.org/groups/G0037/"
-                        },
-                        {
-                            "name": "indicator.as.number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
-                            "example": 15169
-                        },
-                        {
-                            "name": "indicator.as.organization.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Organization name.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "Google LLC"
-                        },
-                        {
-                            "name": "indicator.confidence",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.",
-                            "example": "Medium"
-                        },
-                        {
-                            "name": "indicator.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Describes the type of action conducted by the threat.",
-                            "example": "IP x.x.x.x was observed delivering the Angler EK."
-                        },
-                        {
-                            "name": "indicator.email.address",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies a threat indicator as an email address (irrespective of direction).",
-                            "example": "phish@example.com"
-                        },
-                        {
-                            "name": "indicator.file.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "indicator.file.Ext.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy calculation of file's header and footer used to check file integrity."
-                        },
-                        {
-                            "name": "indicator.file.Ext.entry_modified",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
-                        },
-                        {
-                            "name": "indicator.file.Ext.header_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "indicator.file.Ext.header_data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of malware_signature fieldset."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "The concatenated names of all yara signatures"
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Malware artifact identifier."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of bytes representing yara signature matches"
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature hash."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature sha256."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature id."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature name."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of malware signature matches"
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature version."
-                        },
-                        {
-                            "name": "indicator.file.Ext.monotonic_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "File event monotonic ID."
-                        },
-                        {
-                            "name": "indicator.file.Ext.original",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Original file information during a modification event."
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.gid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.group",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.mode",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file mode prior to a modification event"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file name prior to a modification event"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.owner",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to a modification event"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.uid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "indicator.file.Ext.quarantine_message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Message describing quarantine results."
-                        },
-                        {
-                            "name": "indicator.file.Ext.quarantine_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint the quarantined file was originally."
-                        },
-                        {
-                            "name": "indicator.file.Ext.quarantine_result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean representing whether or not file quarantine succeeded."
-                        },
-                        {
-                            "name": "indicator.file.Ext.temp_file_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
-                        },
-                        {
-                            "name": "indicator.file.Ext.windows",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Platform-specific Windows fields"
-                        },
-                        {
-                            "name": "indicator.file.Ext.windows.zone_identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Windows zone identifier for a file"
-                        },
-                        {
-                            "name": "indicator.file.accessed",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-                        },
-                        {
-                            "name": "indicator.file.attributes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
-                            "example": "[\"readonly\", \"system\"]"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.created",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "File creation time.\nNote that not all filesystems store the creation time."
-                        },
-                        {
-                            "name": "indicator.file.ctime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-                        },
-                        {
-                            "name": "indicator.file.device",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device that is the source of the file.",
-                            "example": "sda"
-                        },
-                        {
-                            "name": "indicator.file.directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "indicator.file.drive_letter",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1,
-                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
-                            "example": "C"
-                        },
-                        {
-                            "name": "indicator.file.elf.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Machine architecture of the ELF file.",
-                            "example": "x86-64"
-                        },
-                        {
-                            "name": "indicator.file.elf.byte_order",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Byte sequence of ELF file.",
-                            "example": "Little Endian"
-                        },
-                        {
-                            "name": "indicator.file.elf.cpu_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU type of the ELF file.",
-                            "example": "Intel"
-                        },
-                        {
-                            "name": "indicator.file.elf.creation_date",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
-                        },
-                        {
-                            "name": "indicator.file.elf.exports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of exported element names and types."
-                        },
-                        {
-                            "name": "indicator.file.elf.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "indicator.file.elf.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "indicator.file.elf.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.abi_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the ELF Application Binary Interface (ABI)."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.class",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Header class of the ELF file."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.data",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Data table of the ELF header."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.entrypoint",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Header entrypoint of the ELF file.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "indicator.file.elf.header.object_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "\"0x1\" for original ELF files."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.os_abi",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Application Binary Interface (ABI) of the Linux OS."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Header type of the ELF file."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the ELF header."
-                        },
-                        {
-                            "name": "indicator.file.elf.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "indicator.file.elf.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "indicator.file.elf.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.chi2",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Chi-square probability distribution of the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.flags",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List flags."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List name."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.physical_offset",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List offset."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List type."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.virtual_address",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List virtual address.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List virtual size.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "indicator.file.elf.segments",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
-                        },
-                        {
-                            "name": "indicator.file.elf.segments.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF object segment sections."
-                        },
-                        {
-                            "name": "indicator.file.elf.segments.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF object segment type."
-                        },
-                        {
-                            "name": "indicator.file.elf.shared_libraries",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of shared libraries used by this ELF object."
-                        },
-                        {
-                            "name": "indicator.file.elf.telfhash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "telfhash symbol hash for ELF file."
-                        },
-                        {
-                            "name": "indicator.file.extension",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "indicator.file.gid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "indicator.file.group",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "indicator.file.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "indicator.file.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "indicator.file.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "indicator.file.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "indicator.file.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "indicator.file.inode",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Inode representing the file in the filesystem.",
-                            "example": "256383"
-                        },
-                        {
-                            "name": "indicator.file.mime_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-                        },
-                        {
-                            "name": "indicator.file.mode",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode of the file in octal representation.",
-                            "example": "0640"
-                        },
-                        {
-                            "name": "indicator.file.mtime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file content was modified."
-                        },
-                        {
-                            "name": "indicator.file.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "indicator.file.owner",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "indicator.file.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "indicator.file.pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "indicator.file.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "indicator.file.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "indicator.file.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "indicator.file.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "indicator.file.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "indicator.file.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "indicator.file.size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
-                            "example": 16384
-                        },
-                        {
-                            "name": "indicator.file.target_path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Target path for symlinks.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "indicator.file.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File type (file, dir, or symlink).",
-                            "example": "file"
-                        },
-                        {
-                            "name": "indicator.file.uid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "indicator.first_seen",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source first reported sighting this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "indicator.geo.city_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "indicator.geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "indicator.geo.continent_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "indicator.geo.country_iso_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "indicator.geo.country_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "indicator.geo.location",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "indicator.geo.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "indicator.geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "indicator.geo.region_iso_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "indicator.geo.region_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "indicator.geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "indicator.ip",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "ip",
-                            "description": "Identifies a threat indicator as an IP address (irrespective of direction).",
-                            "example": "1.2.3.4"
-                        },
-                        {
-                            "name": "indicator.last_seen",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source last reported sighting this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "indicator.marking.tlp",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Traffic Light Protocol sharing markings.",
-                            "example": "CLEAR"
-                        },
-                        {
-                            "name": "indicator.modified_at",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source last modified information for this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "indicator.port",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Identifies a threat indicator as a port number (irrespective of direction).",
-                            "example": 443
-                        },
-                        {
-                            "name": "indicator.provider",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the indicator's provider.",
-                            "example": "lrz_urlhaus"
-                        },
-                        {
-                            "name": "indicator.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Reference URL linking to additional information about this indicator.",
-                            "example": "https://system.example.com/indicator/0001234"
-                        },
-                        {
-                            "name": "indicator.registry.data.bytes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
-                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
-                        },
-                        {
-                            "name": "indicator.registry.data.strings",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "wildcard",
-                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
-                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
-                        },
-                        {
-                            "name": "indicator.registry.data.type",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Standard registry type for encoding contents",
-                            "example": "REG_SZ"
-                        },
-                        {
-                            "name": "indicator.registry.hive",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Abbreviated name for the hive.",
-                            "example": "HKLM"
-                        },
-                        {
-                            "name": "indicator.registry.key",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hive-relative path of keys.",
-                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
-                        },
-                        {
-                            "name": "indicator.registry.path",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path, including hive, key and value",
-                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
-                        },
-                        {
-                            "name": "indicator.registry.value",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the value written.",
-                            "example": "Debugger"
-                        },
-                        {
-                            "name": "indicator.scanner_stats",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Count of AV/EDR vendors that successfully detected malicious file or URL.",
-                            "example": 4
-                        },
-                        {
-                            "name": "indicator.sightings",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Number of times this indicator was observed conducting threat activity.",
-                            "example": 20
-                        },
-                        {
-                            "name": "indicator.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of indicator as represented by Cyber Observable in STIX 2.0.",
-                            "example": "ipv4-addr"
-                        },
-                        {
-                            "name": "indicator.url.domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.",
-                            "example": "www.elastic.co"
-                        },
-                        {
-                            "name": "indicator.url.extension",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "indicator.url.fragment",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
-                        },
-                        {
-                            "name": "indicator.url.full",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top"
-                        },
-                        {
-                            "name": "indicator.url.original",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch"
-                        },
-                        {
-                            "name": "indicator.url.password",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Password of the request."
-                        },
-                        {
-                            "name": "indicator.url.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Path of the request, such as \"/search\"."
-                        },
-                        {
-                            "name": "indicator.url.port",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Port of the request, such as 443.",
-                            "example": 443,
-                            "format": "string"
-                        },
-                        {
-                            "name": "indicator.url.query",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
-                        },
-                        {
-                            "name": "indicator.url.registered_domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "indicator.url.scheme",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme.",
-                            "example": "https"
-                        },
-                        {
-                            "name": "indicator.url.subdomain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
-                            "example": "east"
-                        },
-                        {
-                            "name": "indicator.url.top_level_domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        },
-                        {
-                            "name": "indicator.url.username",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of the request."
-                        },
-                        {
-                            "name": "indicator.x509.alternative_names",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.",
-                            "example": "*.elastic.co"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.common_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of common name (CN) of issuing certificate authority.",
-                            "example": "Example SHA2 High Assurance Server CA"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.country",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of country \\(C) codes",
-                            "example": "US"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.distinguished_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguished name (DN) of issuing certificate authority.",
-                            "example": "C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.locality",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of locality names (L)",
-                            "example": "Mountain View"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.organization",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizations (O) of issuing certificate authority.",
-                            "example": "Example Inc"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.organizational_unit",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizational units (OU) of issuing certificate authority.",
-                            "example": "www.example.com"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.state_or_province",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of state or province names (ST, S, or P)",
-                            "example": "California"
-                        },
-                        {
-                            "name": "indicator.x509.not_after",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Time at which the certificate is no longer considered valid.",
-                            "example": "2020-07-16T03:15:39Z"
-                        },
-                        {
-                            "name": "indicator.x509.not_before",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Time at which the certificate is first considered valid.",
-                            "example": "2019-08-16T01:40:25Z"
-                        },
-                        {
-                            "name": "indicator.x509.public_key_algorithm",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Algorithm used to generate the public key.",
-                            "example": "RSA"
-                        },
-                        {
-                            "name": "indicator.x509.public_key_curve",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The curve used by the elliptic curve public key algorithm. This is algorithm specific.",
-                            "example": "nistp521"
-                        },
-                        {
-                            "name": "indicator.x509.public_key_exponent",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Exponent used to derive the public key. This is algorithm specific.",
-                            "example": 65537,
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "indicator.x509.public_key_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The size of the public key space in bits.",
-                            "example": 2048
-                        },
-                        {
-                            "name": "indicator.x509.serial_number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.",
-                            "example": "55FBB9C7DEBF09809D12CCAA"
-                        },
-                        {
-                            "name": "indicator.x509.signature_algorithm",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.",
-                            "example": "SHA256-RSA"
-                        },
-                        {
-                            "name": "indicator.x509.subject.common_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of common names (CN) of subject.",
-                            "example": "shared.global.example.net"
-                        },
-                        {
-                            "name": "indicator.x509.subject.country",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of country \\(C) code",
-                            "example": "US"
-                        },
-                        {
-                            "name": "indicator.x509.subject.distinguished_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguished name (DN) of the certificate subject entity.",
-                            "example": "C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net"
-                        },
-                        {
-                            "name": "indicator.x509.subject.locality",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of locality names (L)",
-                            "example": "San Francisco"
-                        },
-                        {
-                            "name": "indicator.x509.subject.organization",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizations (O) of subject.",
-                            "example": "Example, Inc."
-                        },
-                        {
-                            "name": "indicator.x509.subject.organizational_unit",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizational units (OU) of subject."
-                        },
-                        {
-                            "name": "indicator.x509.subject.state_or_province",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of state or province names (ST, S, or P)",
-                            "example": "California"
-                        },
-                        {
-                            "name": "indicator.x509.version_number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of x509 format.",
-                            "example": 3
-                        },
-                        {
-                            "name": "software.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software id.",
-                            "example": "S0552"
-                        },
-                        {
-                            "name": "software.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software name.",
-                            "example": "AdFind"
-                        },
-                        {
-                            "name": "software.platforms",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use MITRE ATT&CK® software platform values.",
-                            "example": "[ \"Windows\" ]"
-                        },
-                        {
-                            "name": "software.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software reference URL.",
-                            "example": "https://attack.mitre.org/software/S0552/"
-                        },
-                        {
-                            "name": "software.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software type.",
-                            "example": "Tool"
-                        },
-                        {
-                            "name": "tactic.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )",
-                            "example": "TA0002"
-                        },
-                        {
-                            "name": "tactic.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)",
-                            "example": "Execution"
-                        },
-                        {
-                            "name": "tactic.reference",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )",
-                            "example": "https://attack.mitre.org/tactics/TA0002/"
-                        },
-                        {
-                            "name": "technique.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
-                            "example": "T1059"
-                        },
-                        {
-                            "name": "technique.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Command and Scripting Interpreter"
-                        },
-                        {
-                            "name": "technique.reference",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
-                            "example": "https://attack.mitre.org/techniques/T1059/"
-                        },
-                        {
-                            "name": "technique.subtechnique.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
-                            "example": "T1059.001"
-                        },
-                        {
-                            "name": "technique.subtechnique.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "PowerShell"
-                        },
-                        {
-                            "name": "technique.subtechnique.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
-                            "example": "https://attack.mitre.org/techniques/T1059/001/"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "build": {
-                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-                    },
-                    "id": "2b1eb7f7-bd61-436a-98af-c2b182043476",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "container": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "image": {
-                        "name": "docker.io/library/nginx",
-                        "tag": "latest"
-                    },
-                    "name": "nginx"
-                },
-                "cloud": {
-                    "account": {
-                        "id": "1234"
-                    },
-                    "instance": {
-                        "name": "webserver-12"
-                    },
-                    "project": {
-                        "id": "1234"
-                    },
-                    "provider": "aws",
-                    "region": "us-east-1"
-                },
-                "orchestrator": {
-                    "cluster": {
-                        "name": "webservers"
-                    },
-                    "namespace": "webapp",
-                    "resource": {
-                        "name": "webservers",
-                        "type": "kubernetes"
-                    }
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw"
-                        ],
-                        "protection": "PsProtectedSignerWinSystem",
-                        "user": "SYSTEM",
-                        "architecture": "x86_64",
-                        "token": {
-                            "elevation": true,
-                            "integrity_level_name": "system",
-                            "domain": "NT AUTHORITY",
-                            "user": "SYSTEM",
-                            "elevation_type": "default",
-                            "sid": "S-1-5-18"
-                        },
-                        "memory_region": {
-                            "region_size": 4096,
-                            "region_protection": "RWX",
-                            "allocation_base": 2401471234048,
-                            "allocation_type": "PRIVATE",
-                            "bytes_allocation_offset": 0,
-                            "region_state": "COMMIT",
-                            "bytes_compressed_present": false,
-                            "region_start_bytes": "58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124",
-                            "allocation_protection": "RW-",
-                            "region_base": 2401471238144,
-                            "allocation_size": 8192,
-                            "bytes_address": 2401471234048
-                        }
-                    },
-                    "parent": {
-                        "Ext": {
-                            "protection": "",
-                            "user": "",
-                            "architecture": "unknown"
-                        },
-                        "name": "System Idle Process",
-                        "start": "2022-04-04T12:15:41.4606245Z",
-                        "pid": 0,
-                        "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
-                        "command_line": "",
-                        "executable": "",
-                        "ppid": 0,
-                        "uptime": 822
-                    },
-                    "pe": {},
-                    "name": "System",
-                    "start": "2022-04-04T12:15:41.4606245Z",
-                    "pid": 4,
-                    "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTQtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
-                    "command_line": "",
-                    "executable": "",
-                    "thread": {
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "instruction_pointer": 140705188471348,
-                                    "memory_section": {
-                                        "memory_address": 140705187827712,
-                                        "memory_size": 1163264,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "ntdll.dll",
-                                    "module_path": "c:\\windows\\system32\\ntdll.dll",
-                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!NtAlpcSendWaitReceivePort+0x14"
-                                },
-                                {
-                                    "instruction_pointer": 140705158956066,
-                                    "memory_section": {
-                                        "memory_address": 140705158664192,
-                                        "memory_size": 921600,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "rpcrt4.dll",
-                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879048422"
-                                },
-                                {
-                                    "instruction_pointer": 140705158944113,
-                                    "memory_section": {
-                                        "memory_address": 140705158664192,
-                                        "memory_size": 921600,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "rpcrt4.dll",
-                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879045571"
-                                },
-                                {
-                                    "instruction_pointer": 140705158854463,
-                                    "memory_section": {
-                                        "memory_address": 140705158664192,
-                                        "memory_size": 921600,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "rpcrt4.dll",
-                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF87902F73F"
-                                },
-                                {
-                                    "instruction_pointer": 140705155101013,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9B155"
-                                },
-                                {
-                                    "instruction_pointer": 140705155097096,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9A208"
-                                },
-                                {
-                                    "instruction_pointer": 140705155090820,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C98984"
-                                },
-                                {
-                                    "instruction_pointer": 140705155093243,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C992FB"
-                                },
-                                {
-                                    "instruction_pointer": 140705155073556,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C94614"
-                                },
-                                {
-                                    "instruction_pointer": 140705155277630,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC633E"
-                                },
-                                {
-                                    "instruction_pointer": 140705158666224,
-                                    "memory_section": {
-                                        "memory_address": 140705158664192,
-                                        "memory_size": 921600,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "rpcrt4.dll",
-                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF8790017F0"
-                                },
-                                {
-                                    "instruction_pointer": 140705155255496,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC0CC8"
-                                },
-                                {
-                                    "instruction_pointer": 140705155775858,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878D3FD72"
-                                },
-                                {
-                                    "instruction_pointer": 140704876148243,
-                                    "memory_section": {
-                                        "memory_address": 140704875483136,
-                                        "memory_size": 708608,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "fastprox.dll",
-                                    "module_path": "c:\\windows\\system32\\wbem\\fastprox.dll",
-                                    "symbol_info": "c:\\windows\\system32\\wbem\\fastprox.dll!0x7FF868293613"
-                                },
-                                {
-                                    "instruction_pointer": 140699640718787,
-                                    "memory_section": {
-                                        "memory_address": 140699634241536,
-                                        "memory_size": 9220096,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "alertstests.exe",
-                                    "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
-                                    "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301AE5C3"
-                                },
-                                {
-                                    "instruction_pointer": 140699640807495,
-                                    "memory_section": {
-                                        "memory_address": 140699634241536,
-                                        "memory_size": 9220096,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "alertstests.exe",
-                                    "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
-                                    "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301C4047"
-                                },
-                                {
-                                    "instruction_pointer": 140705160001044,
-                                    "memory_section": {
-                                        "memory_address": 140705159909376,
-                                        "memory_size": 520192,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "kernel32.dll",
-                                    "module_path": "c:\\windows\\system32\\kernel32.dll",
-                                    "symbol_info": "c:\\windows\\system32\\kernel32.dll!BaseThreadInitThunk+0x14"
-                                },
-                                {
-                                    "instruction_pointer": 140705188161185,
-                                    "memory_section": {
-                                        "memory_address": 140705187827712,
-                                        "memory_size": 1163264,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "ntdll.dll",
-                                    "module_path": "c:\\windows\\system32\\ntdll.dll",
-                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                }
-                            ],
-                            "call_stack_final_hook_module": {
-                                "code_signature": [
-                                    {
-                                        "exists": true,
-                                        "status": "trusted",
-                                        "subject_name": "Microsoft Corporation",
-                                        "trusted": true
-                                    }
-                                ],
-                                "hash": {
-                                    "sha256": "e5bfc1a2967fa513177a0327770927d9a2efa5a4f33ac18f716bae7c3f857994"
-                                },
-                                "path": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\131.0.2903.112\\msedge_elf.dll"
-                            },
-                            "call_stack_final_user_module": {
-                                "code_signature": [
-                                    {
-                                        "exists": true,
-                                        "status": "trusted",
-                                        "subject_name": "Microsoft Windows",
-                                        "trusted": true
-                                    }
-                                ],
-                                "hash": {
-                                    "sha256": "8c9740e7fe9c97d5782b8d3db102c7880c40f0b27f20d3ec9f334fe0161b7e55"
-                                },
-                                "name": "rpcrt4.dll",
-                                "path": "c:\\windows\\system32\\rpcrt4.dll"
-                            },
-                            "call_stack_summary": "ntdll.dll, rpcrt4.dll, combase.dll, rpcrt4.dll, combase.dll, fastprox.dll, alertstests.exe, kernel32.dll, ntdll.dll",
-                            "hardware_breakpoint_set": true,
-                            "start_address": 140699640807104,
-                            "start_address_module": "C:\\Users\\vagrant\\endpoint-dev\\Build\\_WS-vs2019-x64-dbg\\AlertsTests\\Debug\\AlertsTests.exe"
-                        },
-                        "id": 5752
-                    },
-                    "uptime": 822
-                },
-                "rule": {
-                    "ruleset": "production"
-                },
-                "message": "Malware Prevention Alert",
-                "@timestamp": "2022-04-04T12:15:41.5944062Z",
-                "file": {
-                    "Ext": {
-                        "temp_file_path": "C:\\Windows\\TEMP\\90edbe42-fe6c-4965-8a6b-222aa2b15cf2",
-                        "code_signature": [
-                            {
-                                "exists": false
-                            }
-                        ],
-                        "quarantine_path": "C:\\.equarantine\\20a65f043449c96f10e538a860a415b55ff46c93",
-                        "quarantine_message": "Success",
-                        "quarantine_result": true,
-                        "malware_classification": {
-                            "identifier": "endpointpe-v4-model",
-                            "score": 0.692318737506866,
-                            "threshold": 0.58,
-                            "version": "4.0.19000"
-                        }
-                    },
-                    "owner": "Administrators",
-                    "extension": "dll",
-                    "drive_letter": "C",
-                    "created": "2022-04-04T12:15:41.4606245Z",
-                    "accessed": "2022-04-04T12:15:41.4606245Z",
-                    "mtime": "2022-04-04T12:15:41.4606245Z",
-                    "directory": "C:\\sysmon",
-                    "path": "C:\\sysmon\\9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
-                    "code_signature": {
-                        "exists": false
-                    },
-                    "size": 4608,
-                    "pe": {
-                        "file_version": "0.0.0.0",
-                        "description": " ",
-                        "original_file_name": "5t5mpwxc.dll",
-                        "Ext": {
-                            "dotnet": true,
-                            "streams": [
-                                {
-                                    "name": "#~",
-                                    "hash": {
-                                        "md5": "debf08c09d49337fbe7acde4d3749242",
-                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
-                                    }
-                                },
-                                {
-                                    "name": "#Blob",
-                                    "hash": {
-                                        "md5": "debf08c09d49337fbe7acde4d3749242",
-                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
-                                    }
-                                }
-                            ],
-                            "sections": [
-                                {
-                                    "name": ".reloc",
-                                    "hash": {
-                                        "md5": "debf08c09d49337fbe7acde4d3749242",
-                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
-                                    }
-                                }
-                            ]
-                        }
-                    },
-                    "name": "9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
-                    "hash": {
-                        "sha1": "9c0e42a47d34240a9a4101cc5d3bc5787dc5ad73",
-                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53",
-                        "md5": "debf08c09d49337fbe7acde4d3749242"
-                    }
-                },
-                "Endpoint": {
-                    "policy": {
-                        "applied": {
-                            "artifacts": {
-                                "global": {
-                                    "identifiers": [
-                                        {
-                                            "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
-                                            "name": "diagnostic-configuration-v1"
-                                        },
-                                        {
-                                            "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
-                                            "name": "diagnostic-endpointpe-v4-blocklist"
-                                        },
-                                        {
-                                            "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
-                                            "name": "diagnostic-endpointpe-v4-exceptionlist"
-                                        },
-                                        {
-                                            "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
-                                            "name": "diagnostic-endpointpe-v4-model"
-                                        },
-                                        {
-                                            "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
-                                            "name": "diagnostic-malware-signature-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
-                                            "name": "diagnostic-ransomware-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
-                                            "name": "diagnostic-rules-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
-                                            "name": "endpointpe-v4-blocklist"
-                                        },
-                                        {
-                                            "sha256": "d784c2aa70a2216dd5bfeecfdd67a83ff5b656e9321bd70cf345a8667a63fb2e",
-                                            "name": "endpointpe-v4-exceptionlist"
-                                        },
-                                        {
-                                            "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
-                                            "name": "endpointpe-v4-model"
-                                        },
-                                        {
-                                            "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
-                                            "name": "global-configuration-v1"
-                                        },
-                                        {
-                                            "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
-                                            "name": "global-exceptionlist-windows"
-                                        },
-                                        {
-                                            "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
-                                            "name": "global-trustlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
-                                            "name": "production-malware-signature-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
-                                            "name": "production-ransomware-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
-                                            "name": "production-rules-windows-v1"
-                                        }
-                                    ],
-                                    "update_age": 0,
-                                    "snapshot": "2023-09-26",
-                                    "version": "1.0.260"
-                                },
-                                "user": {
-                                    "identifiers": [
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-blocklist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-eventfilterlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-exceptionlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-hostisolationexceptionlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-trustlist-windows-v1"
-                                        }
-                                    ],
-                                    "version": "1.0.0"
-                                }
-                            }
-                        }
-                    }
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.alerts"
-                },
-                "elastic": {
-                    "agent": {
-                        "id": "2b1eb7f7-bd61-436a-98af-c2b182043476"
-                    }
-                },
-                "host": {
-                    "hostname": "security-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.34",
-                        "fe80::4850:4f4f:4b53:8103",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "security-win-1",
-                    "id": "bbea673e-eae6-4b03-8724-2183f79da331",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "severity": 73,
-                    "code": "malicious_file",
-                    "risk_score": 73,
-                    "created": "2022-04-04T12:15:41.5944062Z",
-                    "kind": "alert",
-                    "module": "endpoint",
-                    "type": [
-                        "info",
-                        "change",
-                        "denied"
-                    ],
-                    "agent_id_status": "verified",
-                    "sequence": 29414,
-                    "ingested": "2022-04-04T12:19:33Z",
-                    "action": "rename",
-                    "id": "MYfSjQEEEFe1o09b+++++D5Q",
-                    "category": [
-                        "malware",
-                        "intrusion_detection",
-                        "file"
-                    ],
-                    "dataset": "endpoint.alerts",
-                    "outcome": "success"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM"
-                },
-                "Memory_protection": {
-                    "cross_session": false,
-                    "feature": "shellcode_thread",
-                    "parent_to_child": false,
-                    "self_injection": false,
-                    "unique_key_v2": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
-                },
-                "Responses": [
-                    {
-                        "@timestamp": "2023-04-13T16:15:16.0Z",
-                        "action": {
-                            "action": "file_rollback",
-                            "file": {
-                                "attributes": [
-                                    "invalid"
-                                ],
-                                "path": "",
-                                "reason": 2147484160
-                            },
-                            "source": {
-                                "attributes": [
-                                    "archive"
-                                ],
-                                "path": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy55\\git\\endpoint-dev\\Python\\runtime\\failed_test_logs\\20230413_181248\\EndpointRollbackTestCase\\test_rollback_trigger_malware_1_prevent\\tmp\\TRA14KA5Z2\\ExceptionlistTester-Windows.1d1phoq97d"
-                            }
-                        },
-                        "message": "Successful production rollback",
-                        "result": 0
-                    },
-                    {
-                        "@timestamp": "2023-04-13T16:15:16.0Z",
-                        "action": {
-                            "action": "registry_rollback",
-                            "key": {
-                                "actions": [
-                                    "Deleted"
-                                ],
-                                "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback\\1"
-                            }
-                        },
-                        "message": "Successful production registry rollback",
-                        "result": 0
-                    },
-                    {
-                        "@timestamp": "2023-04-13T16:15:16.0Z",
-                        "action": {
-                            "action": "registry_rollback",
-                            "key": {
-                                "actions": [
-                                    "Modified"
-                                ],
-                                "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback.valuetest",
-                                "values": [
-                                    {
-                                        "actions": [
-                                            "Deleted"
-                                        ],
-                                        "name": "SomeValue"
-                                    }
-                                ]
-                            }
-                        }
-                    },
-                    {
-                        "@timestamp": "2023-07-19T14:21:05.0Z",
-                        "action": {
-                            "action": "process_rollback",
-                            "process": {
-                                "path": "C:\\Users\\Pawel Mirski\\AppData\\Local\\Programs\\Python\\Python38-32\\python.exe"
-                            }
-                        },
-                        "message": "Successful production process rollback",
-                        "result": 0
-                    }
-                ]
-            }
-        },
-        {
-            "name": "policy",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Endpoint",
-                    "title": "Endpoint",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
-                    "fields": [
-                        {
-                            "name": "configuration",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
-                        },
-                        {
-                            "name": "configuration.isolation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Configuration setting for Host Isolation from the network"
-                        },
-                        {
-                            "name": "policy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The policy fields are used to hold information about applied policy."
-                        },
-                        {
-                            "name": "policy.applied",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about the policy that is applied"
-                        },
-                        {
-                            "name": "policy.applied.actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "actions applied during the application of the policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.actions.message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "message about the application of the action to further qualify the status of the action"
-                        },
-                        {
-                            "name": "policy.applied.actions.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "name of the action that was applied"
-                        },
-                        {
-                            "name": "policy.applied.actions.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the status of the action"
-                        },
-                        {
-                            "name": "policy.applied.artifacts",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about global protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.channel",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "global artifacts rollout channel"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "the identifiers of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of global artifact applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the sha256 of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.snapshot",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the snapshot date of applied global artifacts or 'latest'"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.update_age",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "number of days since global artifacts were made up-to-date"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about user protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "the identifiers of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of user artifact applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the sha256 of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.endpoint_policy_version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of this applied policy"
-                        },
-                        {
-                            "name": "policy.applied.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the id of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of this applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "the response of actions that failed in the applied policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.response.configurations",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "the configurations of the applied policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.antivirus_registration",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall antivirus registration configuration and status of the applied policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.antivirus_registration.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for antivirus registration"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.antivirus_registration.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.attack_surface_reduction.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for attack surface reduction"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.attack_surface_reduction.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.behavior_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for behavior_protection"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.behavior_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.events",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall event collection configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.events.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for event collection"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.events.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.host_isolation.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for host isolation"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.host_isolation.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.logging",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall logging configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.logging.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for logging"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.logging.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.malware",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall malware configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.malware.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for malware"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.malware.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.memory_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall memory_protection configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.memory_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for memory_protection"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.memory_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.ransomware.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for ransomware"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.ransomware.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.streaming",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall data streaming configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.streaming.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for data streaming"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.streaming.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "the diagnostic configurations of the applied policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.behavior_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of behavior protection"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.behavior_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.credential_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of credential protection"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.credential_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of credential protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.malware.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of malware"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.malware.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.memory_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of memory protection"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.memory_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.memory_scan.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of memory scan"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.memory_scan.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of memory scan, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.ransomware.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of ransomware"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.ransomware.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of this applied policy"
-                        },
-                        {
-                            "name": "state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
-                        },
-                        {
-                            "name": "state.isolation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Current network isolation state of the host"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "build.original",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Extended build information for the agent.\nThis field is intended to contain any build information that a data source may provide, no specific formatting is required.",
-                            "example": "metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "build": {
-                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-                    },
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "message": "Endpoint policy change",
-                "@timestamp": "2022-04-04T18:38:15.7178887Z",
-                "Endpoint": {
-                    "configuration": {
-                        "isolation": false
-                    },
-                    "state": {
-                        "isolation": false
-                    },
-                    "policy": {
-                        "applied": {
-                            "response": {
-                                "configurations": {
-                                    "behavior_protection": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "configure_file_events",
-                                            "configure_network_events",
-                                            "configure_process_events",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "configure_imageload_events",
-                                            "configure_dns_events",
-                                            "configure_security_events",
-                                            "configure_registry_events",
-                                            "configure_malicious_behavior"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "streaming": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "configure_output",
-                                            "workflow"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "malware": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "configure_malware",
-                                            "configure_kernel",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "connect_kernel",
-                                            "configure_user_notification",
-                                            "configure_alerts",
-                                            "detect_file_open_events",
-                                            "detect_sync_image_load_events"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "logging": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "configure_logging",
-                                            "workflow"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "antivirus_registration": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "configure_antivirus_registration",
-                                            "workflow"
-                                        ],
-                                        "status": "unsupported"
-                                    },
-                                    "host_isolation": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "configure_host_isolation",
-                                            "load_config",
-                                            "workflow",
-                                            "connect_kernel",
-                                            "configure_user_notification"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "events": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "detect_network_events",
-                                            "configure_file_events",
-                                            "configure_network_events",
-                                            "configure_process_events",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "detect_file_open_events",
-                                            "detect_file_access_events",
-                                            "detect_async_image_load_events",
-                                            "detect_registry_events",
-                                            "detect_registry_access_events",
-                                            "configure_imageload_events",
-                                            "configure_dns_events",
-                                            "configure_security_events",
-                                            "configure_registry_events"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "ransomware": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "configure_process_events",
-                                            "configure_file_events",
-                                            "configure_ransomware",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "configure_user_notification"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "memory_protection": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "configure_memory_threat",
-                                            "configure_process_events",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "workflow",
-                                            "load_config",
-                                            "detect_process_events",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "detect_thread_events"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "attack_surface_reduction": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "configure_credential_hardening",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "workflow",
-                                            "load_config",
-                                            "configure_kernel",
-                                            "connect_kernel"
-                                        ],
-                                        "status": "success"
-                                    }
-                                },
-                                "diagnostic": {
-                                    "behavior_protection": {
-                                        "concerned_actions": [
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "configure_file_events",
-                                            "configure_network_events",
-                                            "configure_process_events",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "configure_imageload_events",
-                                            "configure_dns_events",
-                                            "configure_security_events",
-                                            "configure_registry_events",
-                                            "configure_diagnostic_rollback",
-                                            "detect_process_handle_events",
-                                            "configure_diagnostic_malicious_behavior"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "malware": {
-                                        "concerned_actions": [
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "configure_diagnostic_malware",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "connect_kernel",
-                                            "configure_kernel",
-                                            "detect_file_open_events",
-                                            "detect_sync_image_load_events",
-                                            "configure_diagnostic_rollback"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "ransomware": {
-                                        "concerned_actions": [
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "configure_process_events",
-                                            "configure_file_events",
-                                            "configure_diagnostic_ransomware",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "configure_diagnostic_rollback"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "memory_protection": {
-                                        "concerned_actions": [
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "detect_process_events",
-                                            "configure_process_events",
-                                            "configure_diagnostic_memory_threat",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "detect_thread_events",
-                                            "configure_diagnostic_rollback"
-                                        ],
-                                        "status": "success"
-                                    }
-                                }
-                            },
-                            "name": "endpoint-1",
-                            "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
-                            "actions": [
-                                {
-                                    "name": "configure_antivirus_registration",
-                                    "message": "Antivirus registration is not possible on servers",
-                                    "status": "unsupported"
-                                },
-                                {
-                                    "name": "configure_ransomware",
-                                    "message": "Successfully enabled ransomware prevention with mbr enabled and canaries enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_memory_threat",
-                                    "message": "Successfully enabled memory threat prevention with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_memory_threat",
-                                    "message": "Successfully enabled memory threat detection with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_host_isolation",
-                                    "message": "Host is not isolated",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_malicious_behavior",
-                                    "message": "Enabled 152 out of 152 malicious behavior rules",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_malicious_behavior",
-                                    "message": "Enabled 196 out of 196 diagnostic malicious behavior rules",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_user_notification",
-                                    "message": "Successfully configured user notification",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_malware",
-                                    "message": "Successfully enabled malware prevention",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_malware",
-                                    "message": "Successfully enabled malware detection",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_rollback",
-                                    "message": "Diagnostic system rollback is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_kernel",
-                                    "message": "Successfully configured kernel",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_output",
-                                    "message": "Successfully configured output connection",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_alerts",
-                                    "message": "Successfully configured alerts",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_logging",
-                                    "message": "Successfully configured logging",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "load_config",
-                                    "message": "Successfully parsed configuration",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "download_user_artifacts",
-                                    "message": "Successfully downloaded user artifacts",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "download_global_artifacts",
-                                    "message": "Global artifacts are available for use",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "connect_kernel",
-                                    "message": "Successfully connected to kernel",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_process_events",
-                                    "message": "Successfully started process event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_sync_image_load_events",
-                                    "message": "Successfully started sync image load event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_async_image_load_events",
-                                    "message": "Successfully started async image load event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_file_write_events",
-                                    "message": "Successfully started file write event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_file_open_events",
-                                    "message": "Successfully stopped file open event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_network_events",
-                                    "message": "Successfully started network event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_registry_events",
-                                    "message": "Successfully started registry event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_thread_events",
-                                    "message": "Successfully configured thread events",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_file_access_events",
-                                    "message": "Successfully configured file access event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_registry_access_events",
-                                    "message": "Successfully configured registry access event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_process_handle_events",
-                                    "message": "Successfully started process handle event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_file_events",
-                                    "message": "Success enabling file events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_network_events",
-                                    "message": "Success enabling network events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_process_events",
-                                    "message": "Success enabling process events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_imageload_events",
-                                    "message": "Success enabling image load events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_dns_events",
-                                    "message": "Success enabling dns events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_registry_events",
-                                    "message": "Success enabling registry events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_security_events",
-                                    "message": "Success enabling security events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_ransomware",
-                                    "message": "Successfully enabled ransomware detection with mbr enabled and canaries enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "agent_connectivity",
-                                    "message": "Successfully connected to Agent",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "workflow",
-                                    "message": "Successfully executed all workflows",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_credential_hardening",
-                                    "message": "Successfully configured credential hardening",
-                                    "status": "success"
-                                }
-                            ],
-                            "endpoint_policy_version": "1",
-                            "version": "2",
-                            "artifacts": {
-                                "global": {
-                                    "channel": "stable",
-                                    "identifiers": [
-                                        {
-                                            "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
-                                            "name": "diagnostic-configuration-v1"
-                                        },
-                                        {
-                                            "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
-                                            "name": "diagnostic-endpointpe-v4-blocklist"
-                                        },
-                                        {
-                                            "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
-                                            "name": "diagnostic-endpointpe-v4-exceptionlist"
-                                        },
-                                        {
-                                            "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
-                                            "name": "diagnostic-endpointpe-v4-model"
-                                        },
-                                        {
-                                            "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
-                                            "name": "diagnostic-malware-signature-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
-                                            "name": "diagnostic-ransomware-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
-                                            "name": "diagnostic-rules-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
-                                            "name": "endpointpe-v4-blocklist"
-                                        },
-                                        {
-                                            "sha256": "b49fdcd8bf63af07ab1e74352137eb20f1e3710640dfcb1bfff3f7273ee14a7f",
-                                            "name": "endpointpe-v4-exceptionlist"
-                                        },
-                                        {
-                                            "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
-                                            "name": "endpointpe-v4-model"
-                                        },
-                                        {
-                                            "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
-                                            "name": "global-configuration-v1"
-                                        },
-                                        {
-                                            "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
-                                            "name": "global-exceptionlist-windows"
-                                        },
-                                        {
-                                            "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
-                                            "name": "global-trustlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
-                                            "name": "production-malware-signature-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
-                                            "name": "production-ransomware-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
-                                            "name": "production-rules-windows-v1"
-                                        }
-                                    ],
-                                    "update_age": 0,
-                                    "snapshot": "2023-09-26",
-                                    "version": "1.0.261"
-                                },
-                                "user": {
-                                    "identifiers": [
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-blocklist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-eventfilterlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-exceptionlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-hostisolationexceptionlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-trustlist-windows-v1"
-                                        }
-                                    ],
-                                    "version": "1.0.0"
-                                }
-                            },
-                            "status": "success"
-                        }
-                    }
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "metrics",
-                    "dataset": "endpoint.policy"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 35122,
-                    "ingested": "2022-04-04T18:38:16Z",
-                    "created": "2022-04-04T18:38:15.7178887Z",
-                    "kind": "state",
-                    "module": "endpoint",
-                    "action": "endpoint_policy_response",
-                    "id": "MYfZG00oEwD2/fqT+++++Bye",
-                    "category": [
-                        "host"
-                    ],
-                    "type": [
-                        "change"
-                    ],
-                    "dataset": "endpoint.policy"
-                }
-            }
-        },
-        {
-            "name": "registry",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Effective_process",
-                    "title": "Effective_process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
-                    "fields": [
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the effective process.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Executable name for the effective process.",
-                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name for the effective process.",
-                            "example": "WMIC.exe"
-                        },
-                        {
-                            "name": "pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process ID.",
-                            "example": 4242
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": true
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "registry",
-                    "title": "Registry",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to Windows Registry operations.",
-                    "fields": [
-                        {
-                            "name": "data.bytes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
-                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
-                        },
-                        {
-                            "name": "data.strings",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "wildcard",
-                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
-                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
-                        },
-                        {
-                            "name": "data.type",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Standard registry type for encoding contents",
-                            "example": "REG_SZ"
-                        },
-                        {
-                            "name": "hive",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Abbreviated name for the hive.",
-                            "example": "HKLM"
-                        },
-                        {
-                            "name": "key",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hive-relative path of keys.",
-                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path, including hive, key and value",
-                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
-                        },
-                        {
-                            "name": "value",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the value written.",
-                            "example": "Debugger"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "registry": {
-                    "hive": "HKLM",
-                    "path": "HKLM\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
-                    "data": {
-                        "strings": [],
-                        "type": "REG_NONE"
-                    },
-                    "value": "Enabled",
-                    "key": "SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
-                },
-                "agent": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "Effective_process": {
-                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
-                    "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
-                    "name": "WMIC.exe",
-                    "pid": 2732
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-                        ],
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows Publisher",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ]
-                    },
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows Publisher",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "name": "svchost.exe",
-                    "pid": 2772,
-                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
-                    "executable": "C:\\Windows\\System32\\svchost.exe",
-                    "thread": {
-                        "id": 340,
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "allocation_private_bytes": 16384,
-                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "protection": "RWX",
-                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                }
-                            ],
-                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                            "hardware_breakpoint_set": true
-                        }
-                    }
-                },
-                "message": "Endpoint registry event",
-                "@timestamp": "2022-04-04T18:53:09.1283846Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.registry"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 36271,
-                    "ingested": "2022-04-04T18:53:18Z",
-                    "created": "2022-04-04T18:53:09.1283846Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "query",
-                    "id": "MYfZG00oEwD2/fqT+++++CMy",
-                    "category": [
-                        "registry"
-                    ],
-                    "type": [
-                        "access"
-                    ],
-                    "dataset": "endpoint.events.registry"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                }
-            }
-        },
-        {
-            "name": "process",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "ephemeral_id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
-                            "example": "8a4f500f"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
-                            "example": "foo"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "cloud",
-                    "title": "Cloud",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to the cloud or infrastructure the events are coming from.",
-                    "fields": [
-                        {
-                            "name": "account.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
-                            "example": 666777888999
-                        },
-                        {
-                            "name": "instance.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Instance name of the host machine."
-                        },
-                        {
-                            "name": "project.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
-                            "example": "my-project"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
-                            "example": "aws"
-                        },
-                        {
-                            "name": "region",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region in which this host, resource, or service is located.",
-                            "example": "us-east-1"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information."
-                },
-                {
-                    "name": "container",
-                    "title": "Container",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique container id."
-                        },
-                        {
-                            "name": "image.hash.all",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.",
-                            "example": "[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]"
-                        },
-                        {
-                            "name": "image.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the image the container was built on."
-                        },
-                        {
-                            "name": "image.tag",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Container image tags."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Container name."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "boot.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
-                            "example": "88a1f0ed-5ae5-41ee-af6b-41921c311872"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "pid_ns_ino",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
-                            "example": 256383
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "orchestrator",
-                    "title": "Orchestrator",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields that describe the resources which container orchestrators manage or act upon.",
-                    "fields": [
-                        {
-                            "name": "cluster.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID of the cluster."
-                        },
-                        {
-                            "name": "cluster.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the cluster."
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Namespace in which the action is taking place.",
-                            "example": "kube-system"
-                        },
-                        {
-                            "name": "resource.ip",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "ip",
-                            "description": "IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running)."
-                        },
-                        {
-                            "name": "resource.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the resource being acted upon.",
-                            "example": "test-pod-cdcws"
-                        },
-                        {
-                            "name": "resource.parent.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).",
-                            "example": "DaemonSet"
-                        },
-                        {
-                            "name": "resource.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of resource being acted upon.",
-                            "example": "service"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "package",
-                    "title": "Package",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.",
-                    "fields": [
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Package name",
-                            "example": "go"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.created_suspended",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.defense_evasions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping."
-                        },
-                        {
-                            "name": "Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "Ext.effective_parent.entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the effective process.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "Ext.effective_parent.executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Executable name for the effective process.",
-                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
-                        },
-                        {
-                            "name": "Ext.effective_parent.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name for the effective process.",
-                            "example": "WMIC.exe"
-                        },
-                        {
-                            "name": "Ext.effective_parent.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process ID.",
-                            "example": 4242
-                        },
-                        {
-                            "name": "Ext.memfd",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for memfd events."
-                        },
-                        {
-                            "name": "Ext.memfd.flag_allow_seal",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Allow sealing operations on this file.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flag_cloexec",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Sets the the close-on-exec flag on the new file descriptor.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flag_exec",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Exec flag is set for file.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flag_hugetlb",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "The anonymous file will be created in the hugetlbfs filesystem using huge pages.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flag_noexec_seal",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Sets both NOEXEC and MFD_ALLOW_SEALING.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Flags passed to the memfd operation.",
-                            "example": "2"
-                        },
-                        {
-                            "name": "Ext.memfd.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Filename for the created file. Appears in /proc/self/fd.",
-                            "example": "anon.txt"
-                        },
-                        {
-                            "name": "Ext.mitigation_policies",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled"
-                        },
-                        {
-                            "name": "Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "Ext.ptrace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for ptrace events."
-                        },
-                        {
-                            "name": "Ext.ptrace.child_pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "PID of the ptrace target."
-                        },
-                        {
-                            "name": "Ext.ptrace.request",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "ptrace request."
-                        },
-                        {
-                            "name": "Ext.relative_file_creation_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future."
-                        },
-                        {
-                            "name": "Ext.relative_file_name_modify_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
-                        },
-                        {
-                            "name": "Ext.session",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Session information for the current process"
-                        },
-                        {
-                            "name": "Ext.session_info.authentication_package",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP"
-                        },
-                        {
-                            "name": "Ext.session_info.client_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Client's IPv4 or IPv6 address as a string, if available."
-                        },
-                        {
-                            "name": "Ext.session_info.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Session ID"
-                        },
-                        {
-                            "name": "Ext.session_info.logon_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Session logon type.  Examples include Interactive, Network, and Service."
-                        },
-                        {
-                            "name": "Ext.session_info.relative_logon_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Process creation time, relative to logon time, in seconds."
-                        },
-                        {
-                            "name": "Ext.session_info.relative_password_age",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Process creation time, relative to the last time the password was changed, in seconds."
-                        },
-                        {
-                            "name": "Ext.session_info.user_flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON."
-                        },
-                        {
-                            "name": "Ext.shmget",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for shmget events."
-                        },
-                        {
-                            "name": "Ext.shmget.flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "flags passed to shmget."
-                        },
-                        {
-                            "name": "Ext.shmget.key",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Key passed to the shmget request."
-                        },
-                        {
-                            "name": "Ext.shmget.size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Requested size."
-                        },
-                        {
-                            "name": "Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "Ext.token.elevation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "Ext.token.security_attributes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.",
-                            "example": "TSA://ProcUnique, LUA://DecHdAutoAp"
-                        },
-                        {
-                            "name": "Ext.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the process is a trusted application"
-                        },
-                        {
-                            "name": "Ext.trusted_descendant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the process is a descendent of a trusted application"
-                        },
-                        {
-                            "name": "args",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "end",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process ended.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "entry_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "entry_leader.attested_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.attested_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.attested_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "entry_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.entry_meta.source.ip",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the source (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "entry_leader.entry_meta.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
-                        },
-                        {
-                            "name": "entry_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "entry_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "entry_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "entry_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "entry_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "entry_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "entry_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "entry_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "env_vars",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"PATH=/usr/local/bin:/usr/bin\", \"USER=ubuntu\"]"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "group_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "group_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "group_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "group_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "group_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "group_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "group_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "group_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "group_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "group_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "group_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "group_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "io",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "A chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input."
-                        },
-                        {
-                            "name": "io.max_bytes_per_process_exceeded",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting."
-                        },
-                        {
-                            "name": "io.text",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "A chunk of output or input sanitized to UTF-8.\nBest efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word."
-                        },
-                        {
-                            "name": "io.total_bytes_captured",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The total number of bytes captured in this event."
-                        },
-                        {
-                            "name": "io.total_bytes_skipped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "parent.Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "parent.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
-                        },
-                        {
-                            "name": "parent.Ext.real.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
-                        },
-                        {
-                            "name": "parent.Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "parent.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "parent.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "parent.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "parent.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "parent.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "parent.exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "parent.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.group_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.group_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "parent.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "parent.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "parent.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "parent.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "parent.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "parent.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "parent.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "parent.pgid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.ppid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "parent.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": true
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack_contains_unbacked",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "parent.thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.thread.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.thread.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "parent.title",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ]
-                        },
-                        {
-                            "name": "parent.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "parent.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "parent.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "parent.uptime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "parent.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "pgid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "ppid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "previous.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "previous.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "previous.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "session_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "session_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "session_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "session_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "session_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "session_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "session_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "session_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "session_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "thread.capabilities.effective",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is the set of capabilities used by the kernel to perform permission checks for the thread.",
-                            "example": "[\"CAP_BPF\", \"CAP_SYS_ADMIN\"]",
-                            "pattern": "^(CAP_[A-Z_]+|\\d+)$"
-                        },
-                        {
-                            "name": "thread.capabilities.permitted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is a limiting superset for the effective capabilities that the thread may assume.",
-                            "example": "[\"CAP_BPF\", \"CAP_SYS_ADMIN\"]",
-                            "pattern": "^(CAP_[A-Z_]+|\\d+)$"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "title",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "tty.columns",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The number of character columns per line. e.g terminal width\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'",
-                            "example": 80
-                        },
-                        {
-                            "name": "tty.rows",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The number of character rows in the terminal. e.g terminal height\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'",
-                            "example": 24
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "working_directory",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "container": {
-                    "id": "8d38b2f18290e973c5ea8f9ee207e970a8aa9191fa89bf3d4ea2a126f2f010a6",
-                    "image": {
-                        "name": "gke.gcr.io/csi-node-driver-registrar:v2.5.0-gke.1",
-                        "tag": [
-                            "v2.5.0-gke.1"
-                        ],
-                        "hash": {
-                            "all": [
-                                "sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d"
-                            ]
-                        }
-                    },
-                    "name": "csi-driver-registrar"
-                },
-                "cloud": {
-                    "account": {
-                        "id": "1234"
-                    },
-                    "instance": {
-                        "name": "webserver-12"
-                    },
-                    "project": {
-                        "id": "1234"
-                    },
-                    "provider": "aws",
-                    "region": "us-east-1"
-                },
-                "orchestrator": {
-                    "cluster": {
-                        "id": "f0cd61d5-327b-43e0-bc94-d9ea922fb4b5",
-                        "name": "webservers"
-                    },
-                    "namespace": "webapp",
-                    "resource": {
-                        "ip": [
-                            "10.1.237.155"
-                        ],
-                        "name": "pdcsi-node-6zh4j",
-                        "type": "pod",
-                        "parent": {
-                            "type": "DaemonSet"
-                        }
-                    }
-                },
-                "process": {
-                    "entry_leader": {
-                        "attested_user": {
-                            "id": "123",
-                            "name": "userA"
-                        },
-                        "attested_groups": {
-                            "name": "groupA"
-                        }
-                    },
-                    "Ext": {
-                        "ancestry": [
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-                        ],
-                        "memfd": {
-                            "flag_hugetlb": false,
-                            "flag_allow_seal": true,
-                            "flags": 2,
-                            "name": "test_memfd",
-                            "flag_exec": false,
-                            "flag_cloexec": false,
-                            "flag_noexec_seal": false
-                        },
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows Publisher",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "created_suspended": true,
-                        "mitigation_policies": [
-                            "Microsoft only, Opt-in to restrict to Microsoft, Windows Store and WHQL",
-                            "CET dynamic APIs can only be called out of proc",
-                            "CF Guard"
-                        ],
-                        "protection": "PsProtectedSignerAntimalware-Light",
-                        "device": {
-                            "volume_device_type": "Disk File System"
-                        },
-                        "authentication_id": "0x3e7",
-                        "token": {
-                            "integrity_level_name": "system",
-                            "security_attributes": [
-                                "TSA://ProcUnique"
-                            ],
-                            "elevation_level": "default"
-                        },
-                        "effective_parent": {
-                            "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
-                            "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
-                            "name": "WMIC.exe",
-                            "pid": 2732
-                        },
-                        "relative_file_creation_time": 48628704.4029488,
-                        "relative_file_name_modify_time": 48628704.4029488,
-                        "session_info": {
-                            "logon_type": "Interactive",
-                            "client_address": "127.0.0.1",
-                            "id": 1,
-                            "authentication_package": "NTLM",
-                            "relative_logon_time": 0.1,
-                            "relative_password_age": 2592000.123,
-                            "user_flags": [
-                                "LOGON_EXTRA_SIDS",
-                                "LOGON_NTLMV2_ENABLED",
-                                "LOGON_WINLOGON"
-                            ]
-                        }
-                    },
-                    "parent": {
-                        "args": [],
-                        "name": "services.exe",
-                        "pid": 600,
-                        "args_count": 0,
-                        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                        "command_line": "",
-                        "executable": "C:\\Windows\\System32\\services.exe",
-                        "thread": {
-                            "Ext": {
-                                "call_stack": [
-                                    {
-                                        "allocation_private_bytes": 16384,
-                                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                        "protection": "RWX",
-                                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                    }
-                                ],
-                                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                                "call_stack_contains_unbacked": true,
-                                "hardware_breakpoint_set": true
-                            }
-                        }
-                    },
-                    "pid": 2772,
-                    "working_directory": "C:\\Windows\\system32\\",
-                    "end": "2022-07-18T21:05:19.9419692Z",
-                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
-                    "executable": "C:\\Windows\\System32\\svchost.exe",
-                    "args": [
-                        "C:\\Windows\\System32\\svchost.exe",
-                        "-k",
-                        "WerSvcGroup"
-                    ],
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows Publisher",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "pe": {
-                        "original_file_name": "svchost.exe"
-                    },
-                    "name": "svchost.exe",
-                    "args_count": 3,
-                    "command_line": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
-                    "hash": {
-                        "sha1": "4fbfc6004084d97032837c21d3f426892d868eac",
-                        "sha256": "cb19fd67b1d028e01f54c426a0924528c4a8d8ed8996cfe0ee0c6e45285436a1",
-                        "md5": "1b280ad032268a636ecfe6f9165431b7"
-                    },
-                    "tty": {
-                        "char_device": {
-                            "major": 4,
-                            "minor": 1
-                        },
-                        "rows": 24,
-                        "columns": 80
-                    },
-                    "io": {
-                        "text": "helloworld",
-                        "total_bytes_captured": 10,
-                        "total_bytes_skipped": 0,
-                        "max_bytes_per_process_exceeded": false
-                    },
-                    "env_vars": [
-                        "NICK=test",
-                        "OTHER=why"
-                    ]
-                },
-                "message": "Endpoint process event",
-                "@timestamp": "2022-04-04T18:53:08.6578986Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.process"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 36236,
-                    "ingested": "2022-04-04T18:53:18Z",
-                    "created": "2022-04-04T18:53:08.6578986Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "start",
-                    "id": "MYfZG00oEwD2/fqT+++++CLz",
-                    "category": [
-                        "process"
-                    ],
-                    "type": [
-                        "start"
-                    ],
-                    "dataset": "endpoint.events.process"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                }
-            }
-        },
-        {
-            "name": "security",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Target",
-                    "title": "Target",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
-                    "fields": [
-                        {
-                            "name": "process.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "file",
-                    "title": "File",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
-                    "fields": [
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "effective.domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "effective.email",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "effective.full_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "effective.hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "effective.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "effective.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "winlog",
-                    "title": "Winlog",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields provide detailed information regarding events logged in the Windows Event Log. The Windows Event Log is a centralized system used by Windows to record events related to system, application, and security activities. Each event log entry is categorized by a specific event type, and contains relevant metadata that can include the event source, event ID, timestamp, user details, and other associated data.",
-                    "fields": [
-                        {
-                            "name": "event_data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The event-specific data. This is a non-exhaustive list of parameters that are used in Windows events."
-                        },
-                        {
-                            "name": "event_data.PrivilegeList",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of sensitive privileges, assigned to the new logon.",
-                            "example": "SeTcbPrivilege, SeSecurityPrivilege"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "Target": {
-                    "process": {
-                        "Ext": {
-                            "authentication_id": "0x3e7"
-                        }
-                    }
-                },
-                "agent": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "file": {
-                    "path": "/User/admin/Downloads/application",
-                    "code_signature": {
-                        "signing_id": "com.developer.identifier",
-                        "team_id": "XYZABC"
-                    }
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-                        ],
-                        "authentication_id": "0x3e7",
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows Publisher",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ]
-                    },
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows Publisher",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "name": "C:\\Windows\\System32\\services.exe",
-                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                    "executable": "C:\\Windows\\System32\\services.exe"
-                },
-                "message": "Endpoint security event",
-                "@timestamp": "2022-04-04T18:53:08.6510289Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.security"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 36385,
-                    "ingested": "2022-04-04T18:53:18Z",
-                    "created": "2022-04-04T18:53:08.6510289Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "log_on",
-                    "id": "MYfZG00oEwD2/fqT+++++CQ/",
-                    "category": [
-                        "authentication",
-                        "session"
-                    ],
-                    "type": [
-                        "start"
-                    ],
-                    "dataset": "endpoint.events.security",
-                    "outcome": "success"
-                },
-                "user": {
-                    "domain": "DESKTOP-1TK590J",
-                    "effective": {
-                        "domain": "DESKTOP-1TK590J",
-                        "name": "EafTestLogon80589",
-                        "id": "S-1-5-18",
-                        "email": "EafTestLogon80589@DESKTOP-1TK590J.local",
-                        "full_name": "EafTestLogon80589",
-                        "hash": "f1297b0233914ec6ebf8fc01195e8712dfd8322f5e8d9d8bbe0083a0fc1860fd"
-                    },
-                    "id": "S-1-5-21-1749029863-1064264096-968553628-1001",
-                    "name": "Default"
-                },
-                "winlog": {
-                    "event_data": {
-                        "PrivilegeList": [
-                            "SeSecurityPrivilege",
-                            "SeTakeOwnershipPrivilege",
-                            "SeLoadDriverPrivilege",
-                            "SeBackupPrivilege",
-                            "SeRestorePrivilege",
-                            "SeDebugPrivilege",
-                            "SeSystemEnvironmentPrivilege",
-                            "SeImpersonatePrivilege",
-                            "SeDelegateSessionUserImpersonatePrivilege"
-                        ]
-                    }
-                }
-            }
-        },
-        {
-            "name": "metadata",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "Endpoint",
-                    "title": "Endpoint",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
-                    "fields": [
-                        {
-                            "name": "capabilities",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 128,
-                            "description": "Enabled capabilities",
-                            "doc_values": false
-                        },
-                        {
-                            "name": "configuration",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
-                        },
-                        {
-                            "name": "configuration.isolation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Configuration setting for Host Isolation from the network"
-                        },
-                        {
-                            "name": "policy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The policy fields are used to hold information about applied policy."
-                        },
-                        {
-                            "name": "policy.applied",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about the policy that is applied"
-                        },
-                        {
-                            "name": "policy.applied.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the id of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of this applied policy"
-                        },
-                        {
-                            "name": "policy.applied.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the status of the applied policy"
-                        },
-                        {
-                            "name": "state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
-                        },
-                        {
-                            "name": "state.isolation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Current network isolation state of the host"
-                        },
-                        {
-                            "name": "status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The current status of the endpoint e.g. enrolled, unenrolled."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
-                            "example": "foo"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "elastic",
-                    "title": "Elastic",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Holds fields and properties of data points and concepts in the elastic domain or namespace.",
-                    "fields": [
-                        {
-                            "name": "agent",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
-                        },
-                        {
-                            "name": "agent.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this elastic agent (if one exists).",
-                            "example": "c2a9093e-e289-4c0a-aa44-8c32a414fa7a"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "build": {
-                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-                    },
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "@timestamp": "2022-04-04T12:33:36.6664577Z",
-                "Endpoint": {
-                    "capabilities": [
-                        "isolation"
-                    ],
-                    "configuration": {
-                        "isolation": false
-                    },
-                    "state": {
-                        "isolation": false
-                    },
-                    "policy": {
-                        "applied": {
-                            "name": "endpoint-1",
-                            "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
-                            "status": "success"
-                        }
-                    },
-                    "status": "enrolled"
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "metrics",
-                    "dataset": "endpoint.metadata"
-                },
-                "elastic": {
-                    "agent": {
-                        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21"
-                    }
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 5054,
-                    "ingested": "2022-04-04T12:33:37Z",
-                    "created": "2022-04-04T12:33:36.6664577Z",
-                    "kind": "metric",
-                    "module": "endpoint",
-                    "action": "endpoint_metadata",
-                    "id": "MYfZG00oEwD2/fqT+++++/SC",
-                    "category": [
-                        "host"
-                    ],
-                    "type": [
-                        "info"
-                    ],
-                    "dataset": "endpoint.metadata"
-                }
-            }
-        },
-        {
-            "name": "action_responses",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "action_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The action id",
-                    "path": "EndpointActions.action_id"
-                },
-                {
-                    "name": "agent_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Alias field that maps to {agent: {id}}",
-                    "path": "agent.id"
-                },
-                {
-                    "name": "completed_at",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Request completion timestamp when the response is done executing. Usually matches with @timestamp.",
-                    "path": "EndpointActions.completed_at"
-                },
-                {
-                    "name": "data.alert_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "List of alert ids that triggered the action",
-                    "path": "EndpointActions.data.alert_id"
-                },
-                {
-                    "name": "data.command",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The action that is requested",
-                    "path": "EndpointActions.data.command"
-                },
-                {
-                    "name": "data.comment",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "A comment that describes the action that is requested",
-                    "path": "EndpointActions.data.comment"
-                },
-                {
-                    "name": "started_at",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Timestamp of start of request",
-                    "path": "EndpointActions.started_at"
-                },
-                {
-                    "name": "status",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The status of the request that distinguishes if the request is queued, running or completed.",
-                    "path": "EndpointActions.status"
-                },
-                {
-                    "name": "EndpointActions",
-                    "title": "Endpoint Actions",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields to describe the endpoint  action requests and responses.",
-                    "fields": [
-                        {
-                            "name": "action_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action id"
-                        },
-                        {
-                            "name": "completed_at",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Request completion timestamp when the response is done executing. Usually matches with @timestamp."
-                        },
-                        {
-                            "name": "data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The action request information"
-                        },
-                        {
-                            "name": "data.alert_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of alert ids that triggered the action"
-                        },
-                        {
-                            "name": "data.command",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action that is requested",
-                            "example": "isolate"
-                        },
-                        {
-                            "name": "data.comment",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "A comment that describes the action that is requested"
-                        },
-                        {
-                            "name": "started_at",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp of start of request"
-                        },
-                        {
-                            "name": "status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The status of the request that distinguishes if the request is queued, running or completed."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "error",
-                    "title": "Error",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.",
-                    "fields": [
-                        {
-                            "name": "code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Error code describing the error."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the error."
-                        },
-                        {
-                            "name": "message",
-                            "level": "core",
-                            "type": "match_only_text",
-                            "description": "Error message."
-                        },
-                        {
-                            "name": "stack_trace",
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "The stack trace of this error in plain text.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of the error, for example the class name of the exception.",
-                            "example": "java.lang.NullPointerException"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "end",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "EndpointActions": {
-                    "completed_at": "2022-04-04T20:44:14.0Z",
-                    "data": {
-                        "comment": "Action completed successfully",
-                        "command": "isolate"
-                    },
-                    "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
-                    "started_at": "2022-04-04T20:44:08.0Z"
-                },
-                "agent": {
-                    "id": "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
-                },
-                "@timestamp": "2022-04-04T20:44:14.0Z",
-                "data_stream": {
-                    "namespace": "default",
-                    "type": ".logs",
-                    "dataset": "endpoint.action.responses"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "ingested": "2022-04-04T20:44:45Z"
-                }
-            }
-        },
-        {
-            "name": "collection",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                }
-            ]
-        },
-        {
-            "name": "library",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Effective_process",
-                    "title": "Effective_process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
-                    "fields": [
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the effective process.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Executable name for the effective process.",
-                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name for the effective process.",
-                            "example": "WMIC.exe"
-                        },
-                        {
-                            "name": "pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process ID.",
-                            "example": 4242
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dll",
-                    "title": "DLL",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.defense_evasions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump."
-                        },
-                        {
-                            "name": "Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "Ext.load_index",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.\nThe first load index is 1."
-                        },
-                        {
-                            "name": "Ext.relative_file_creation_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future."
-                        },
-                        {
-                            "name": "Ext.relative_file_name_modify_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
-                        },
-                        {
-                            "name": "Ext.size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of DLL"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "file",
-                    "title": "File",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": true
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-                        ],
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "protection": "PsProtectedSignerAntimalware-Light"
-                    },
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "name": "VSSVC.exe",
-                    "pid": 4528,
-                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ1MjgtMTMyOTM1NzEwODYuNjI4MzM0NzAw",
-                    "executable": "C:\\Windows\\System32\\VSSVC.exe",
-                    "thread": {
-                        "id": 340,
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "allocation_private_bytes": 16384,
-                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "protection": "RWX",
-                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                }
-                            ],
-                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                            "hardware_breakpoint_set": true
-                        }
-                    }
-                },
-                "dll": {
-                    "Ext": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "device": {
-                            "volume_device_type": "Disk File System"
-                        },
-                        "load_index": 1,
-                        "relative_file_creation_time": 48628704.4029488,
-                        "relative_file_name_modify_time": 48628704.4029488,
-                        "size": 65536
-                    },
-                    "path": "C:\\Windows\\System32\\msxml3.dll",
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "pe": {
-                        "file_version": "8.110.17763.1911",
-                        "imphash": "2e1d1e35c17be5497d2de33f06dc41b4",
-                        "original_file_name": "MSXML3.dll"
-                    },
-                    "name": "msxml3.dll",
-                    "hash": {
-                        "sha1": "02488fb2dbf679a3282338178b451da635b79b54",
-                        "sha256": "a9698adcf789d9e30f37dd5e6c9be0441bc37662ba7402e85071ccec2135d36c",
-                        "md5": "65e4fd0564411bb60c600fae12cde2f9"
-                    }
-                },
-                "message": "Endpoint DLL load event",
-                "@timestamp": "2022-04-04T18:38:08.3185831Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.library"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 34339,
-                    "ingested": "2022-04-04T18:38:16Z",
-                    "created": "2022-04-04T18:38:08.3185831Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "load",
-                    "id": "MYfZG00oEwD2/fqT+++++BRi",
-                    "category": [
-                        "library"
-                    ],
-                    "type": [
-                        "start"
-                    ],
-                    "dataset": "endpoint.events.library"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                },
-                "Effective_process": {
-                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTU2NS0xNjk1MTkyOTQ3",
-                    "executable": "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
-                    "name": "Terminal",
-                    "pid": 565
-                }
-            }
-        },
-        {
-            "name": "heartbeat",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "billable",
-                    "level": "custom",
-                    "type": "boolean",
-                    "description": "Whether document should be included in billing calculations"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "@timestamp": "2023-07-18T20:40:09.279939Z",
-                "agent": {
-                    "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-                },
-                "data_stream": {
-                    "dataset": "endpoint.heartbeat",
-                    "namespace": "default",
-                    "type": ".logs"
-                },
-                "message": "Endpoint heartbeat",
-                "event": {
-                    "ingested": "2023-07-18T20:40:09.279939Z"
-                },
-                "billable": true
-            }
-        },
-        {
-            "name": "actions",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "action_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The action id",
-                    "path": "EndpointActions.action_id"
-                },
-                {
-                    "name": "agents",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Alias field that maps to {agent: {id}}",
-                    "path": "agent.id"
-                },
-                {
-                    "name": "data.alert_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "List of alert ids that triggered the action",
-                    "path": "EndpointActions.data.alert_id"
-                },
-                {
-                    "name": "data.command",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The action that is requested",
-                    "path": "EndpointActions.data.command"
-                },
-                {
-                    "name": "data.comment",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "A comment that describes the action that is requested",
-                    "path": "EndpointActions.data.comment"
-                },
-                {
-                    "name": "expiration",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Request expiration timestamp",
-                    "path": "EndpointActions.expiration"
-                },
-                {
-                    "name": "input_type",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The input type of the action, distinguishes endpoint actions as `endpoint`",
-                    "path": "EndpointActions.input_type"
-                },
-                {
-                    "name": "type",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Distinguishes the type of input. Usually set to `INPUT_ACTION`",
-                    "path": "EndpointActions.type"
-                },
-                {
-                    "name": "user_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The user id",
-                    "path": "user.id"
-                },
-                {
-                    "name": "EndpointActions",
-                    "title": "Endpoint Actions",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields to describe the endpoint  action requests and responses.",
-                    "fields": [
-                        {
-                            "name": "action_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action id"
-                        },
-                        {
-                            "name": "data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The action request information"
-                        },
-                        {
-                            "name": "data.alert_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of alert ids that triggered the action"
-                        },
-                        {
-                            "name": "data.command",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action that is requested",
-                            "example": "isolate"
-                        },
-                        {
-                            "name": "data.comment",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "A comment that describes the action that is requested"
-                        },
-                        {
-                            "name": "expiration",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Request expiration timestamp"
-                        },
-                        {
-                            "name": "input_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The input type of the action, distinguishes endpoint actions as `endpoint`"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguishes the type of input. Usually set to `INPUT_ACTION`"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "error",
-                    "title": "Error",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.",
-                    "fields": [
-                        {
-                            "name": "code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Error code describing the error."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the error."
-                        },
-                        {
-                            "name": "message",
-                            "level": "core",
-                            "type": "match_only_text",
-                            "description": "Error message."
-                        },
-                        {
-                            "name": "stack_trace",
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "The stack trace of this error in plain text.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of the error, for example the class name of the exception.",
-                            "example": "java.lang.NullPointerException"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "end",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "rule",
-                    "title": "Rule",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
-                            "example": 101
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the rule or signature generating the event.",
-                            "example": "BLOCK_DNS_over_TLS"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "EndpointActions": {
-                    "data": {
-                        "comment": "testing isolation",
-                        "command": "isolate"
-                    },
-                    "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
-                    "input_type": "endpoint",
-                    "expiration": "2022-04-18T20:44:07.805Z",
-                    "type": "INPUT_ACTION"
-                },
-                "agent": {
-                    "id": [
-                        "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
-                    ]
-                },
-                "@timestamp": "2022-04-04T20:44:07.805Z",
-                "event": {
-                    "agent_id_status": "auth_metadata_missing",
-                    "ingested": "2022-04-04T20:44:07Z"
-                },
-                "user": {
-                    "id": "user@elastic.co"
-                }
-            }
-        },
-        {
-            "name": "file",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Effective_process",
-                    "title": "Effective_process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
-                    "fields": [
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the effective process.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Executable name for the effective process.",
-                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name for the effective process.",
-                            "example": "WMIC.exe"
-                        },
-                        {
-                            "name": "pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process ID.",
-                            "example": 4242
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Persistence",
-                    "title": "Persistence",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a Persistence event.",
-                    "fields": [
-                        {
-                            "name": "args",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Arguments used to execute the persistence item"
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The persistence item's executable"
-                        },
-                        {
-                            "name": "keepalive",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Keep alive option boolean"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The persistence item's name"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file's path"
-                        },
-                        {
-                            "name": "runatload",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Run at load option boolean"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.correlation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Information about event this should be correlated with."
-                        },
-                        {
-                            "name": "Ext.correlation.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event"
-                        },
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "file",
-                    "title": "File",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "Ext.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy calculation of file's header and footer used to check file integrity."
-                        },
-                        {
-                            "name": "Ext.header_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "Ext.header_data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "Ext.malware_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of malware_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "The concatenated names of all yara signatures"
-                        },
-                        {
-                            "name": "Ext.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Malware artifact identifier."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of bytes representing yara signature matches"
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature hash."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature sha256."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature id."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature name."
-                        },
-                        {
-                            "name": "Ext.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of malware signature matches"
-                        },
-                        {
-                            "name": "Ext.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature version."
-                        },
-                        {
-                            "name": "Ext.monotonic_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "File event monotonic ID."
-                        },
-                        {
-                            "name": "Ext.original",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Original file information during a modification event."
-                        },
-                        {
-                            "name": "Ext.original.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file extension prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.gid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "Ext.original.group",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "Ext.original.mode",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file mode prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file name prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.owner",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "Ext.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.uid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "Ext.windows",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Platform-specific Windows fields"
-                        },
-                        {
-                            "name": "Ext.windows.zone_identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Windows zone identifier for a file"
-                        },
-                        {
-                            "name": "accessed",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-                        },
-                        {
-                            "name": "attributes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
-                            "example": "[\"readonly\", \"system\"]"
-                        },
-                        {
-                            "name": "created",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "File creation time.\nNote that not all filesystems store the creation time."
-                        },
-                        {
-                            "name": "ctime",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-                        },
-                        {
-                            "name": "device",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device that is the source of the file.",
-                            "example": "sda"
-                        },
-                        {
-                            "name": "directory",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "drive_letter",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1,
-                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
-                            "example": "C"
-                        },
-                        {
-                            "name": "extension",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "gid",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "group",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "inode",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Inode representing the file in the filesystem.",
-                            "example": "256383"
-                        },
-                        {
-                            "name": "mime_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-                        },
-                        {
-                            "name": "mode",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode of the file in octal representation.",
-                            "example": "0640"
-                        },
-                        {
-                            "name": "mtime",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file content was modified."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "origin_referrer_url",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 8192,
-                            "description": "The url of the webpage that linked to the file."
-                        },
-                        {
-                            "name": "origin_url",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 8192,
-                            "description": "The url where the file is hosted."
-                        },
-                        {
-                            "name": "owner",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "size",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
-                            "example": 16384
-                        },
-                        {
-                            "name": "target_path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Target path for symlinks.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File type (file, dir, or symlink).",
-                            "example": "file"
-                        },
-                        {
-                            "name": "uid",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "ppid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": true
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "id": "ccb7b1a1-303e-416f-b975-311737e8e125",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "Effective_process": {
-                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
-                    "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
-                    "name": "WMIC.exe",
-                    "pid": 2732
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTYwNC0xMzI5MzU0OTEwOS4zNTg1OTc3MDA=",
-                            "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ3Mi0xMzI5MzU0OTEwOS43NjU4MjcwMA=="
-                        ],
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Elasticsearch, Inc.",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ]
-                    },
-                    "args_count": 1,
-                    "parent": {
-                        "pid": 604,
-                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
-                        "group_leader": {
-                            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-                        }
-                    },
-                    "entry_leader": {
-                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
-                        "parent": {
-                            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-                        }
-                    },
-                    "session_leader": {
-                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-                    },
-                    "group_leader": {
-                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-                    },
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Elasticsearch, Inc.",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "name": "winlogbeat.exe",
-                    "pid": 4512,
-                    "thread": {
-                        "id": 340,
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "allocation_private_bytes": 16384,
-                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "protection": "RWX",
-                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                }
-                            ],
-                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                            "hardware_breakpoint_set": true
-                        }
-                    },
-                    "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
-                    "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
-                },
-                "message": "Endpoint file event",
-                "@timestamp": "2022-04-04T18:37:01.5775771Z",
-                "file": {
-                    "Ext": {
-                        "header_data": [],
-                        "entropy": 5.28353871945538,
-                        "device": {
-                            "volume_device_type": "Disk File System"
-                        },
-                        "header_bytes": "7570646174655f74696d653a20323032",
-                        "windows": {
-                            "zone_identifier": -1
-                        },
-                        "monotonic_id": 3526
-                    },
-                    "path": "C:\\ProgramData\\winlogbeat\\.winlogbeat.yml.new",
-                    "extension": "new",
-                    "size": 1406,
-                    "name": ".winlogbeat.yml.new",
-                    "origin_referrer_url": "https://example.com",
-                    "origin_url": "https://example.com/file.zip"
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.file"
-                },
-                "host": {
-                    "hostname": "response-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.9",
-                        "fe80::4d1:ef01:c0ed:299a",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "response-win-1",
-                    "id": "bcbbe9cb-0278-43f9-aa1b-2dc9839bbf6f",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 32114,
-                    "ingested": "2022-04-04T18:37:29Z",
-                    "created": "2022-04-04T18:37:01.5775771Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "creation",
-                    "id": "MYfZFpbNKturKgFp+++++AlT",
-                    "category": [
-                        "file"
-                    ],
-                    "type": [
-                        "creation"
-                    ],
-                    "dataset": "endpoint.events.file"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                }
-            }
-        },
-        {
-            "name": "api",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Target",
-                    "title": "Target",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
-                    "fields": [
-                        {
-                            "name": "process.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.Ext.created_suspended",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory allocation containing the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Original memory size requested when the memory was allocated.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-                            "example": "PRIVATE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The address where bytes_compressed begins.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether bytes_compressed is present in this event.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the memory region.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A sequence of signature names matched.",
-                            "example": "Windows.EICAR.Not-a-virus"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature identifier"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The first matching details."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The first matching details.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of file matching signature."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of file matching signature."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the first yara rule matched."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the first yara rule matched."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Additional matching details if available.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The second matching details.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of second file matching signature.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of second file matching signature.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the second yara rule matched.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the second yara rule matched.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature version"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
-                            "example": "C:\\Windows\\System32\\mshtml.dll"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.pehash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
-                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "PE Section List name."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the file at mapped_path is an executable.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.pehash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
-                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "PE Section List name."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether an executable file was found in memory.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of the memory region.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_start_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 64 bytes at the region base address.",
-                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-                            "example": "COMMIT"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.strings",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Array of strings found within the memory region.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "process.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "process.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "process.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "process.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "process.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the destination (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "port",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Port of the destination.",
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dll",
-                    "title": "DLL",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "end",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "network",
-                    "title": "Network",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.",
-                    "fields": [
-                        {
-                            "name": "transport",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
-                            "example": "tcp"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
-                            "example": "ipv4"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.api.behaviors",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
-                            "example": "[ \"cross-process\", \"rapid_background_polling\", \"multiple_polling_processes\", \"native_api\", \"shellcode\" ]"
-                        },
-                        {
-                            "name": "Ext.api.metadata",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Information related to the API call."
-                        },
-                        {
-                            "name": "Ext.api.metadata.amsi_filenames",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A list of filenames previously scanned by AMSI.",
-                            "example": "[ \"C:\\script.ps1\" ]"
-                        },
-                        {
-                            "name": "Ext.api.metadata.amsi_logs",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Information related to previous AMSI scans."
-                        },
-                        {
-                            "name": "Ext.api.metadata.amsi_logs.entries",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A subset of the AMSI content buffers scanned prior to this event.",
-                            "example": "[ \"[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport(\"kernel32.dll\")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}\" ]"
-                        },
-                        {
-                            "name": "Ext.api.metadata.amsi_logs.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The AMSI content type scanned prior to this event.",
-                            "example": "PowerShell"
-                        },
-                        {
-                            "name": "Ext.api.metadata.background_callcount",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.",
-                            "example": 6021
-                        },
-                        {
-                            "name": "Ext.api.metadata.client_is_local",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.api.metadata.client_machine",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Client process's machine name (provided by the client and potentially untrustworthy).",
-                            "example": "DESKTOP-EXAMPLE"
-                        },
-                        {
-                            "name": "Ext.api.metadata.client_machine_fqdn",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Client process's machine name FQDN (provided by the client and potentially untrustworthy).",
-                            "example": "DESKTOP-EXAMPLE.elastic.co"
-                        },
-                        {
-                            "name": "Ext.api.metadata.client_process_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Client process id",
-                            "example": 3600
-                        },
-                        {
-                            "name": "Ext.api.metadata.ms_since_last_keyevent",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.",
-                            "example": 94
-                        },
-                        {
-                            "name": "Ext.api.metadata.procedure_symbol",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Summary of the hook procedure.",
-                            "example": "taskbar.dll"
-                        },
-                        {
-                            "name": "Ext.api.metadata.return_value",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Return value of RegisterRawInputDevices API call.",
-                            "example": 1
-                        },
-                        {
-                            "name": "Ext.api.metadata.security_descriptor",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The security descriptor of the device.",
-                            "example": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)"
-                        },
-                        {
-                            "name": "Ext.api.metadata.start_address_allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection attributes associated with the starting address of a thread.",
-                            "example": "RCX"
-                        },
-                        {
-                            "name": "Ext.api.metadata.start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module associated with the starting address of a thread.",
-                            "example": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe"
-                        },
-                        {
-                            "name": "Ext.api.metadata.target_address_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the memory region targeted by the API call.",
-                            "example": "Unbacked"
-                        },
-                        {
-                            "name": "Ext.api.metadata.target_address_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path of the memory region targeted by the API call.",
-                            "example": "C:\\programdata\\example.dll"
-                        },
-                        {
-                            "name": "Ext.api.metadata.thread_info_flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Thread info flags.",
-                            "example": 16
-                        },
-                        {
-                            "name": "Ext.api.metadata.visible_windows_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Number of visible windows owned by the caller thread.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.metadata.windows_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Number of windows owned by the caller thread.",
-                            "example": 2
-                        },
-                        {
-                            "name": "Ext.api.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the API, usually the name of the function or system call.",
-                            "example": "VirtualAlloc"
-                        },
-                        {
-                            "name": "Ext.api.parameters",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Parameter values passed to the API call."
-                        },
-                        {
-                            "name": "Ext.api.parameters.address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The target memory address.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.api.parameters.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`",
-                            "example": "COMMIT|RESERVE"
-                        },
-                        {
-                            "name": "Ext.api.parameters.app_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The application name requesting the AMSI scan.",
-                            "example": "PowerShell"
-                        },
-                        {
-                            "name": "Ext.api.parameters.argument1",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The first argument to the procedure.",
-                            "example": 1
-                        },
-                        {
-                            "name": "Ext.api.parameters.argument2",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The second argument to the procedure.",
-                            "example": 2
-                        },
-                        {
-                            "name": "Ext.api.parameters.argument3",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The third argument to the procedure.",
-                            "example": 3
-                        },
-                        {
-                            "name": "Ext.api.parameters.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The content associated with an AMSI scan.",
-                            "example": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport(\"kernel32.dll\")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20);"
-                        },
-                        {
-                            "name": "Ext.api.parameters.consumer_details",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name."
-                        },
-                        {
-                            "name": "Ext.api.parameters.consumer_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.",
-                            "example": "ExampleConsumer"
-                        },
-                        {
-                            "name": "Ext.api.parameters.consumer_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An example list of consumer type.\n  \"ActiveScriptEventConsumer\" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.\n  \"CommandLineEventConsumer\" - Launches an arbitrary process in the local system context when an event is delivered to it.\n  \"LogFileEventConsumer\" - Writes customized strings to a text log file when events are delivered to it.\n  \"NTEventLogEventConsumer\" - Logs a specific message to the Windows event log when an event is delivered to it.\n  \"SMTPEventConsumer\" - Sends an email message using SMTP each time an event is delivered to it.",
-                            "example": "CommandLineEventConsumer"
-                        },
-                        {
-                            "name": "Ext.api.parameters.content_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The content name, typically a filename, associated with an AMSI scan.",
-                            "example": "C:\\script.ps1"
-                        },
-                        {
-                            "name": "Ext.api.parameters.context_flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`",
-                            "example": 1048607
-                        },
-                        {
-                            "name": "Ext.api.parameters.desired_access",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`."
-                        },
-                        {
-                            "name": "Ext.api.parameters.desired_access_numeric",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`."
-                        },
-                        {
-                            "name": "Ext.api.parameters.device",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the device object.",
-                            "example": "\\Device\\NPCAP"
-                        },
-                        {
-                            "name": "Ext.api.parameters.driver",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the driver object.",
-                            "example": "\\Driver\\npcap"
-                        },
-                        {
-                            "name": "Ext.api.parameters.eax",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.ebp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EBP frame pointer register.",
-                            "example": 15006644
-                        },
-                        {
-                            "name": "Ext.api.parameters.ebx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EBX general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.ecx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 ECX general purpose register. First argument in __fastcall and __thiscall.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.edi",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EDI general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.edx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EDX general purpose register. Second argument in a __fastcall.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.eip",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EIP instruction pointer register.",
-                            "example": 1472790528
-                        },
-                        {
-                            "name": "Ext.api.parameters.esi",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 ESI general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.esp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 ESP stack pointer register.",
-                            "example": 15007744
-                        },
-                        {
-                            "name": "Ext.api.parameters.event_filter_details",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Provide an overview of the query that define when an event should be triggered."
-                        },
-                        {
-                            "name": "Ext.api.parameters.event_filter_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.",
-                            "example": "ExampleFilter"
-                        },
-                        {
-                            "name": "Ext.api.parameters.flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.",
-                            "example": "INPUTSINK"
-                        },
-                        {
-                            "name": "Ext.api.parameters.handle_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This parameter indicates whether the detected access was attempt against a process or a thread.",
-                            "example": "process"
-                        },
-                        {
-                            "name": "Ext.api.parameters.hook_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DLL containing the hook procedure.",
-                            "example": "c:\\windows\\system32\\taskbar.dll"
-                        },
-                        {
-                            "name": "Ext.api.parameters.hook_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of hook procedure to be installed.",
-                            "example": "WH_KEYBOARD_LL"
-                        },
-                        {
-                            "name": "Ext.api.parameters.io_control_code",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The I/O control code for the requested device operation.",
-                            "example": 27365
-                        },
-                        {
-                            "name": "Ext.api.parameters.namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "WMI namespace to which the connection is made.",
-                            "example": "root\\Microsoft\\Windows\\DeviceGuard"
-                        },
-                        {
-                            "name": "Ext.api.parameters.operation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Specifies the connection or request to WMI",
-                            "example": "Win32_Process::Create"
-                        },
-                        {
-                            "name": "Ext.api.parameters.procedure",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The memory address of the procedure or function.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.api.parameters.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
-                            "example": "RWX|GUARD"
-                        },
-                        {
-                            "name": "Ext.api.parameters.protection_old",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
-                            "example": "RCX"
-                        },
-                        {
-                            "name": "Ext.api.parameters.r8",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 R8 general purpose register. Third argument in a __fastcall.",
-                            "example": 3
-                        },
-                        {
-                            "name": "Ext.api.parameters.r9",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 R9 general purpose register. Fourth argument in a __fastcall.",
-                            "example": 4
-                        },
-                        {
-                            "name": "Ext.api.parameters.rax",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RAX general purpose register. Return value in a __fastcall.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rbp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RBP general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rbx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The x64 RBX general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rcx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RCX general purpose register. First argument in a __fastcall.",
-                            "example": 1
-                        },
-                        {
-                            "name": "Ext.api.parameters.rdi",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RDI general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rdx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RDX general purpose register. Second argument in a __fastcall.",
-                            "example": 2
-                        },
-                        {
-                            "name": "Ext.api.parameters.rip",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RIP instruction pointer register.",
-                            "example": 140706153693184
-                        },
-                        {
-                            "name": "Ext.api.parameters.rsi",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The x64 RSI general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rsp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RSP stack pointer register.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.api.parameters.size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.api.parameters.usage",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.",
-                            "example": "KEYBOARD"
-                        },
-                        {
-                            "name": "Ext.api.parameters.usage_page",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.",
-                            "example": "GENERIC"
-                        },
-                        {
-                            "name": "Ext.api.summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The summary of the API call and its parameters.",
-                            "example": "VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.created_suspended",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory allocation containing the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Original memory size requested when the memory was allocated.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-                            "example": "PRIVATE"
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The address where bytes_compressed begins.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether bytes_compressed is present in this event.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the memory region.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A sequence of signature names matched.",
-                            "example": "Windows.EICAR.Not-a-virus"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature identifier"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The first matching details."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The first matching details.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of file matching signature."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of file matching signature."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the first yara rule matched."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the first yara rule matched."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Additional matching details if available.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The second matching details.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of second file matching signature.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of second file matching signature.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the second yara rule matched.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the second yara rule matched.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature version"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
-                            "example": "C:\\Windows\\System32\\mshtml.dll"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.pehash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
-                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "PE Section List name."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the file at mapped_path is an executable.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.pehash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
-                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "PE Section List name."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether an executable file was found in memory.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.region_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.region_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "Ext.memory_region.region_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of the memory region.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.memory_region.region_start_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 64 bytes at the region base address.",
-                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
-                        },
-                        {
-                            "name": "Ext.memory_region.region_state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-                            "example": "COMMIT"
-                        },
-                        {
-                            "name": "Ext.memory_region.strings",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Array of strings found within the memory region.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.instruction_pointer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The return address of this stack frame."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.module_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path to the DLL/module containing `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection_provenance",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the memory region that last modified the protection of this page.  \"Unbacked\" can indicate shellcode."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_contains_unbacked",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The module that installed the final API hook in the call stack."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_hook_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_hook_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_hook_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_hook_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The final non-win32 module in the call stack."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory region that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_user_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file name of the call_stack_final_user_module.",
-                            "example": "example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_user_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory protection for the acting region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.protection_provenance",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the memory region that caused the last modification of the protection of this page. \"Unbacked\" may indicate shellcode.",
-                            "example": "third_party_hook.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.protection_provenance_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path of the module that caused the last modification the protection of this page.",
-                            "example": "C:\\Program Files\\Hook Inc\\third_party_hook.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.reason",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The unexpected call_stack_summary that led to an \"Undetermined\" protection_provenance.",
-                            "example": "ntdll.dll|kernelbase.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "@timestamp": "2023-01-09T19:38:51.5141503Z",
-                "Target": {
-                    "process": {
-                        "Ext": {
-                            "created_suspended": true,
-                            "protection": "PsProtectedSignerWinTcb",
-                            "memory_region": {
-                                "allocation_base": 1649160290304,
-                                "allocation_protection": "RWX",
-                                "allocation_size": 4096,
-                                "allocation_type": "PRIVATE",
-                                "bytes_address": 1649160290304,
-                                "bytes_allocation_offset": 0,
-                                "bytes_compressed": "eJztwbEJACAMALA+5uAtWnAoOPg/+EWnJO9k1bo742XuMRsEAAAA0OsD8lge9g==",
-                                "bytes_compressed_present": true,
-                                "hash": {
-                                    "sha256": "0b28b598ef70fd2377613fd88a50d52047ae31c16f2c688f3aa4e0b98d63730c"
-                                },
-                                "memory_pe_detected": false,
-                                "region_base": 1649160290304,
-                                "region_protection": "R--",
-                                "region_size": 4096,
-                                "region_state": "COMMIT",
-                                "strings": [
-                                    "shellcode",
-                                    "seed=AAAA"
-                                ]
-                            },
-                            "token": {
-                                "integrity_level_name": "high"
-                            }
-                        },
-                        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI1NzMyLTE2OTkwMDE3NDAuOTU4NTY4MDAw",
-                        "executable": "C:\\Temp\\1_StayRunningWin32_x64.exe",
-                        "name": "1_StayRunningWin32_x64.exe",
-                        "pid": 25732
-                    }
-                },
-                "dll": {
-                    "Ext": {
-                        "code_signature": [
-                            {
-                                "exists": true,
-                                "status": "trusted",
-                                "subject_name": "Microsoft Windows",
-                                "trusted": true
-                            }
-                        ]
-                    },
-                    "hash": {
-                        "sha256": "8b9731a4b83e801cda7b918f8194608e91f86b3a86ffb6bb24230b1cc28e1a54"
-                    },
-                    "path": "c:\\windows\\system32\\drivers\\pktmon.sys"
-                },
-                "destination": {
-                    "ip": "2001:4860:4860::8844",
-                    "port": 139
-                },
-                "event": {
-                    "category": [
-                        "api",
-                        "intrusion_detection"
-                    ],
-                    "created": "2023-01-09T19:38:51.5141503Z",
-                    "dataset": "endpoint.events.api",
-                    "id": "MvlgiHxIZtj1+Abi++++++ul",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "outcome": "success",
-                    "provider": "Microsoft-Windows-Threat-Intelligence",
-                    "sequence": 3802,
-                    "type": [
-                        "credential_access"
-                    ]
-                },
-                "host": {
-                    "architecture": "x86_64",
-                    "hostname": "DESKTOP-OCG8CR6",
-                    "id": "dabadaba-0000-0000-0000-000000000000",
-                    "ip": [
-                        "169.254.104.226",
-                        "fe80::6037:d589:2ee9:772f",
-                        "172.22.6.230",
-                        "fe80::80ea:8e8d:e1f2:6622",
-                        "169.254.74.35",
-                        "fe80::900c:a9d3:fd8:9345",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "mac": [
-                        "00-15-5D-00-09-18",
-                        "00-15-5D-00-09-19",
-                        "00-15-5D-00-09-17"
-                    ],
-                    "name": "DESKTOP-OCG8CR6",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows 11 Enterprise N"
-                        },
-                        "family": "windows",
-                        "full": "Windows 11 Enterprise N 22H2 (10.0.22621.963)",
-                        "kernel": "22H2 (10.0.22621.963)",
-                        "name": "Windows",
-                        "platform": "windows",
-                        "type": "windows",
-                        "version": "22H2 (10.0.22621.963)"
-                    }
-                },
-                "message": "Endpoint API event - hand-crafted with a superset of fields",
-                "network": {
-                    "transport": "tcp",
-                    "type": "ipv6"
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTgxMi0xNjczMjkxNTMzLjcxNjczMTgwMA==",
-                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ5NjAtMTY3Mjk2NTgzMC4yODc0OTYxMDA=",
-                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTY2MjgtMTY3Mjk2NTc3Mi41MTg4MDA1MDA=",
-                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ2MDAtMTY3Mjk2NTcxMy40NzY1NDUyMDA="
-                        ],
-                        "api": {
-                            "behaviors": [
-                                "cross-process",
-                                "rapid_background_polling",
-                                "multiple_polling_processes",
-                                "pid_spoofing"
-                            ],
-                            "metadata": {
-                                "target_address_name": "Unbacked",
-                                "target_address_path": "c:\\windows\\system32\\ntdll.dll",
-                                "return_value": 1,
-                                "windows_count": 2,
-                                "visible_windows_count": 0,
-                                "thread_info_flags": 16,
-                                "start_address_module": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe",
-                                "start_address_allocation_protection": "RCX",
-                                "procedure_symbol": "taskbar.dll",
-                                "ms_since_last_keyevent": 94,
-                                "background_callcount": 6021,
-                                "security_descriptor": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)",
-                                "client_machine": "DESKTOP-EXAMPLE",
-                                "client_machine_fqdn": "DESKTOP-EXAMPLE",
-                                "client_process_id": 3600,
-                                "client_is_local": true,
-                                "amsi_filenames": [
-                                    "C:\\script.ps1"
-                                ],
-                                "amsi_logs": {
-                                    "entries": [
-                                        "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
-                                    ],
-                                    "type": "PowerShell"
-                                }
-                            },
-                            "name": "OpenProcess",
-                            "parameters": {
-                                "desired_access": [
-                                    "PROCESS_QUERY_LIMITED_INFORMATION",
-                                    "PROCESS_VM_READ"
-                                ],
-                                "desired_access_numeric": 4112,
-                                "handle_type": "process",
-                                "address": 2904525045760,
-                                "allocation_type": "COMMIT|RESERVE",
-                                "protection": "R-X",
-                                "protection_old": "R-X",
-                                "size": 16,
-                                "context_flags": 1048607,
-                                "r8": 8,
-                                "r9": 9,
-                                "rax": 10,
-                                "rbp": 3,
-                                "rbx": 11,
-                                "rcx": 2883351609344,
-                                "rdi": 5,
-                                "rdx": 13,
-                                "rip": 140706538588528,
-                                "rsi": 4,
-                                "rsp": 2,
-                                "eax": 10,
-                                "ebp": 3,
-                                "ebx": 11,
-                                "ecx": 12,
-                                "edi": 5,
-                                "edx": 0,
-                                "eip": 1,
-                                "esi": 4,
-                                "esp": 2,
-                                "argument1": 2583984274656,
-                                "argument2": 4105953215,
-                                "argument3": 31058890,
-                                "procedure": 140705553857280,
-                                "usage_page": "GENERIC",
-                                "usage": "KEYBOARD",
-                                "flags": "INPUTSINK",
-                                "hook_type": "WH_KEYBOARD_LL",
-                                "hook_module": "c:\\windows\\system32\\taskbar.dll",
-                                "device": "\\Device\\PktMonDev",
-                                "io_control_code": 27365,
-                                "event_filter_name": "ExampleFilter",
-                                "event_filter_details": "__EventFilter{EventNamespace = \"root\\CimV2\"; Name = \"ExampleFilter\";};",
-                                "consumer_name": "ExampleConsumer",
-                                "consumer_type": "CommandLineEventConsumer",
-                                "consumer_details": "CommandLineEventConsumer{Name = \"ExampleConsumer\";};",
-                                "namespace": "root\\Microsoft\\Windows\\DeviceGuard",
-                                "operation": "Win32_Process::Create",
-                                "app_name": "PowerShell",
-                                "content_name": "C:\\script.ps1",
-                                "buffer": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
-                            },
-                            "summary": "VirtualAllocEx( charmap.exe, NULL, 0x10, COMMIT|RESERVE, R-X )"
-                        },
-                        "code_signature": [
-                            {
-                                "exists": true,
-                                "status": "errorBadDigest",
-                                "subject_name": "Microsoft Windows",
-                                "trusted": false
-                            }
-                        ],
-                        "memory_region": {
-                            "allocation_base": 140712018378752,
-                            "allocation_protection": "RCX",
-                            "allocation_size": 45056,
-                            "allocation_type": "IMAGE",
-                            "mapped_path": "C:\\Program Files\\Python39\\DLLs\\libffi-7.dll",
-                            "region_base": 140712018395136,
-                            "region_protection": "R-X",
-                            "region_size": 8192,
-                            "region_state": "COMMIT"
-                        },
-                        "token": {
-                            "integrity_level_name": "system"
-                        }
-                    },
-                    "code_signature": {
-                        "exists": true,
-                        "status": "errorBadDigest",
-                        "subject_name": "Microsoft Windows",
-                        "trusted": false
-                    },
-                    "command_line": "",
-                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTkxNi0xNjczMjkzMTMwLjk0NjAwMjAw",
-                    "executable": "c\\git\\endpoint-dev\\Tools\\Leia\\modules\\exe_malware\\mimikatz.exe",
-                    "name": "mimikatz.exe",
-                    "pid": 916,
-                    "thread": {
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "allocation_private_bytes": 4096,
-                                    "protection_provenance": "dabapi.dll",
-                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!ZwProtectVirtualMemory+0x14"
-                                },
-                                {
-                                    "symbol_info": "c:\\windows\\system32\\kernelbase.dll!VirtualProtect+0x36"
-                                },
-                                {
-                                    "allocation_private_bytes": 8192,
-                                    "callsite_leading_bytes": "c048895424204c8bc9488d0d801f0000418d500248ff15052a00000f1f4400004883c438c3cccccccccccccccccccccc4883ec2048b880bf1acaf87f0000ffd0",
-                                    "callsite_trailing_bytes": "4883c420c3ec48498363e800498d4320ba2500000049c743e004000000440fb7ca4c8d05d0320000ba2b000000498943d848ff15f82a00000f1f4400004883c4",
-                                    "protection": "RWX",
-                                    "protection_provenance": "eventstests.exe",
-                                    "symbol_info": "c:\\windows\\system32\\dabapi.dll!DabApiBufferFree+0x10"
-                                },
-                                {
-                                    "symbol_info": "Unknown"
-                                }
-                            ],
-                            "call_stack_final_user_module": {
-                                "allocation_private_bytes": 4096,
-                                "code_signature": [
-                                    {
-                                        "exists": true,
-                                        "status": "trusted",
-                                        "subject_name": "Microsoft Windows",
-                                        "trusted": true
-                                    }
-                                ],
-                                "hash": {
-                                    "sha256": "0386c57d59ee1292bb74d9878358da7a0ba00e5b56ed52fd6171b9e6d29d85aa"
-                                },
-                                "name": "dabapi.dll",
-                                "path": "c:\\windows\\system32\\dabapi.dll",
-                                "protection": "RWX",
-                                "protection_provenance": "eventstests.exe",
-                                "protection_provenance_path": "c:\\dev\\eventstests.exe",
-                                "reason": "ntdll.dll"
-                            },
-                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll"
-                        },
-                        "id": 11628
-                    }
-                },
-                "user": {
-                    "domain": "DESKTOP-OCG8CR6",
-                    "id": "S-1-5-21-3820246941-898183108-3095036578-1001",
-                    "name": "User"
-                }
-            }
-        },
-        {
-            "name": "network",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "address",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
-                        },
-                        {
-                            "name": "as.number",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
-                            "example": 15169
-                        },
-                        {
-                            "name": "as.organization.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Organization name.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Google LLC"
-                        },
-                        {
-                            "name": "bytes",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Bytes sent from the destination to the source.",
-                            "example": 184,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "domain",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.",
-                            "example": "foo.example.com"
-                        },
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the destination (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "packets",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Packets sent from the destination to the source.",
-                            "example": 12
-                        },
-                        {
-                            "name": "port",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Port of the destination.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "registered_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "top_level_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dns",
-                    "title": "DNS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.options",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DNS options field, uint64, representing as a keyword to avoid overflows in ES"
-                        },
-                        {
-                            "name": "Ext.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "DNS status field, uint32"
-                        },
-                        {
-                            "name": "question.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
-                            "example": "www.example.com"
-                        },
-                        {
-                            "name": "question.registered_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "question.subdomain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The subdomain is all of the labels under the registered_domain.\nIf the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
-                            "example": "www"
-                        },
-                        {
-                            "name": "question.top_level_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        },
-                        {
-                            "name": "question.type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of record being queried.",
-                            "example": "AAAA"
-                        },
-                        {
-                            "name": "resolved_ip",
-                            "level": "extended",
-                            "type": "ip",
-                            "description": "Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.",
-                            "example": "[\"10.10.10.10\", \"10.10.10.11\"]"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "http",
-                    "title": "HTTP",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to HTTP activity. Use the `url` field set to store the url of the request.",
-                    "fields": [
-                        {
-                            "name": "request.body.bytes",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Size in bytes of the request body.",
-                            "example": 887,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "request.body.content",
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "The full HTTP request body.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Hello world"
-                        },
-                        {
-                            "name": "request.bytes",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Total size in bytes of the request (body and headers).",
-                            "example": 1437,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "response.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "response.Ext.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "HTTP version"
-                        },
-                        {
-                            "name": "response.body.bytes",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Size in bytes of the response body.",
-                            "example": 887,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "response.body.content",
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "The full HTTP response body.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Hello world"
-                        },
-                        {
-                            "name": "response.bytes",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Total size in bytes of the response (body and headers).",
-                            "example": 1437,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "response.status_code",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "HTTP response status code.",
-                            "example": 404,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "network",
-                    "title": "Network",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.",
-                    "fields": [
-                        {
-                            "name": "bytes",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Total bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.",
-                            "example": 368,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "community_id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec.",
-                            "example": "1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0="
-                        },
-                        {
-                            "name": "direction",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Direction of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values \"ingress\" or \"egress\".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values \"inbound\", \"outbound\", \"internal\" or \"external\".\nNote that \"internal\" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that \"external\" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.",
-                            "example": "inbound"
-                        },
-                        {
-                            "name": "iana_number",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.",
-                            "example": 6
-                        },
-                        {
-                            "name": "packets",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Total packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum.",
-                            "example": 24
-                        },
-                        {
-                            "name": "protocol",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying.",
-                            "example": "http"
-                        },
-                        {
-                            "name": "transport",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
-                            "example": "tcp"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
-                            "example": "ipv4"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "address",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
-                        },
-                        {
-                            "name": "as.number",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
-                            "example": 15169
-                        },
-                        {
-                            "name": "as.organization.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Organization name.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Google LLC"
-                        },
-                        {
-                            "name": "bytes",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Bytes sent from the source to the destination.",
-                            "example": 184,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "domain",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.",
-                            "example": "foo.example.com"
-                        },
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the source (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "packets",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Packets sent from the source to the destination.",
-                            "example": 12
-                        },
-                        {
-                            "name": "port",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Port of the source.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "registered_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "top_level_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "id": "afd348c6-0ec9-4961-805e-8ed2fc4c043b",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTYxMi0xMzI5MzU0OTEwOS43MzU5NDk3MDA=",
-                            "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTQ3Ni0xMzI5MzU0OTEwOS4zODExMTM3MDA="
-                        ],
-                        "code_signature": [
-                            {
-                                "trusted": false,
-                                "subject_name": "Google LLC",
-                                "exists": true,
-                                "status": "errorExpired"
-                            }
-                        ]
-                    },
-                    "parent": {
-                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
-                        "group_leader": {
-                            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-                        }
-                    },
-                    "entry_leader": {
-                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
-                        "parent": {
-                            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-                        }
-                    },
-                    "session_leader": {
-                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-                    },
-                    "group_leader": {
-                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-                    },
-                    "code_signature": {
-                        "trusted": false,
-                        "subject_name": "Google LLC",
-                        "exists": true,
-                        "status": "errorExpired"
-                    },
-                    "name": "GCEWindowsAgent.exe",
-                    "pid": 580,
-                    "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
-                    "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
-                },
-                "destination": {
-                    "geo": {
-                        "continent_name": "North America",
-                        "country_iso_code": "US",
-                        "country_name": "United States",
-                        "location": {
-                            "lon": -97.822,
-                            "lat": 37.751
-                        }
-                    },
-                    "as": {
-                        "number": 15169,
-                        "organization": {
-                            "name": "GOOGLE"
-                        }
-                    },
-                    "address": "64.233.191.95",
-                    "port": 443,
-                    "bytes": 4923,
-                    "ip": "64.233.191.95"
-                },
-                "source": {
-                    "address": "10.201.0.32",
-                    "port": 54924,
-                    "bytes": 498,
-                    "ip": "10.201.0.32"
-                },
-                "dns": {
-                    "Ext": {
-                        "status": 123,
-                        "options": 9223372036854775808
-                    },
-                    "resolved_ip": [
-                        "10.10.10.10",
-                        "10.10.10.11"
-                    ],
-                    "question": {
-                        "name": "foo",
-                        "type": "A"
-                    }
-                },
-                "message": "Endpoint network event",
-                "network": {
-                    "transport": "tcp",
-                    "type": "ipv4",
-                    "direction": "egress"
-                },
-                "@timestamp": "2022-04-04T18:52:00.6007809Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.network"
-                },
-                "host": {
-                    "hostname": "mgmt-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.32",
-                        "fe80::f8e6:a511:69ea:27c4",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "mgmt-win-1",
-                    "id": "51b19c6c-27e3-4c80-ac2a-b72ed52c40c9",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 36090,
-                    "ingested": "2022-04-04T18:52:21Z",
-                    "created": "2022-04-04T18:52:00.6007809Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "disconnect_received",
-                    "id": "MYfZG5h8j1qej16H+++++CFe",
-                    "category": [
-                        "network"
-                    ],
-                    "type": [
-                        "end"
-                    ],
-                    "dataset": "endpoint.events.network"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                }
-            }
-        },
-        {
-            "name": "metrics",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Endpoint",
-                    "title": "Endpoint",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
-                    "fields": [
-                        {
-                            "name": "metrics",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Metrics fields hold the endpoint and system's performance metrics"
-                        },
-                        {
-                            "name": "metrics.cpu",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "CPU statistics"
-                        },
-                        {
-                            "name": "metrics.cpu.endpoint",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "CPU metrics for the endpoint"
-                        },
-                        {
-                            "name": "metrics.cpu.endpoint.histogram",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "histogram",
-                            "description": "This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket"
-                        },
-                        {
-                            "name": "metrics.cpu.endpoint.latest",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "half_float",
-                            "description": "Average CPU over the last sample interval"
-                        },
-                        {
-                            "name": "metrics.cpu.endpoint.mean",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "half_float",
-                            "description": "Average CPU load used by the endpoint"
-                        },
-                        {
-                            "name": "metrics.disks",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "An array of disk information for the host",
-                            "enabled": false
-                        },
-                        {
-                            "name": "metrics.disks.device",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device name"
-                        },
-                        {
-                            "name": "metrics.disks.endpoint_drive",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "This field will be present and set to true only for the drive that holds the installed endpoint"
-                        },
-                        {
-                            "name": "metrics.disks.free",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The number of bytes marked as free on the disk"
-                        },
-                        {
-                            "name": "metrics.disks.fstype",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file system type for the drive"
-                        },
-                        {
-                            "name": "metrics.disks.mount",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The disks mount location"
-                        },
-                        {
-                            "name": "metrics.disks.total",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The size of the disk in bytes"
-                        },
-                        {
-                            "name": "metrics.documents_volume",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Statistics about sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.alerts.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.alerts.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.alerts.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.alerts.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of API Event sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent API Event documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "An array of API Event document statistics per source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of API Event sent documents from source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent API Event documents from source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.source",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "API Event document source name"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed API Event documents from source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed API Event documents from source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed API Event documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed API Event documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.diagnostic_alerts.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.diagnostic_alerts.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.diagnostic_alerts.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.diagnostic_alerts.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.dns_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.dns_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.dns_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.dns_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.file_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.file_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.file_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.file_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.library_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.library_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.library_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.library_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.network_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.network_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.network_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.network_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.overall.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.overall.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.overall.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.overall.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.process_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.process_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.process_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.process_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.registry_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.registry_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.registry_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.registry_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.security_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.security_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.security_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.security_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.event_filter.active_global_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The number of active global event filters",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.event_filter.active_user_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The number of active user event filters",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.malicious_behavior_rules",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "An array of performance information about each malicious behavior rule",
-                            "enabled": false
-                        },
-                        {
-                            "name": "metrics.malicious_behavior_rules.endpoint_uptime_percent",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Perfect of Endpoint's update spent running the rule",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.malicious_behavior_rules.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The rule id",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.memory",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Memory statistics"
-                        },
-                        {
-                            "name": "metrics.memory.endpoint",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Endpoint memory utilization"
-                        },
-                        {
-                            "name": "metrics.memory.endpoint.private",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The memory private to the endpoint"
-                        },
-                        {
-                            "name": "metrics.memory.endpoint.private.latest",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The memory usage by the endpoint for the last sample interval"
-                        },
-                        {
-                            "name": "metrics.memory.endpoint.private.mean",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Average memory usage by the endpoint since its start"
-                        },
-                        {
-                            "name": "metrics.system_impact",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "An array of system impact information",
-                            "enabled": false,
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.authentication_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing authentication events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.authentication_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on authentication events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.dns_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing DNS events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.dns_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on DNS events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.file_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing file events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.file_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on file events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.library_load_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing library load events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.library_load_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on library load events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.malware.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing malware scanning due to the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.malware.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on malware scanning due to the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.network_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing network events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.network_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on network events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.overall.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing activity for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.overall.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent monitoring the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the process",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "description": "'The identifier used to sign the binary.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'",
-                            "example": "com.apple.xpc.proxy",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "description": "'The team identifier used to sign the binary.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'",
-                            "example": "EQHXZ8M8AV",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Path to the process executable for the impact entry",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing process events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on process events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.registry_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing registry events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.registry_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on registry events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.threat_intelligence_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.threat_intelligence_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.win32k_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.win32k_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.threads",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Statistics about the individual Endpoint threads (array)",
-                            "enabled": false
-                        },
-                        {
-                            "name": "metrics.threads.cpu.mean",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The thread's average CPU use",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.threads.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The thread name",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.uptime",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Number of seconds since boot"
-                        },
-                        {
-                            "name": "metrics.uptime.endpoint",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of seconds since the endpoint was started"
-                        },
-                        {
-                            "name": "metrics.uptime.system",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of seconds since the system was started"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "end",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "build": {
-                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-                    },
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "message": "Endpoint metrics",
-                "@timestamp": "2022-04-04T18:38:15.7178887Z",
-                "Endpoint": {
-                    "metrics": {
-                        "system_impact": [
-                            {
-                                "file_events": {
-                                    "week_ms": 418
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows Publisher",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\svchost.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 7483
-                                },
-                                "process_events": {
-                                    "week_ms": 78
-                                },
-                                "registry_events": {
-                                    "week_ms": 248
-                                },
-                                "dns_events": {
-                                    "week_ms": 16
-                                },
-                                "network_events": {
-                                    "week_ms": 8
-                                },
-                                "overall": {
-                                    "week_ms": 11744
-                                },
-                                "authentication_events": {
-                                    "week_ms": 155
-                                },
-                                "library_load_events": {
-                                    "week_ms": 3028
-                                },
-                                "cred_access_events": {
-                                    "week_ms": 10
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 250
-                                },
-                                "win32k_events": {
-                                    "week_ms": 50
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 46
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 2
-                                },
-                                "process_events": {
-                                    "week_ms": 19
-                                },
-                                "registry_events": {
-                                    "week_ms": 3
-                                },
-                                "overall": {
-                                    "week_ms": 8290
-                                },
-                                "library_load_events": {
-                                    "week_ms": 7890
-                                },
-                                "cred_access_events": {
-                                    "week_ms": 20
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 300
-                                },
-                                "win32k_events": {
-                                    "week_ms": 10
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 1641
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Elasticsearch, Inc.",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 2589
-                                },
-                                "process_events": {
-                                    "week_ms": 419
-                                },
-                                "registry_events": {
-                                    "week_ms": 1
-                                },
-                                "network_events": {
-                                    "week_ms": 32
-                                },
-                                "overall": {
-                                    "week_ms": 5046
-                                },
-                                "library_load_events": {
-                                    "week_ms": 4
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 360
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 2
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows Publisher",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\lsass.exe"
-                                },
-                                "process_events": {
-                                    "week_ms": 3
-                                },
-                                "registry_events": {
-                                    "week_ms": 83
-                                },
-                                "overall": {
-                                    "week_ms": 4761
-                                },
-                                "authentication_events": {
-                                    "week_ms": 3177
-                                },
-                                "library_load_events": {
-                                    "week_ms": 26
-                                },
-                                "cred_access_events": {
-                                    "week_ms": 1350
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 120
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\conhost.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 16
-                                },
-                                "process_events": {
-                                    "week_ms": 26
-                                },
-                                "registry_events": {
-                                    "week_ms": 3
-                                },
-                                "overall": {
-                                    "week_ms": 3261
-                                },
-                                "library_load_events": {
-                                    "week_ms": 2966
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 250
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 51
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false,
-                                            "status": "errorCode_endpoint: Initital state, no attempt to load signature was made"
-                                        }
-                                    ],
-                                    "executable": "System"
-                                },
-                                "malware": {
-                                    "week_ms": 1978
-                                },
-                                "overall": {
-                                    "week_ms": 2029
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\e266326169887aa7cb26b9e2aa421ee4\\System.Web.ni.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 1015
-                                },
-                                "overall": {
-                                    "week_ms": 1015
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 8
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Elasticsearch, Inc.",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\metricbeat-8.3.0-SNAPSHOT-windows-x86_64\\metricbeat.exe"
-                                },
-                                "process_events": {
-                                    "week_ms": 502
-                                },
-                                "dns_events": {
-                                    "week_ms": 84
-                                },
-                                "network_events": {
-                                    "week_ms": 1
-                                },
-                                "overall": {
-                                    "week_ms": 1162
-                                },
-                                "library_load_events": {
-                                    "week_ms": 417
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 150
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": false,
-                                            "subject_name": "Google LLC",
-                                            "exists": true,
-                                            "status": "errorExpired"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 627
-                                },
-                                "process_events": {
-                                    "week_ms": 89
-                                },
-                                "registry_events": {
-                                    "week_ms": 2
-                                },
-                                "dns_events": {
-                                    "week_ms": 7
-                                },
-                                "network_events": {
-                                    "week_ms": 8
-                                },
-                                "overall": {
-                                    "week_ms": 1068
-                                },
-                                "library_load_events": {
-                                    "week_ms": 85
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 250
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\39ce4aafe1a3bc56fb1435f6550dd7a3\\Microsoft.PowerShell.Commands.Utility.ni.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 760
-                                },
-                                "overall": {
-                                    "week_ms": 760
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 15
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\metricbeat-7.10.0-windows-x86_64\\metricbeat.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 29
-                                },
-                                "process_events": {
-                                    "week_ms": 634
-                                },
-                                "registry_events": {
-                                    "week_ms": 1
-                                },
-                                "dns_events": {
-                                    "week_ms": 8
-                                },
-                                "network_events": {
-                                    "week_ms": 4
-                                },
-                                "overall": {
-                                    "week_ms": 744
-                                },
-                                "library_load_events": {
-                                    "week_ms": 3
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 50
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\spoolsv.exe"
-                                },
-                                "process_events": {
-                                    "week_ms": 8
-                                },
-                                "registry_events": {
-                                    "week_ms": 40
-                                },
-                                "overall": {
-                                    "week_ms": 795
-                                },
-                                "library_load_events": {
-                                    "week_ms": 627
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 120
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Elasticsearch, Inc.",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Packetbeat\\packetbeat.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 74
-                                },
-                                "process_events": {
-                                    "week_ms": 432
-                                },
-                                "registry_events": {
-                                    "week_ms": 1
-                                },
-                                "network_events": {
-                                    "week_ms": 1
-                                },
-                                "overall": {
-                                    "week_ms": 599
-                                },
-                                "library_load_events": {
-                                    "week_ms": 61
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 30
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 20
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Corporation",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        },
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Corporation",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 350
-                                },
-                                "process_events": {
-                                    "week_ms": 19
-                                },
-                                "registry_events": {
-                                    "week_ms": 1
-                                },
-                                "overall": {
-                                    "week_ms": 480
-                                },
-                                "library_load_events": {
-                                    "week_ms": 70
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 20
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 6
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Elasticsearch, Inc.",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\filebeat-8.3.0-SNAPSHOT-windows-x86_64\\filebeat.exe"
-                                },
-                                "process_events": {
-                                    "week_ms": 395
-                                },
-                                "dns_events": {
-                                    "week_ms": 51
-                                },
-                                "network_events": {
-                                    "week_ms": 2
-                                },
-                                "overall": {
-                                    "week_ms": 494
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 40
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Google LLC",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Google\\Compute Engine\\vss\\GoogleVssProvider.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 439
-                                },
-                                "overall": {
-                                    "week_ms": 439
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\VSSVC.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 45
-                                },
-                                "process_events": {
-                                    "week_ms": 13
-                                },
-                                "registry_events": {
-                                    "week_ms": 124
-                                },
-                                "overall": {
-                                    "week_ms": 476
-                                },
-                                "authentication_events": {
-                                    "week_ms": 8
-                                },
-                                "library_load_events": {
-                                    "week_ms": 216
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 70
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\SYSTEM32\\mispace.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 353
-                                },
-                                "overall": {
-                                    "week_ms": 353
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\b1cbeb46534d9974961496306f2f1a28\\System.Web.Extensions.ni.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 305
-                                },
-                                "overall": {
-                                    "week_ms": 305
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 25
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\wbem\\WMIADAP.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 247
-                                },
-                                "process_events": {
-                                    "week_ms": 4
-                                },
-                                "registry_events": {
-                                    "week_ms": 5
-                                },
-                                "overall": {
-                                    "week_ms": 345
-                                },
-                                "library_load_events": {
-                                    "week_ms": 14
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 50
-                                }
-                            }
-                        ],
-                        "memory": {
-                            "endpoint": {
-                                "private": {
-                                    "mean": 288590259,
-                                    "latest": 493723648
-                                }
-                            }
-                        },
-                        "disks": [
-                            {
-                                "endpoint_drive": true,
-                                "total": 53564403712,
-                                "free": 25891106816,
-                                "device": "\\Device\\HarddiskVolume3",
-                                "mount": "C:\\",
-                                "fstype": "NTFS"
-                            },
-                            {
-                                "total": 100663296,
-                                "free": 73579520,
-                                "device": "\\Device\\HarddiskVolume2",
-                                "mount": "",
-                                "fstype": "FAT32"
-                            }
-                        ],
-                        "documents_volume": {
-                            "file_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 3485,
-                                "sent_bytes": 7302875
-                            },
-                            "security_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 259,
-                                "sent_bytes": 422247
-                            },
-                            "library_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 114,
-                                "sent_bytes": 287954
-                            },
-                            "process_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 201,
-                                "sent_bytes": 602914
-                            },
-                            "registry_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 605,
-                                "sent_bytes": 1288593
-                            },
-                            "dns_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 5250,
-                                "sent_bytes": 11364752
-                            },
-                            "network_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 1753,
-                                "sent_bytes": 3479631
-                            },
-                            "overall": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 11667,
-                                "sent_bytes": 24748966
-                            }
-                        },
-                        "cpu": {
-                            "endpoint": {
-                                "mean": 0.324235176435677,
-                                "latest": 62.6406111450215
-                            }
-                        },
-                        "threads": [
-                            {
-                                "name": "actionsAPIThread",
-                                "cpu": {
-                                    "mean": 0.00456829602558246
-                                }
-                            },
-                            {
-                                "name": "stateReportThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "checkinAPIThread",
-                                "cpu": {
-                                    "mean": 0.0365463682046597
-                                }
-                            },
-                            {
-                                "name": "KernelAsyncMessageQueueConsumerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "Cron",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "File Cache",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "FileLogThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "LoggingLimitThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "CredentialAccessEventDispatcherThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelPortConsumerThread",
-                                "cpu": {
-                                    "mean": 0.00456454263282819
-                                }
-                            },
-                            {
-                                "name": "KernelPortConsumerThread",
-                                "cpu": {
-                                    "mean": 0.00456454263282819
-                                }
-                            },
-                            {
-                                "name": "RulesEngineThread",
-                                "cpu": {
-                                    "mean": 0.0091324200913242
-                                }
-                            },
-                            {
-                                "name": "KernelPortConsumerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelAsyncMessageQueueConsumerThread",
-                                "cpu": {
-                                    "mean": 0.00456454263282819
-                                }
-                            },
-                            {
-                                "name": "KernelSyncQueueConsumerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "DocumentLoggingThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "DocumentLoggingMaintenance",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "BulkConsumerThread",
-                                "cpu": {
-                                    "mean": 0.00455871626549964
-                                }
-                            },
-                            {
-                                "name": "DocumentLoggingConsumerThread",
-                                "cpu": {
-                                    "mean": 0.113967906637491
-                                }
-                            },
-                            {
-                                "name": "DocumentLoggingLimitThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.022822713164141
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.022822713164141
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "ArtifactManifestDownload",
-                                "cpu": {
-                                    "mean": 0.12311901504788
-                                }
-                            },
-                            {
-                                "name": "PolicyReloadThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "CredentialAccessClassifierThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelPortConsumerThread",
-                                "cpu": {
-                                    "mean": 0.0136936278984846
-                                }
-                            },
-                            {
-                                "name": "PerformanceMonitorWorkerThread",
-                                "cpu": {
-                                    "mean": 0.00912200684150513
-                                }
-                            },
-                            {
-                                "name": "MetadataThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "EventsQueueThread",
-                                "cpu": {
-                                    "mean": 0.0729760547320411
-                                }
-                            },
-                            {
-                                "name": "DelayedAlertEnrichment",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "MaintainProcessMap",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "FileScoreThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "DiagnosticMalwareThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "QuarantineManagerWorkerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "EventProcessingThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "HostIsolationMonitorThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "serviceCommsThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "grpcConnectionManagerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "RansomwareGlobalUserThread"
-                            },
-                            {
-                                "name": "RansomwareProcessMonitorThread"
-                            },
-                            {
-                                "name": "RansomwareFileCacheCleanupThread"
-                            },
-                            {
-                                "name": "RansomwareParseUnverifiedThread"
-                            },
-                            {
-                                "name": "RansomwareLuaVerifiedThread"
-                            }
-                        ],
-                        "uptime": {
-                            "endpoint": 21930,
-                            "system": 21992
-                        }
-                    }
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "metrics",
-                    "dataset": "endpoint.metrics"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 35124,
-                    "ingested": "2022-04-04T18:38:16Z",
-                    "created": "2022-04-04T18:38:15.7178887Z",
-                    "kind": "metric",
-                    "module": "endpoint",
-                    "action": "endpoint_metrics",
-                    "id": "MYfZG00oEwD2/fqT+++++Byi",
-                    "category": [
-                        "host"
-                    ],
-                    "type": [
-                        "info"
-                    ],
-                    "dataset": "endpoint.metrics"
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file
diff --git a/scripts/generate-docs/output/policy.md b/scripts/generate-docs/output/policy.md
deleted file mode 100644
index 59e713971..000000000
--- a/scripts/generate-docs/output/policy.md
+++ /dev/null
@@ -1,264 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `Endpoint`
-
-### Description
-Fields describing the state of the Elastic Endpoint when an event occurs.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `configuration` | Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state | None |
-| `configuration.isolation` | Configuration setting for Host Isolation from the network | None |
-| `policy` | The policy fields are used to hold information about applied policy. | None |
-| `policy.applied` | information about the policy that is applied | None |
-| `policy.applied.actions` | actions applied during the application of the policy | None |
-| `policy.applied.actions.message` | message about the application of the action to further qualify the status of the action | None |
-| `policy.applied.actions.name` | name of the action that was applied | None |
-| `policy.applied.actions.status` | the status of the action | None |
-| `policy.applied.artifacts` | information about protection artifacts applied. | None |
-| `policy.applied.artifacts.global` | information about global protection artifacts applied. | None |
-| `policy.applied.artifacts.global.channel` | global artifacts rollout channel | None |
-| `policy.applied.artifacts.global.identifiers` | the identifiers of global artifacts applied. | None |
-| `policy.applied.artifacts.global.identifiers.name` | the name of global artifact applied. | None |
-| `policy.applied.artifacts.global.identifiers.sha256` | the sha256 of global artifacts applied. | None |
-| `policy.applied.artifacts.global.snapshot` | the snapshot date of applied global artifacts or 'latest' | None |
-| `policy.applied.artifacts.global.update_age` | number of days since global artifacts were made up-to-date | None |
-| `policy.applied.artifacts.global.version` | the version of global artifacts applied. | None |
-| `policy.applied.artifacts.user` | information about user protection artifacts applied. | None |
-| `policy.applied.artifacts.user.identifiers` | the identifiers of user artifacts applied. | None |
-| `policy.applied.artifacts.user.identifiers.name` | the name of user artifact applied. | None |
-| `policy.applied.artifacts.user.identifiers.sha256` | the sha256 of user artifacts applied. | None |
-| `policy.applied.artifacts.user.version` | the version of user artifacts applied. | None |
-| `policy.applied.endpoint_policy_version` | the version of this applied policy | None |
-| `policy.applied.id` | the id of the applied policy | None |
-| `policy.applied.name` | the name of this applied policy | None |
-| `policy.applied.response` | the response of actions that failed in the applied policy | None |
-| `policy.applied.response.configurations` | the configurations of the applied policy | None |
-| `policy.applied.response.configurations.antivirus_registration` | overall antivirus registration configuration and status of the applied policy | None |
-| `policy.applied.response.configurations.antivirus_registration.concerned_actions` | all actions that were taken for antivirus registration | None |
-| `policy.applied.response.configurations.antivirus_registration.status` | the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions | None |
-| `policy.applied.response.configurations.attack_surface_reduction.concerned_actions` | all actions that were taken for attack surface reduction | None |
-| `policy.applied.response.configurations.attack_surface_reduction.status` | the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions | None |
-| `policy.applied.response.configurations.behavior_protection.concerned_actions` | all actions that were taken for behavior_protection | None |
-| `policy.applied.response.configurations.behavior_protection.status` | the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
-| `policy.applied.response.configurations.events` | overall event collection configuration and status of the applied policy | None |
-| `policy.applied.response.configurations.events.concerned_actions` | all actions that were taken for event collection | None |
-| `policy.applied.response.configurations.events.status` | the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
-| `policy.applied.response.configurations.host_isolation.concerned_actions` | all actions that were taken for host isolation | None |
-| `policy.applied.response.configurations.host_isolation.status` | the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
-| `policy.applied.response.configurations.logging` | overall logging configuration and status of the applied policy | None |
-| `policy.applied.response.configurations.logging.concerned_actions` | all actions that were taken for logging | None |
-| `policy.applied.response.configurations.logging.status` | the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions | None |
-| `policy.applied.response.configurations.malware` | overall malware configuration and status of the applied policy | None |
-| `policy.applied.response.configurations.malware.concerned_actions` | all actions that were taken for malware | None |
-| `policy.applied.response.configurations.malware.status` | the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
-| `policy.applied.response.configurations.memory_protection` | overall memory_protection configuration and status of the applied policy | None |
-| `policy.applied.response.configurations.memory_protection.concerned_actions` | all actions that were taken for memory_protection | None |
-| `policy.applied.response.configurations.memory_protection.status` | the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions | None |
-| `policy.applied.response.configurations.ransomware.concerned_actions` | all actions that were taken for ransomware | None |
-| `policy.applied.response.configurations.ransomware.status` | the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
-| `policy.applied.response.configurations.streaming` | overall data streaming configuration and status of the applied policy | None |
-| `policy.applied.response.configurations.streaming.concerned_actions` | all actions that were taken for data streaming | None |
-| `policy.applied.response.configurations.streaming.status` | the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions | None |
-| `policy.applied.response.diagnostic` | the diagnostic configurations of the applied policy | None |
-| `policy.applied.response.diagnostic.behavior_protection.concerned_actions` | all actions that were taken for the diagnostic configuration of behavior protection | None |
-| `policy.applied.response.diagnostic.behavior_protection.status` | the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
-| `policy.applied.response.diagnostic.credential_protection.concerned_actions` | all actions that were taken for the diagnostic configuration of credential protection | None |
-| `policy.applied.response.diagnostic.credential_protection.status` | the overall status of the diagnostic configuration of credential protection, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
-| `policy.applied.response.diagnostic.malware.concerned_actions` | all actions that were taken for the diagnostic configuration of malware | None |
-| `policy.applied.response.diagnostic.malware.status` | the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
-| `policy.applied.response.diagnostic.memory_protection.concerned_actions` | all actions that were taken for the diagnostic configuration of memory protection | None |
-| `policy.applied.response.diagnostic.memory_protection.status` | the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
-| `policy.applied.response.diagnostic.memory_scan.concerned_actions` | all actions that were taken for the diagnostic configuration of memory scan | None |
-| `policy.applied.response.diagnostic.memory_scan.status` | the overall status of the diagnostic configuration of memory scan, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
-| `policy.applied.response.diagnostic.ransomware.concerned_actions` | all actions that were taken for the diagnostic configuration of ransomware | None |
-| `policy.applied.response.diagnostic.ransomware.status` | the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions | None |
-| `policy.applied.status` | the status of the applied policy | None |
-| `policy.applied.version` | the version of this applied policy | None |
-| `state` | Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration) | None |
-| `state.isolation` | Current network isolation state of the host | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `build.original` | Extended build information for the agent.
-This field is intended to contain any build information that a data source may provide, no specific formatting is required. | metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC] |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/process.md b/scripts/generate-docs/output/process.md
deleted file mode 100644
index 23d190a3d..000000000
--- a/scripts/generate-docs/output/process.md
+++ /dev/null
@@ -1,804 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `ephemeral_id` | Ephemeral identifier of this agent (if one exists).
-This id normally changes across restarts, but `agent.id` does not. | 8a4f500f |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `name` | Custom name of the agent.
-This is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from. | foo |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `cloud`
-
-### Description
-Fields related to the cloud or infrastructure the events are coming from.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `account.id` | The cloud account or organization id used to identify different entities in a multi-tenant environment.
-Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | 666777888999 |
-| `instance.name` | Instance name of the host machine. | None |
-| `project.id` | The cloud project identifier.
-Examples: Google Cloud Project id, Azure Project id. | my-project |
-| `provider` | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | aws |
-| `region` | Region in which this host, resource, or service is located. | us-east-1 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `container`
-
-### Description
-Container fields are used for meta information about the specific container that is the source of information.
-These fields help correlate data based containers from any runtime.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique container id. | None |
-| `image.hash.all` | An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set. | [sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26] |
-| `image.name` | Name of the image the container was built on. | None |
-| `image.tag` | Container image tags. | None |
-| `name` | Container name. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `destination`
-
-### Description
-Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `group`
-
-### Description
-The group fields are meant to represent groups that are relevant to the event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | Group info prior to any setgid operations. | None |
-| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `Ext.real.name` | Name of the group. | None |
-| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `id` | Unique identifier for the group on the system/platform. | None |
-| `name` | Name of the group. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `boot.id` | Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container. | 88a1f0ed-5ae5-41ee-af6b-41921c311872 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `pid_ns_ino` | This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h. | 256383 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `orchestrator`
-
-### Description
-Fields that describe the resources which container orchestrators manage or act upon.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `cluster.id` | Unique ID of the cluster. | None |
-| `cluster.name` | Name of the cluster. | None |
-| `namespace` | Namespace in which the action is taking place. | kube-system |
-| `resource.ip` | IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running). | None |
-| `resource.name` | Name of the resource being acted upon. | test-pod-cdcws |
-| `resource.parent.type` | Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet). | DaemonSet |
-| `resource.type` | Type of resource being acted upon. | service |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `package`
-
-### Description
-These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `name` | Package name | go |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `process`
-
-### Description
-These fields contain information about a process.
-These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
-| `Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
-| `Ext.authentication_id` | Process authentication ID | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `Ext.created_suspended` | A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls. | true |
-| `Ext.defense_evasions` | List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping. | None |
-| `Ext.device.bus_type` | Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc. | None |
-| `Ext.device.dos_name` | DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,... | None |
-| `Ext.device.file_system_type` | Volume device file system type.
-Following are examples of the most frequently seen volume device file system types: NTFS UDF | None |
-| `Ext.device.nt_name` | NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2 | None |
-| `Ext.device.product_id` | ProductID of the device. It is provided by the vendor of the device if any. | None |
-| `Ext.device.serial_number` | Serial Number of the device. It is provided by the vendor of the device if any. | None |
-| `Ext.device.vendor_id` | VendorID of the device. It is provided by the vendor of the device. | None |
-| `Ext.device.volume_device_type` | Volume device type.
-Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System | None |
-| `Ext.dll.Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.dll.Ext.mapped_address` | The base address where this module is loaded. | None |
-| `Ext.dll.Ext.mapped_size` | The size of this module's memory mapping, in bytes. | None |
-| `Ext.dll.name` | Name of the library.
-This generally maps to the name of the file on disk. | kernel32.dll |
-| `Ext.dll.path` | Full file path of the library. | C:\Windows\System32\kernel32.dll |
-| `Ext.effective_parent.entity_id` | Unique identifier for the effective process. | c2c455d9f99375d |
-| `Ext.effective_parent.executable` | Executable name for the effective process. | C:\Windows\System32\wbem\WMIC.exe |
-| `Ext.effective_parent.name` | Process name for the effective process. | WMIC.exe |
-| `Ext.effective_parent.pid` | Process ID. | 4242 |
-| `Ext.memfd` | Object for memfd events. | None |
-| `Ext.memfd.flag_allow_seal` | Allow sealing operations on this file. | false |
-| `Ext.memfd.flag_cloexec` | Sets the the close-on-exec flag on the new file descriptor. | false |
-| `Ext.memfd.flag_exec` | Exec flag is set for file. | false |
-| `Ext.memfd.flag_hugetlb` | The anonymous file will be created in the hugetlbfs filesystem using huge pages. | false |
-| `Ext.memfd.flag_noexec_seal` | Sets both NOEXEC and MFD_ALLOW_SEALING. | false |
-| `Ext.memfd.flags` | Flags passed to the memfd operation. | 2 |
-| `Ext.memfd.name` | Filename for the created file. Appears in /proc/self/fd. | anon.txt |
-| `Ext.mitigation_policies` | Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled | None |
-| `Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
-| `Ext.ptrace` | Object for ptrace events. | None |
-| `Ext.ptrace.child_pid` | PID of the ptrace target. | None |
-| `Ext.ptrace.request` | ptrace request. | None |
-| `Ext.relative_file_creation_time` | Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future. | None |
-| `Ext.relative_file_name_modify_time` | Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future. | None |
-| `Ext.session` | Session information for the current process | None |
-| `Ext.session_info.authentication_package` | Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP | None |
-| `Ext.session_info.client_address` | Client's IPv4 or IPv6 address as a string, if available. | None |
-| `Ext.session_info.id` | Session ID | None |
-| `Ext.session_info.logon_type` | Session logon type.  Examples include Interactive, Network, and Service. | None |
-| `Ext.session_info.relative_logon_time` | Process creation time, relative to logon time, in seconds. | None |
-| `Ext.session_info.relative_password_age` | Process creation time, relative to the last time the password was changed, in seconds. | None |
-| `Ext.session_info.user_flags` | List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON. | None |
-| `Ext.shmget` | Object for shmget events. | None |
-| `Ext.shmget.flags` | flags passed to shmget. | None |
-| `Ext.shmget.key` | Key passed to the shmget request. | None |
-| `Ext.shmget.size` | Requested size. | None |
-| `Ext.token.elevation` | Whether the token is elevated or not | None |
-| `Ext.token.elevation_level` | What level of elevation the token has | one of "default", "full", "limited" |
-| `Ext.token.elevation_type` | What level of elevation the token has | one of "default", "full", "limited" |
-| `Ext.token.integrity_level_name` | Human readable integrity level. | one of "system", "high", "medium", "low", "untrusted" |
-| `Ext.token.security_attributes` | Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class. | TSA://ProcUnique, LUA://DecHdAutoAp |
-| `Ext.trusted` | Whether or not the process is a trusted application | None |
-| `Ext.trusted_descendant` | Whether or not the process is a descendent of a trusted application | None |
-| `args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `end` | The time the process ended. | 2016-05-23T08:05:34.853Z |
-| `entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `entry_leader.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `entry_leader.attested_groups.name` | Name of the group. | None |
-| `entry_leader.attested_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `entry_leader.attested_user.name` | Short name or login of the user. | a.einstein |
-| `entry_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `entry_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.entry_meta.source.ip` | IP address of the source (IPv4 or IPv6). | None |
-| `entry_leader.entry_meta.type` | The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console
-Note: This field is only set on process.session_leader. | None |
-| `entry_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `entry_leader.group.id` | Unique identifier for the group on the system/platform. | None |
-| `entry_leader.group.name` | Name of the group. | None |
-| `entry_leader.interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `entry_leader.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `entry_leader.parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.parent.pid` | Process id. | 4242 |
-| `entry_leader.parent.session_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `entry_leader.parent.session_leader.pid` | Process id. | 4242 |
-| `entry_leader.parent.session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `entry_leader.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `entry_leader.pid` | Process id. | 4242 |
-| `entry_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `entry_leader.real_group.name` | Name of the group. | None |
-| `entry_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `entry_leader.real_user.name` | Short name or login of the user. | a.einstein |
-| `entry_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
-For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
-This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
-Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
-Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
-| `entry_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `entry_leader.saved_group.name` | Name of the group. | None |
-| `entry_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `entry_leader.saved_user.name` | Short name or login of the user. | a.einstein |
-| `entry_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `entry_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `entry_leader.supplemental_groups.name` | Name of the group. | None |
-| `entry_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `entry_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `entry_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `entry_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `entry_leader.user.name` | Short name or login of the user. | a.einstein |
-| `entry_leader.working_directory` | The working directory of the process. | /home/alice |
-| `env_vars` | Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.
-May be filtered to protect sensitive information. | ["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"] |
-| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `exit_code` | The exit code of the process, if this is a termination event.
-The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
-| `group.id` | Unique identifier for the group on the system/platform. | None |
-| `group.name` | Name of the group. | None |
-| `group_leader.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `group_leader.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `group_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `group_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `group_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `group_leader.group.id` | Unique identifier for the group on the system/platform. | None |
-| `group_leader.group.name` | Name of the group. | None |
-| `group_leader.interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `group_leader.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `group_leader.pid` | Process id. | 4242 |
-| `group_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `group_leader.real_group.name` | Name of the group. | None |
-| `group_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `group_leader.real_user.name` | Short name or login of the user. | a.einstein |
-| `group_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
-For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
-This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
-Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
-Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
-| `group_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `group_leader.saved_group.name` | Name of the group. | None |
-| `group_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `group_leader.saved_user.name` | Short name or login of the user. | a.einstein |
-| `group_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `group_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `group_leader.supplemental_groups.name` | Name of the group. | None |
-| `group_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `group_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `group_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `group_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `group_leader.user.name` | Short name or login of the user. | a.einstein |
-| `group_leader.working_directory` | The working directory of the process. | /home/alice |
-| `hash.md5` | MD5 hash. | None |
-| `hash.sha1` | SHA1 hash. | None |
-| `hash.sha256` | SHA256 hash. | None |
-| `hash.sha512` | SHA512 hash. | None |
-| `interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `io` | A chunk of input or output (IO) from a single process.
-This field only appears on the top level process object, which is the process that wrote the output or read the input. | None |
-| `io.max_bytes_per_process_exceeded` | If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting. | None |
-| `io.text` | A chunk of output or input sanitized to UTF-8.
-Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word. | None |
-| `io.total_bytes_captured` | The total number of bytes captured in this event. | None |
-| `io.total_bytes_skipped` | The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero | None |
-| `name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `parent.Ext` | Object for all custom defined fields to live in. | None |
-| `parent.Ext.architecture` | Process architecture.  It can differ from host architecture. | x86_64 |
-| `parent.Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `parent.Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `parent.Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `parent.Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `parent.Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `parent.Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `parent.Ext.protection` | Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light. | None |
-| `parent.Ext.real` | The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent. | None |
-| `parent.Ext.real.pid` | For process.parent this will be the ppid of the process that actually spawned the current process. | None |
-| `parent.Ext.user` | User associated with the running process. | None |
-| `parent.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `parent.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `parent.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `parent.code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `parent.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `parent.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `parent.code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `parent.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `parent.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `parent.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `parent.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `parent.exit_code` | The exit code of the process, if this is a termination event.
-The field should be absent if there is no exit code for the event (e.g. process start). | 137 |
-| `parent.group.id` | Unique identifier for the group on the system/platform. | None |
-| `parent.group.name` | Name of the group. | None |
-| `parent.group_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `parent.group_leader.pid` | Process id. | 4242 |
-| `parent.group_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `parent.hash.md5` | MD5 hash. | None |
-| `parent.hash.sha1` | SHA1 hash. | None |
-| `parent.hash.sha256` | SHA256 hash. | None |
-| `parent.hash.sha512` | SHA512 hash. | None |
-| `parent.interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `parent.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `parent.pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `parent.pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `parent.pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `parent.pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `parent.pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `parent.pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `parent.pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
-Identifier of the group of processes the process belongs to. | None |
-| `parent.pid` | Process id. | 4242 |
-| `parent.ppid` | Parent process' pid. | 4241 |
-| `parent.real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `parent.real_group.name` | Name of the group. | None |
-| `parent.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `parent.real_user.name` | Short name or login of the user. | a.einstein |
-| `parent.saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `parent.saved_group.name` | Name of the group. | None |
-| `parent.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `parent.saved_user.name` | Short name or login of the user. | a.einstein |
-| `parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `parent.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `parent.supplemental_groups.name` | Name of the group. | None |
-| `parent.thread.Ext` | Object for all custom defined fields to live in. | None |
-| `parent.thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
-| `parent.thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
-| `parent.thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
-| `parent.thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
-| `parent.thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
-| `parent.thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
-| `parent.thread.Ext.call_stack_contains_unbacked` | Indicates whether the creating thread's stack contains frames pointing outside any known executable image. | None |
-| `parent.thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
-| `parent.thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
-| `parent.thread.id` | Thread ID. | 4242 |
-| `parent.thread.name` | Thread name. | thread-0 |
-| `parent.title` | Process title.
-The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
-| `parent.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `parent.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `parent.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `parent.uptime` | Seconds the process has been up. | 1325 |
-| `parent.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `parent.user.name` | Short name or login of the user. | a.einstein |
-| `parent.working_directory` | The working directory of the process. | /home/alice |
-| `pe.company` | Internal company name of the file, provided at compile-time. | Microsoft Corporation |
-| `pe.description` | Internal description of the file, provided at compile-time. | Paint |
-| `pe.file_version` | Internal version of the file, provided at compile-time. | 6.3.9600.17415 |
-| `pe.imphash` | A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.
-Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html. | 0c6803c4e922103c4dca5963aad36ddf |
-| `pe.original_file_name` | Internal name of the file, provided at compile-time. | MSPAINT.EXE |
-| `pe.product` | Internal product name of the file, provided at compile-time. | Microsoft® Windows® Operating System |
-| `pgid` | Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.
-Identifier of the group of processes the process belongs to. | None |
-| `pid` | Process id. | 4242 |
-| `ppid` | Parent process' pid. | 4241 |
-| `previous.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `previous.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `previous.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `real_group.name` | Name of the group. | None |
-| `real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `real_user.name` | Short name or login of the user. | a.einstein |
-| `saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `saved_group.name` | Name of the group. | None |
-| `saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `saved_user.name` | Short name or login of the user. | a.einstein |
-| `session_leader.args` | Array of process arguments, starting with the absolute path to the executable.
-May be filtered to protect sensitive information. | ["/usr/bin/ssh", "-l", "user", "10.0.0.16"] |
-| `session_leader.args_count` | Length of the process.args array.
-This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity. | 4 |
-| `session_leader.command_line` | Full command line that started the process, including the absolute path to the executable, and all arguments.
-Some arguments may be filtered to protect sensitive information. | /usr/bin/ssh -l user 10.0.0.16 |
-| `session_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `session_leader.executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `session_leader.group.id` | Unique identifier for the group on the system/platform. | None |
-| `session_leader.group.name` | Name of the group. | None |
-| `session_leader.interactive` | Whether the process is connected to an interactive shell.
-Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.
-Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY. | True |
-| `session_leader.name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `session_leader.parent.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `session_leader.parent.pid` | Process id. | 4242 |
-| `session_leader.parent.session_leader.entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `session_leader.parent.session_leader.pid` | Process id. | 4242 |
-| `session_leader.parent.session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `session_leader.parent.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `session_leader.pid` | Process id. | 4242 |
-| `session_leader.real_group.id` | Unique identifier for the group on the system/platform. | None |
-| `session_leader.real_group.name` | Name of the group. | None |
-| `session_leader.real_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `session_leader.real_user.name` | Short name or login of the user. | a.einstein |
-| `session_leader.same_as_process` | This boolean is used to identify if a leader process is the same as the top level process.
-For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.
-This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)
-Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`
-Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`. | True |
-| `session_leader.saved_group.id` | Unique identifier for the group on the system/platform. | None |
-| `session_leader.saved_group.name` | Name of the group. | None |
-| `session_leader.saved_user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `session_leader.saved_user.name` | Short name or login of the user. | a.einstein |
-| `session_leader.start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `session_leader.supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `session_leader.supplemental_groups.name` | Name of the group. | None |
-| `session_leader.tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `session_leader.tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `session_leader.tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `session_leader.user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `session_leader.user.name` | Short name or login of the user. | a.einstein |
-| `session_leader.working_directory` | The working directory of the process. | /home/alice |
-| `start` | The time the process started. | 2016-05-23T08:05:34.853Z |
-| `supplemental_groups.id` | Unique identifier for the group on the system/platform. | None |
-| `supplemental_groups.name` | Name of the group. | None |
-| `thread.capabilities.effective` | This is the set of capabilities used by the kernel to perform permission checks for the thread. | ["CAP_BPF", "CAP_SYS_ADMIN"] |
-| `thread.capabilities.permitted` | This is a limiting superset for the effective capabilities that the thread may assume. | ["CAP_BPF", "CAP_SYS_ADMIN"] |
-| `thread.id` | Thread ID. | 4242 |
-| `thread.name` | Thread name. | thread-0 |
-| `title` | Process title.
-The proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened. | None |
-| `tty` | Information about the controlling TTY device. If set, the process belongs to an interactive session. | None |
-| `tty.char_device.major` | The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation. | 4 |
-| `tty.char_device.minor` | The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them. | 1 |
-| `tty.columns` | The number of character columns per line. e.g terminal width
-Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output' | 80 |
-| `tty.rows` | The number of character rows in the terminal. e.g terminal height
-Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output' | 24 |
-| `uptime` | Seconds the process has been up. | 1325 |
-| `user.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `user.name` | Short name or login of the user. | a.einstein |
-| `working_directory` | The working directory of the process. | /home/alice |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `source`
-
-### Description
-Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user`
-
-### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | User info prior to any setuid operations. | None |
-| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
-| `Ext.real.name` | Short name or login of the user. | None |
-| `domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `email` | User email address. | None |
-| `full_name` | User's full name, if available. | Albert Einstein |
-| `group.Ext` | Object for all custom defined fields to live in. | None |
-| `group.Ext.real` | Group info prior to any setgid operations. | None |
-| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `group.Ext.real.name` | Name of the group. | None |
-| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `group.id` | Unique identifier for the group on the system/platform. | None |
-| `group.name` | Name of the group. | None |
-| `hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `name` | Short name or login of the user. | a.einstein |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/registry.md b/scripts/generate-docs/output/registry.md
deleted file mode 100644
index 46e88f1b7..000000000
--- a/scripts/generate-docs/output/registry.md
+++ /dev/null
@@ -1,401 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `Effective_process`
-
-### Description
-These fields contain information about an effective process.
-The effective process is the process that requested the a specific action, without directly performing it.
-Processes can have effective parents that differ from their regular parents. For example, on Windows, "wmic process call create notepad" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.
-Events can have effective processes that differ from their regular processes. For example, on Windows, "reg add \\localhost\HKLM\Software\Foo /v Data /t REG_SZ /d 123"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `entity_id` | Unique identifier for the effective process. | c2c455d9f99375d |
-| `executable` | Executable name for the effective process. | C:\Windows\System32\wbem\WMIC.exe |
-| `name` | Process name for the effective process. | WMIC.exe |
-| `pid` | Process ID. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `destination`
-
-### Description
-Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `group`
-
-### Description
-The group fields are meant to represent groups that are relevant to the event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | Group info prior to any setgid operations. | None |
-| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `Ext.real.name` | Name of the group. | None |
-| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `id` | Unique identifier for the group on the system/platform. | None |
-| `name` | Name of the group. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `process`
-
-### Description
-These fields contain information about a process.
-These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `pid` | Process id. | 4242 |
-| `thread.Ext` | Object for all custom defined fields to live in. | None |
-| `thread.Ext.call_stack` | Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame. | None |
-| `thread.Ext.call_stack.allocation_private_bytes` | The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing. | None |
-| `thread.Ext.call_stack.callsite_leading_bytes` | Hex opcode bytes preceding the callsite | None |
-| `thread.Ext.call_stack.callsite_trailing_bytes` | Hex opcode bytes after the callsite (where control will return to) | None |
-| `thread.Ext.call_stack.protection` | Protection of the page containing this instruction.  This is `R-X' by default if omitted. | None |
-| `thread.Ext.call_stack.symbol_info` | The nearest symbol for `instruction_pointer`. | None |
-| `thread.Ext.call_stack_summary` | Concatentation of the non-repeated modules in the call stack. | ntdll.dll|example.exe|kernel32.dll|ntdll.dll |
-| `thread.Ext.hardware_breakpoint_set` | Whether a hardware breakpoint was set for the thread. This field is omitted if false. | true |
-| `thread.id` | Thread ID. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `registry`
-
-### Description
-Fields related to Windows Registry operations.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `data.bytes` | Original bytes written with base64 encoding.
-For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values. | ZQBuAC0AVQBTAAAAZQBuAAAAAAA= |
-| `data.strings` | Content when writing string types.
-Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`). | ["C:\rta\red_ttp\bin\myapp.exe"] |
-| `data.type` | Standard registry type for encoding contents | REG_SZ |
-| `hive` | Abbreviated name for the hive. | HKLM |
-| `key` | Hive-relative path of keys. | SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe |
-| `path` | Full path, including hive, key and value | HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger |
-| `value` | Name of the value written. | Debugger |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `source`
-
-### Description
-Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user`
-
-### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | User info prior to any setuid operations. | None |
-| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
-| `Ext.real.name` | Short name or login of the user. | None |
-| `domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `email` | User email address. | None |
-| `full_name` | User's full name, if available. | Albert Einstein |
-| `group.Ext` | Object for all custom defined fields to live in. | None |
-| `group.Ext.real` | Group info prior to any setgid operations. | None |
-| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `group.Ext.real.name` | Name of the group. | None |
-| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `group.id` | Unique identifier for the group on the system/platform. | None |
-| `group.name` | Name of the group. | None |
-| `hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `name` | Short name or login of the user. | a.einstein |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/output/security.md b/scripts/generate-docs/output/security.md
deleted file mode 100644
index 064380e89..000000000
--- a/scripts/generate-docs/output/security.md
+++ /dev/null
@@ -1,411 +0,0 @@
-[Back to index](README.md)
-
-## `@timestamp`
-
-### Description
-Date/time when the event originated.
-This is the date/time extracted from the event, typically representing when the event was generated by the source.
-If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.
-Required field for all events.
-### Example
-
-```json
-"2016-05-23T08:05:34.853Z"
-```
-<hr>
-
-## `message`
-
-### Description
-For log events the message field contains the log message, optimized for viewing in a log viewer.
-For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.
-If multiple messages exist, they can be combined into one message.
-### Example
-
-```json
-"Hello World"
-```
-<hr>
-
-## `Target`
-
-### Description
-These fields contain information about a target.
-These fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `process.Ext` | Object for all custom defined fields to live in. | None |
-| `process.Ext.authentication_id` | Process authentication ID | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `agent`
-
-### Description
-The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.
-Examples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `id` | Unique identifier of this agent (if one exists).
-Example: For Beats this would be beat.id. | 8a4f500d |
-| `type` | Type of the agent.
-The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine. | filebeat |
-| `version` | Version of the agent. | 6.0.0-rc2 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `data_stream`
-
-### Description
-Fields describing the new indexing strategy <type>-<dataset>-<namespace>
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `dataset` | Data stream dataset name. | nginx.access |
-| `namespace` | Data stream namespace. | production |
-| `type` | Data stream type. | logs |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `destination`
-
-### Description
-Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Destination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `ecs`
-
-### Description
-Meta-information specific to ECS.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `version` | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.
-When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | 1.0.0 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `event`
-
-### Description
-The event fields are used for context information about the log or metric event itself.
-A log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `action` | The action captured by the event.
-This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | user-password-change |
-| `category` | This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.
-`event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.
-This field is an array. This will allow proper categorization of some events that fall in multiple categories. | authentication |
-| `code` | Identification code for this event, if one exists.
-Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID. | 4648 |
-| `created` | `event.created` contains the date/time when the event was first read by an agent, or by your pipeline.
-This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.
-In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.
-In case the two timestamps are identical, `@timestamp` should be used. | 2016-05-23T08:05:34.857Z |
-| `dataset` | Name of the dataset.
-If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.
-It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name. | apache.access |
-| `hash` | Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity. | 123456789012345678901234567890ABCD |
-| `id` | Unique ID to describe the event. | 8a4f500d |
-| `ingested` | Timestamp when an event arrived in the central data store.
-This is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.
-In normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`. | 2016-05-23T08:05:35.101Z |
-| `kind` | This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.
-`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.
-The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not. | alert |
-| `module` | Name of the module this data is coming from.
-If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module. | apache |
-| `outcome` | This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.
-`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.
-Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.
-Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.
-Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense. | success |
-| `provider` | Source of the event.
-Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing). | kernel |
-| `sequence` | Sequence number of the event.
-The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision. | None |
-| `severity` | The numeric severity of the event according to your event source.
-What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.
-The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`. | 7 |
-| `type` | This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.
-`event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.
-This field is an array. This will allow proper categorization of some events that fall in multiple event types. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `file`
-
-### Description
-A file is defined as a set of information that has been created on, or has existed on a filesystem.
-File objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `path` | Full path to the file, including the file name. It should include the drive letter, when appropriate. | /home/alice/example.png |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `group`
-
-### Description
-The group fields are meant to represent groups that are relevant to the event.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | Group info prior to any setgid operations. | None |
-| `Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `Ext.real.name` | Name of the group. | None |
-| `domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `id` | Unique identifier for the group on the system/platform. | None |
-| `name` | Name of the group. | None |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `host`
-
-### Description
-A host is defined as a general computing instance.
-ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `architecture` | Operating system architecture. | x86_64 |
-| `domain` | Name of the domain of which the host is a member.
-For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | CONTOSO |
-| `hostname` | Hostname of the host.
-It normally contains what the `hostname` command returns on the host machine. | None |
-| `id` | Unique host id.
-As hostname is not always unique, use values that are meaningful in your environment.
-Example: The current usage of `beat.name`. | None |
-| `ip` | Host ip addresses. | None |
-| `mac` | Host MAC addresses.
-The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen. | ["00-00-5E-00-53-23", "00-00-5E-00-53-24"] |
-| `name` | Name of the host.
-It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host. | None |
-| `os.Ext` | Object for all custom defined fields to live in. | None |
-| `os.Ext.variant` | A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field. | Ubuntu |
-| `os.family` | OS family (such as redhat, debian, freebsd, windows). | debian |
-| `os.full` | Operating system name, including the version or code name. | Mac OS Mojave |
-| `os.kernel` | Operating system kernel version as a raw string. | 4.4.0-112-generic |
-| `os.name` | Operating system name, without the version. | Mac OS X |
-| `os.platform` | Operating system platform (such centos, ubuntu, windows). | darwin |
-| `os.type` | Use the `os.type` field to categorize the operating system into one of the broad commercial families.
-If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition. | macos |
-| `os.version` | Operating system version as a raw string. | 10.14.1 |
-| `type` | Type of host.
-For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | None |
-| `uptime` | Seconds the host has been up. | 1325 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `process`
-
-### Description
-These fields contain information about a process.
-These fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.ancestry` | An array of entity_ids indicating the ancestors for this event | None |
-| `Ext.authentication_id` | Process authentication ID | None |
-| `Ext.code_signature` | Nested version of ECS code_signature fieldset. | None |
-| `Ext.code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `Ext.code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `Ext.code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `Ext.code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `Ext.code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `code_signature.exists` | Boolean to capture if a signature is present. | true |
-| `code_signature.signing_id` | The identifier used to sign the process.
-This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only. | com.apple.xpc.proxy |
-| `code_signature.status` | Additional information about the certificate status.
-This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked. | ERROR_UNTRUSTED_ROOT |
-| `code_signature.subject_name` | Subject name of the code signer | Microsoft Corporation |
-| `code_signature.team_id` | The team identifier used to sign the process.
-This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only. | EQHXZ8M8AV |
-| `code_signature.trusted` | Stores the trust status of the certificate chain.
-Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status. | true |
-| `code_signature.valid` | Boolean to capture if the digital signature is verified against the binary content.
-Leave unpopulated if a certificate was unchecked. | true |
-| `entity_id` | Unique identifier for the process.
-The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.
-Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts. | c2c455d9f99375d |
-| `executable` | Absolute path to the process executable. | /usr/bin/ssh |
-| `name` | Process name.
-Sometimes called program name or similar. | ssh |
-| `pid` | Process id. | 4242 |
-| `thread.id` | Thread ID. | 4242 |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `source`
-
-### Description
-Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.
-Source fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `geo.city_name` | City name. | Montreal |
-| `geo.continent_code` | Two-letter code representing continent's name. | NA |
-| `geo.continent_name` | Name of the continent. | North America |
-| `geo.country_iso_code` | Country ISO code. | CA |
-| `geo.country_name` | Country name. | Canada |
-| `geo.location` | Longitude and latitude. | { "lon": -73.614830, "lat": 45.505918 } |
-| `geo.name` | User-defined description of a location, at the level of granularity they care about.
-Could be the name of their data centers, the floor number, if this describes a local physical entity, city names.
-Not typically used in automated geolocation. | boston-dc |
-| `geo.postal_code` | Postal code associated with the location.
-Values appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country. | 94040 |
-| `geo.region_iso_code` | Region ISO code. | CA-QC |
-| `geo.region_name` | Region name. | Quebec |
-| `geo.timezone` | The time zone of the location, such as IANA time zone name. | America/Argentina/Buenos_Aires |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `user`
-
-### Description
-The user fields describe information about the user that is relevant to the event.
-Fields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `Ext` | Object for all custom defined fields to live in. | None |
-| `Ext.real` | User info prior to any setuid operations. | None |
-| `Ext.real.id` | One or multiple unique identifiers of the user. | None |
-| `Ext.real.name` | Short name or login of the user. | None |
-| `domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `effective.domain` | Name of the directory the user is a member of.
-For example, an LDAP or Active Directory domain name. | None |
-| `effective.email` | User email address. | None |
-| `effective.full_name` | User's full name, if available. | Albert Einstein |
-| `effective.hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `effective.id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `effective.name` | Short name or login of the user. | a.einstein |
-| `email` | User email address. | None |
-| `full_name` | User's full name, if available. | Albert Einstein |
-| `group.Ext` | Object for all custom defined fields to live in. | None |
-| `group.Ext.real` | Group info prior to any setgid operations. | None |
-| `group.Ext.real.id` | Unique identifier for the group on the system/platform. | None |
-| `group.Ext.real.name` | Name of the group. | None |
-| `group.domain` | Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name. | None |
-| `group.id` | Unique identifier for the group on the system/platform. | None |
-| `group.name` | Name of the group. | None |
-| `hash` | Unique user hash to correlate information for a user in anonymized form.
-Useful if `user.id` or `user.name` contain confidential information and cannot be used. | None |
-| `id` | Unique identifier of the user. | S-1-5-21-202424912787-2692429404-2351956786-1000 |
-| `name` | Short name or login of the user. | a.einstein |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
-## `winlog`
-
-### Description
-These fields provide detailed information regarding events logged in the Windows Event Log. The Windows Event Log is a centralized system used by Windows to record events related to system, application, and security activities. Each event log entry is categorized by a specific event type, and contains relevant metadata that can include the event source, event ID, timestamp, user details, and other associated data.
-### Sub-fields
-| Field | Description | Example |
-| --- | --- | --- |
-| `event_data` | The event-specific data. This is a non-exhaustive list of parameters that are used in Windows events. | None |
-| `event_data.PrivilegeList` | An array of sensitive privileges, assigned to the new logon. | SeTcbPrivilege, SeSecurityPrivilege |
-### Example
-
-```json
-Needs example
-
-```
-<hr>
-
diff --git a/scripts/generate-docs/pydocgen/__main__.py b/scripts/generate-docs/pydocgen/__main__.py
index e572487c9..d37ed890a 100644
--- a/scripts/generate-docs/pydocgen/__main__.py
+++ b/scripts/generate-docs/pydocgen/__main__.py
@@ -1,119 +1,106 @@
 import argparse
+import logging
+from logging import config
 import pathlib
 import traceback
 import sys
 import tempfile
-from unittest import result
 
-from .models.packages import PackageList
-from .models.custom_documentation import CustomDocList
-from .markdown import generate_package_list_markdown
-from sqlmodel import SQLModel, Field, create_engine, Session, select
-from sqlalchemy import Engine
+from .markdown import generate_custom_documentation_markdown
 
+from typing import Literal
 
-from typing import Optional
 
-def resolve_packages_dir() -> pathlib.Path:
-    """
-    resolve_packages_dir returns the directory where the packages are stored relative to this file
-    """
-    this_file = pathlib.Path(__file__).resolve()
-    root_dir = this_file.parents[3]
-    return root_dir / "package" / "endpoint" / "data_stream"
+def configure_logging(
+    log_level: Literal["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"], 
+    verbose: bool
+) -> None:
+    """Configures the logging system with specified level and verbosity.
 
-def resolve_custom_documentation_dir() -> pathlib.Path:
-    """
-    resolve_custom_documentation_dir returns the directory where the custom documentation is stored relative to this file
+    Args:
+        log_level: String representation of logging level (DEBUG, INFO, etc.)
+        verbose: Boolean flag to force maximum verbosity
     """
-    this_file = pathlib.Path(__file__).resolve()
-    root_dir = this_file.parents[3]
-    return root_dir / "custom_documentation" / "src" / "endpoint" / "data_stream"
+    level = getattr(logging, log_level)
+
+    # If verbose is specified, override to DEBUG level
+    if verbose:
+        level = logging.DEBUG
+
+    # Basic config with both handlers
+    logging.basicConfig(
+        level=level,
+        format="%(asctime)s - %(levelname)-8s %(message)s",
+        datefmt="%Y-%m-%d %H:%M:%S",
+    )
+
 
 def main():
-    parser = argparse.ArgumentParser(description="Dump packages as JSON")
+    parser = argparse.ArgumentParser(
+        description="Create markdown documentation for the fields defined in custom_documentation",
+        epilog="Example usage: python -m pydocgen --output-dir /path/to/output",
+    )
+
     parser.add_argument(
-        "--packages-dir",
-        default=resolve_packages_dir(),
+        "--database",
+        default=pathlib.Path(tempfile.gettempdir()) / "generate-docs.sqlite",
         type=pathlib.Path,
-        help="directory holding the packages",
+        help="path to the database",
+    )
+
+    parser.add_argument(
+        "--no-cache",
+        action="store_true",
+        help="do not use cached database if it exists, always regenerate the database",
     )
+
     parser.add_argument(
-        "--output",
-        default=pathlib.Path().resolve() / "output",
+        "--output-dir",
+        default=pathlib.Path.cwd().resolve() / "output",
         type=pathlib.Path,
-        help="output directory",
+        help="output directory for markdown documentation",
+    )
+    parser.add_argument(
+        "-v",
+        "--verbose",
+        action="store_true",
+        help="Force maximum verbosity (DEBUG level + detailed output)",
+    )
+
+    parser.add_argument(
+        "-l",
+        "--log-level",
+        type=str.upper,
+        choices=["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"],
+        default="INFO",
+        help="Set logging verbosity level",
     )
+
     args = parser.parse_args()
 
-    # #
-    # # Validate the output directory
-    # #
-    # if args.output.exists():
-    #     raise FileExistsError(
-    #         f"output directory {args.output} already exists, please remove it or specify a different directory"
-    #     )
-    # args.output.mkdir(parents=True)
-
-    #
-    # Create the PackageList object and dump it to a file
-    #
-    # package_list = PackageList.from_packages_dir(args.packages_dir)
-
-    def createDatabase(db_path: pathlib.Path) -> Engine:
-
-        if db_path.exists():
-            print(f"{db_path} already exists, skipping database creation")
-            return create_engine(f"sqlite:///{db_path}")
-
-        def add_to_db(field: DocumentField, session: Session):
-            existing_field = session.exec(
-                select(DocumentField).where(DocumentField.name == field.name)
-            ).first()
-            if existing_field:
-                if existing_field.description != field.description:
-                    raise ValueError(
-                        f"Field {field.name} already exists with different description"
-                    )
-            else:
-                session.add(field)
-
-        print(f"{db_path} does not exist, creating database")
-        engine = create_engine(f"sqlite:///{db_path}")
-        SQLModel.metadata.create_all(engine)
-        package_list = PackageList.from_packages_dir(args.packages_dir)
-        with Session(engine) as session:
-            for package in package_list:
-                for field in package.fields:
-                    if field.fields:
-                        for sub_field in field.fields:
-                            name = f"{field.name}.{sub_field.name}"
-                            add_to_db(DocumentField(name=name, description=sub_field.description), session)
-                    else:
-                        add_to_db(DocumentField(name=field.name, description=field.description), session)
-            session.commit()
-        return engine
-
-    class DocumentField(SQLModel, table=True):
-        id: Optional[int] = Field(default=None, primary_key=True)
-        name: str = Field(sa_column_kwargs={"unique": True})
-        description: str
-
-    db_path = pathlib.Path(tempfile.gettempdir()) / "generate-docs.db"
-    engine = createDatabase(db_path)
-
-    custom_docs = CustomDocList.from_yaml(resolve_custom_documentation_dir())
-
-    not_found_fields = []
-    with Session(engine) as session:
-        for custom_doc in custom_docs:
-            for field in custom_doc.fields.endpoint:
-                statement = select(DocumentField).where(DocumentField.name == field)
-                result = session.exec(statement).first()
-                if not result:
-                    print(f"name: {field}, description: <Description Not Found>")
-                else:
-                    print(f"name: {result.name}, description: {result.description}")
+    configure_logging(args.log_level, args.verbose)
+
+    if args.no_cache and args.database.exists():
+        logging.info(f"Removing existing database {args.database} since --no-cache was specified")
+        args.database.unlink()
+
+    generate_custom_documentation_markdown(args.database, args.output_dir)
+    logging.info(f"Generated markdown documentation to {args.output_dir}")
+
+# #
+# # Validate the output directory
+# #
+# if args.output.exists():
+#     raise FileExistsError(
+#         f"output directory {args.output} already exists, please remove it or specify a different directory"
+#     )
+# args.output.mkdir(parents=True)
+
+#
+# Create the PackageList object and dump it to a file
+#
+# package_list = PackageList.from_packages_dir(args.packages_dir)
+
 
 if __name__ == "__main__":
     try:
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index 8519048fc..7daeaddf7 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -1,89 +1,179 @@
+import logging
 import pathlib
-from .models import Package, PackageList
-import json
+from .models import Package, PackageList, CustomDocumentationList, Filter
+from .database import getDatabase, PackageField
 
-def ensure_valid_output_directory(output_directory: pathlib.Path):
-    """
-    Ensure that the output directory is valid
-    """
-    if not output_directory.exists():
-        output_directory.mkdir(parents=True)
-    if not output_directory.is_dir():
-        raise FileExistsError(f"output_directory {output_directory} is not a directory")
+from sqlmodel import SQLModel, Field, create_engine, Session, select, Relationship
+from sqlalchemy import Engine, Column, JSON
 
-def generate_package_markdown(package: Package):
-    """
-    Generate markdown for a package
+from typing import List
 
-    Args:
-        package: the package to generate markdown for
+# def ensure_valid_output_directory(output_directory: pathlib.Path):
+#     """
+#     Ensure that the output directory is valid
+#     """
+#     if not output_directory.exists():
+#         output_directory.mkdir(parents=True)
+#     if not output_directory.is_dir():
+#         raise FileExistsError(f"output_directory {output_directory} is not a directory")
 
-    Returns:
-        markdown string
-    """
-    markdown = f"[Back to index](README.md)\n\n"
-    for field in package.fields:
-        markdown += f"## `{field.name}`\n\n"
-        markdown += f"### Description\n"
-        markdown += f"{field.description}\n"
-        if field.fields:
-            markdown += f"### Sub-fields\n"
-            markdown += "| Field | Description | Example |\n"
-            markdown += "| --- | --- | --- |\n"
-            for sub_field in field.fields:
-                markdown += f"| `{sub_field.name}` | {sub_field.description} | {sub_field.example} |\n"
-        markdown += f"### Example\n\n"
-        markdown += f"```json\n"
-        if not field.example:
-            markdown += "Needs example\n"
-        else:
-            markdown += json.dumps(field.example, indent=4)
-        markdown += "\n```\n<hr>\n\n"
-    return markdown
-
-def generate_readme_markdown(package_list: PackageList, output_directory: pathlib.Path):
-    """
-    Generates the top level readme markdown file
-    """
-    ensure_valid_output_directory(output_directory)
-    readme_path = output_directory / "README.md"
-
-    #
-    # This file will list each package, its top level fields, and a link to the package's markdown file
-    # if the package has a sample event, it will be included in a details tag
-    #
-    with readme_path.open("w") as f:
-        for package in package_list.packages:
-            f.write(f"# {package.name}\n")
-            if package.sample_event:
-                f.write("### Sample Event\n")
-                f.write("<details>\n")
-                f.write("<summary>\nClick to expand\n</summary>\n\n")
-                f.write("```json\n")
-                f.write(json.dumps(package.sample_event, indent=4))
-                f.write("\n```\n")
-                f.write("</details>\n\n")
-            f.write(f"### [Fields]({package.name}.md)\n")
-            for field in package.fields:
-                f.write(f"- [{field.name}]({package.name}.md#{field.name})\n")
-
-def generate_package_list_markdown(package_list: PackageList, output_directory: pathlib.Path) -> None:
+# def generate_package_markdown(package: Package):
+#     """
+#     Generate markdown for a package
+
+#     Args:
+#         package: the package to generate markdown for
+
+#     Returns:
+#         markdown string
+#     """
+#     markdown = f"[Back to index](README.md)\n\n"
+#     for field in package.fields:
+#         markdown += f"## `{field.name}`\n\n"
+#         markdown += f"### Description\n"
+#         markdown += f"{field.description}\n"
+#         if field.fields:
+#             markdown += f"### Sub-fields\n"
+#             markdown += "| Field | Description | Example |\n"
+#             markdown += "| --- | --- | --- |\n"
+#             for sub_field in field.fields:
+#                 markdown += f"| `{sub_field.name}` | {sub_field.description} | {sub_field.example} |\n"
+#         markdown += f"### Example\n\n"
+#         markdown += f"```json\n"
+#         if not field.example:
+#             markdown += "Needs example\n"
+#         else:
+#             markdown += json.dumps(field.example, indent=4)
+#         markdown += "\n```\n<hr>\n\n"
+#     return markdown
+
+# def generate_readme_markdown(package_list: PackageList, output_directory: pathlib.Path):
+#     """
+#     Generates the top level readme markdown file
+#     """
+#     ensure_valid_output_directory(output_directory)
+#     readme_path = output_directory / "README.md"
+
+#     #
+#     # This file will list each package, its top level fields, and a link to the package's markdown file
+#     # if the package has a sample event, it will be included in a details tag
+#     #
+#     with readme_path.open("w") as f:
+#         for package in package_list.packages:
+#             f.write(f"# {package.name}\n")
+#             if package.sample_event:
+#                 f.write("### Sample Event\n")
+#                 f.write("<details>\n")
+#                 f.write("<summary>\nClick to expand\n</summary>\n\n")
+#                 f.write("```json\n")
+#                 f.write(json.dumps(package.sample_event, indent=4))
+#                 f.write("\n```\n")
+#                 f.write("</details>\n\n")
+#             f.write(f"### [Fields]({package.name}.md)\n")
+#             for field in package.fields:
+#                 f.write(f"- [{field.name}]({package.name}.md#{field.name})\n")
+
+# def generate_package_list_markdown(package_list: PackageList, output_directory: pathlib.Path) -> None:
+#     """
+#     Generate markdown files for a list of packages
+#     """
+#     ensure_valid_output_directory(output_directory)
+
+#     #
+#     # Create a top level Readme.md file
+#     #
+#     generate_readme_markdown(package_list, output_directory)
+
+#     #
+#     # Walk the list of packages and create a markdown file for each
+#     #
+#     for package in package_list.packages:
+#         path = output_directory / f"{package.name}.md"
+#         with path.open("w") as f:
+#             f.write(generate_package_markdown(package))
+
+#     return f"Generated {len(package_list.packages)} packages to {output_directory}"
+
+
+def generate_custom_documentation_markdown(db_path: pathlib.Path, output_dir: pathlib.Path):
     """
-    Generate markdown files for a list of packages
+    Generate markdown files for custom documentation
     """
-    ensure_valid_output_directory(output_directory)
-
-    #
-    # Create a top level Readme.md file
-    #
-    generate_readme_markdown(package_list, output_directory)
-
-    #
-    # Walk the list of packages and create a markdown file for each
-    #
-    for package in package_list.packages:
-        path = output_directory / f"{package.name}.md"
-        with path.open("w") as f:
-            f.write(generate_package_markdown(package))
-
-    return f"Generated {len(package_list.packages)} packages to {output_directory}"
+
+    def get_output_filename(src_path: pathlib.Path) -> pathlib.Path:
+        parts = src_path.parts
+        index = parts.index("data_stream")
+        output_filename = output_dir
+        for part in parts[index + 1 : -1]:
+            output_filename = output_filename / part
+        return output_filename / parts[-1].replace(".yaml", ".md")
+
+    def get_formatted_os_name(os: str) -> str:
+        if os == "windows":
+            return "Windows"
+        if os == "linux":
+            return "Linux"
+        if os == "macos":
+            return "macOS"
+        return os
+
+    def get_formatted_os_string(os_list: List[str]) -> str:
+        return ", ".join(get_formatted_os_name(os) for os in os_list)
+
+    def get_kql_query_string(filter: Filter) -> str:
+        queries = []
+        for field, metadata in Filter.model_fields.items():
+            field_name = metadata.alias if metadata.alias else field
+            if field in filter.dict():
+                field_value = filter.dict()[field]
+                if not field_value:
+                    continue
+                if isinstance(field_value, list):
+                    if len(field_value) == 1:
+                        field_value = f"{field_value[0]}"
+                    else:
+                        field_value = '" or "'.join(field_value)
+                queries.append(f"{field_name} : \"{field_value}\"")
+        return " and ".join(queries)
+
+    engine = getDatabase(db_path)
+    custom_docs = CustomDocumentationList.from_files()
+    with Session(engine) as session:
+        for custom_doc in custom_docs:
+            output_filename = get_output_filename(custom_doc.filepath)
+            output_filename.parent.mkdir(parents=True, exist_ok=True)
+            with output_filename.open("w") as f:
+                f.write(f"# {custom_doc.overview.name}\n\n")
+
+                f.write(f"## Description\n\n")
+                f.write(f"{custom_doc.overview.description}\n\n")
+
+                f.write("## Overview\n\n")
+                f.write("<table>\n")
+                f.write("<tr>\n")
+                f.write("<td><strong>OS</strong></td>\n")
+                f.write(f"<td>{get_formatted_os_string(custom_doc.identification.os)}</td>\n")
+                f.write("</tr>\n")
+                f.write("<tr>\n")
+                f.write(f"<td><strong>Data Stream</strong></td>\n")
+                f.write(f"<td>{custom_doc.identification.data_stream}</td>\n")
+                f.write("</tr>\n")
+                f.write("<tr>\n")
+                f.write(f"<td><strong>KQL Query</strong></td>\n")
+                f.write(f"<td><code>{get_kql_query_string(custom_doc.identification.filter)}</code></td>\n")
+                f.write("</tr>\n")
+                f.write("</table>\n\n")
+
+                f.write(f"## Fields\n\n")
+                f.write("<table>\n")
+                #f.write("<tr><th>Field</th><th>Description</th></tr>\n")
+                for field in custom_doc.fields.endpoint:
+                    package_field = session.exec(select(PackageField).where(PackageField.name == field)).first()
+
+                    description = None
+                    if package_field:
+                        description = package_field.description.replace("\n", "  ").replace("\r", "  ")
+                    f.write(f"<tr><td><code>{field}<code></td><td>{description if description else 'No description found'}</td></tr>\n")
+                f.write("</table>\n")
+
+            logging.debug(f"wrote markdown to {output_filename}")
diff --git a/scripts/generate-docs/sample_output/alerts/linux/linux_malicious_behavior_alert.md b/scripts/generate-docs/sample_output/alerts/linux/linux_malicious_behavior_alert.md
new file mode 100644
index 000000000..3517e2d22
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/linux/linux_malicious_behavior_alert.md
@@ -0,0 +1,133 @@
+# Linux Malicious Behavior Alert
+
+## Description
+
+This alert is generated when a Malicious Behavior alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "behavior"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Events.*<code></td><td>No description found</td></tr>
+<tr><td><code>Events._label<code></td><td>No description found</td></tr>
+<tr><td><code>Events._state<code></td><td>No description found</td></tr>
+<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
+<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
+<tr><td><code>Responses.action.field<code></td><td>Field in the triggering event to use as input for action</td></tr>
+<tr><td><code>Responses.action.state<code></td><td>Index of event in events array to use for field lookup</td></tr>
+<tr><td><code>Responses.action.tree<code></td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
+<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
+<tr><td><code>Responses.process.entity_id<code></td><td>Entity id of actionable process</td></tr>
+<tr><td><code>Responses.process.name<code></td><td>Name of actionable process</td></tr>
+<tr><td><code>Responses.process.pid<code></td><td>pid of actionable process</td></tr>
+<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.*<code></td><td>No description found</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.*<code></td><td>No description found</td></tr>
+<tr><td><code>rule.description<code></td><td>The description of the rule generating the event.</td></tr>
+<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td><code>rule.reference<code></td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>rule.version<code></td><td>The version / revision of the rule being used for analysis.</td></tr>
+<tr><td><code>threat.framework<code></td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
+<tr><td><code>threat.tactic.id<code></td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td><code>threat.tactic.name<code></td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
+<tr><td><code>threat.tactic.reference<code></td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td><code>threat.technique.id<code></td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td><code>threat.technique.name<code></td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td><code>threat.technique.reference<code></td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td><code>threat.technique.subtechnique<code></td><td>No description found</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/linux/linux_malware_alert.md b/scripts/generate-docs/sample_output/alerts/linux/linux_malware_alert.md
new file mode 100644
index 000000000..4ebab56c5
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/linux/linux_malware_alert.md
@@ -0,0 +1,244 @@
+# Linux Malware Alert
+
+## Description
+
+This alert is generated when a Malware alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "malicious_file"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.malware_classification.identifier<code></td><td>The model's unique identifier.</td></tr>
+<tr><td><code>file.Ext.malware_classification.score<code></td><td>The score produced by the classification model.</td></tr>
+<tr><td><code>file.Ext.malware_classification.threshold<code></td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
+<tr><td><code>file.Ext.malware_classification.version<code></td><td>The version of the model used.</td></tr>
+<tr><td><code>file.Ext.malware_signature.all_names<code></td><td>The concatenated names of all yara signatures</td></tr>
+<tr><td><code>file.Ext.malware_signature.identifier<code></td><td>Malware artifact identifier.</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.matches<code></td><td>An array of bytes representing yara signature matches</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.signature.hash.sha256<code></td><td>Primary malware signature sha256.</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.signature.id<code></td><td>Primary malware signature id.</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.signature.name<code></td><td>Primary malware signature name.</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.matches<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.signature.hash.sha256<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.signature.id<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.signature.name<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.version<code></td><td>Primary malware signature version.</td></tr>
+<tr><td><code>file.Ext.quarantine_message<code></td><td>Message describing quarantine results.</td></tr>
+<tr><td><code>file.Ext.quarantine_path<code></td><td>Path on endpoint the quarantined file was originally.</td></tr>
+<tr><td><code>file.Ext.quarantine_result<code></td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
+<tr><td><code>file.Ext.temp_file_path<code></td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
+<tr><td><code>file.accessed<code></td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
+<tr><td><code>file.created<code></td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
+<tr><td><code>file.directory<code></td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td><code>file.mtime<code></td><td>Last time the file content was modified.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.owner<code></td><td>File owner's username.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/linux/linux_memory_threat_alert.md b/scripts/generate-docs/sample_output/alerts/linux/linux_memory_threat_alert.md
new file mode 100644
index 000000000..8ef84a28f
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/linux/linux_memory_threat_alert.md
@@ -0,0 +1,218 @@
+# Linux Memory Threat Alert
+
+## Description
+
+This alert is generated when a Memory Threat alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "memory_signature"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_base<code></td><td>Base address of the memory allocation containing the memory region.</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_size<code></td><td>Original memory size requested when the memory was allocated.</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_type<code></td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_address<code></td><td>The address where bytes_compressed begins.</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_allocation_offset<code></td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_compressed<code></td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_compressed_present<code></td><td>Whether bytes_compressed is present in this event.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.all_names<code></td><td>A sequence of signature names matched.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.identifier<code></td><td>malware signature identifier</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.matches<code></td><td>The first matching details.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256<code></td><td>sha256 hash of file matching signature.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.id<code></td><td>The id of the first yara rule matched.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.name<code></td><td>The name of the first yara rule matched.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.version<code></td><td>malware signature version</td></tr>
+<tr><td><code>process.Ext.memory_region.region_base<code></td><td>Base address of the memory region.</td></tr>
+<tr><td><code>process.Ext.memory_region.region_protection<code></td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
+<tr><td><code>process.Ext.memory_region.region_size<code></td><td>Size of the memory region.</td></tr>
+<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/macos/macos_malicious_behavior_alert.md b/scripts/generate-docs/sample_output/alerts/macos/macos_malicious_behavior_alert.md
new file mode 100644
index 000000000..c27390fbb
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/macos/macos_malicious_behavior_alert.md
@@ -0,0 +1,120 @@
+# macOS Malicious Behavior Alert
+
+## Description
+
+This alert is generated when a Malicious Behavior alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "behavior"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Events.*<code></td><td>No description found</td></tr>
+<tr><td><code>Events._label<code></td><td>No description found</td></tr>
+<tr><td><code>Events._state<code></td><td>No description found</td></tr>
+<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
+<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
+<tr><td><code>Responses.action.field<code></td><td>Field in the triggering event to use as input for action</td></tr>
+<tr><td><code>Responses.action.state<code></td><td>Index of event in events array to use for field lookup</td></tr>
+<tr><td><code>Responses.action.tree<code></td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
+<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
+<tr><td><code>Responses.process.entity_id<code></td><td>Entity id of actionable process</td></tr>
+<tr><td><code>Responses.process.name<code></td><td>Name of actionable process</td></tr>
+<tr><td><code>Responses.process.pid<code></td><td>pid of actionable process</td></tr>
+<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.*<code></td><td>No description found</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.*<code></td><td>No description found</td></tr>
+<tr><td><code>rule.description<code></td><td>The description of the rule generating the event.</td></tr>
+<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td><code>rule.reference<code></td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>rule.version<code></td><td>The version / revision of the rule being used for analysis.</td></tr>
+<tr><td><code>threat.framework<code></td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
+<tr><td><code>threat.tactic.id<code></td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td><code>threat.tactic.name<code></td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
+<tr><td><code>threat.tactic.reference<code></td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td><code>threat.technique.id<code></td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td><code>threat.technique.name<code></td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td><code>threat.technique.reference<code></td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td><code>threat.technique.subtechnique<code></td><td>No description found</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/macos/macos_malware_alert.md b/scripts/generate-docs/sample_output/alerts/macos/macos_malware_alert.md
new file mode 100644
index 000000000..bb4a498cf
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/macos/macos_malware_alert.md
@@ -0,0 +1,162 @@
+# macOS Malware Alert
+
+## Description
+
+This alert is generated when a macOS Malware alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "malicious_file"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.malware_classification.identifier<code></td><td>The model's unique identifier.</td></tr>
+<tr><td><code>file.Ext.malware_classification.score<code></td><td>The score produced by the classification model.</td></tr>
+<tr><td><code>file.Ext.malware_classification.threshold<code></td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
+<tr><td><code>file.Ext.malware_classification.version<code></td><td>The version of the model used.</td></tr>
+<tr><td><code>file.Ext.malware_signature.all_names<code></td><td>The concatenated names of all yara signatures</td></tr>
+<tr><td><code>file.Ext.malware_signature.identifier<code></td><td>Malware artifact identifier.</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.matches<code></td><td>An array of bytes representing yara signature matches</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.signature.hash.sha256<code></td><td>Primary malware signature sha256.</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.signature.id<code></td><td>Primary malware signature id.</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.signature.name<code></td><td>Primary malware signature name.</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.matches<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.signature.hash.sha256<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.signature.id<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.signature.name<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.version<code></td><td>Primary malware signature version.</td></tr>
+<tr><td><code>file.Ext.quarantine_message<code></td><td>Message describing quarantine results.</td></tr>
+<tr><td><code>file.Ext.quarantine_path<code></td><td>Path on endpoint the quarantined file was originally.</td></tr>
+<tr><td><code>file.Ext.quarantine_result<code></td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
+<tr><td><code>file.Ext.temp_file_path<code></td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
+<tr><td><code>file.accessed<code></td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
+<tr><td><code>file.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>file.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>file.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>file.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>file.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>file.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>file.created<code></td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
+<tr><td><code>file.directory<code></td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.mtime<code></td><td>Last time the file content was modified.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.owner<code></td><td>File owner's username.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/macos/macos_memory_threat_alert.md b/scripts/generate-docs/sample_output/alerts/macos/macos_memory_threat_alert.md
new file mode 100644
index 000000000..c15a31dd5
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/macos/macos_memory_threat_alert.md
@@ -0,0 +1,142 @@
+# macOS Memory Threat Alert
+
+## Description
+
+This alert is generated when a macOS Memory Thread alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "memory_signature"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_base<code></td><td>Base address of the memory allocation containing the memory region.</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_size<code></td><td>Original memory size requested when the memory was allocated.</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_type<code></td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_address<code></td><td>The address where bytes_compressed begins.</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_allocation_offset<code></td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_compressed<code></td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_compressed_present<code></td><td>Whether bytes_compressed is present in this event.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.all_names<code></td><td>A sequence of signature names matched.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.identifier<code></td><td>malware signature identifier</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.matches<code></td><td>The first matching details.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256<code></td><td>sha256 hash of file matching signature.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.id<code></td><td>The id of the first yara rule matched.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.name<code></td><td>The name of the first yara rule matched.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.version<code></td><td>malware signature version</td></tr>
+<tr><td><code>process.Ext.memory_region.region_base<code></td><td>Base address of the memory region.</td></tr>
+<tr><td><code>process.Ext.memory_region.region_protection<code></td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
+<tr><td><code>process.Ext.memory_region.region_size<code></td><td>Size of the memory region.</td></tr>
+<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_malicious_behavior_alert.md b/scripts/generate-docs/sample_output/alerts/windows/windows_malicious_behavior_alert.md
new file mode 100644
index 000000000..05b1ac596
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/windows/windows_malicious_behavior_alert.md
@@ -0,0 +1,129 @@
+# Windows Malicious Behavior Alert
+
+## Description
+
+This alert occurs when a Malicious Behavior alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "behavior"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Events.*<code></td><td>No description found</td></tr>
+<tr><td><code>Events._label<code></td><td>No description found</td></tr>
+<tr><td><code>Events._state<code></td><td>No description found</td></tr>
+<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
+<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
+<tr><td><code>Responses.action.field<code></td><td>Field in the triggering event to use as input for action</td></tr>
+<tr><td><code>Responses.action.file.attributes<code></td><td>Destination file attributes</td></tr>
+<tr><td><code>Responses.action.file.path<code></td><td>Destination file path</td></tr>
+<tr><td><code>Responses.action.file.reason<code></td><td>Combined USN file modification reason</td></tr>
+<tr><td><code>Responses.action.key.actions<code></td><td>Actions taken by Registry Rollback for key</td></tr>
+<tr><td><code>Responses.action.key.path<code></td><td>NT path of registry key recovered by Rollback</td></tr>
+<tr><td><code>Responses.action.key.values.actions<code></td><td>Actions taken by Registry Rollback for value</td></tr>
+<tr><td><code>Responses.action.key.values.name<code></td><td>Value name recovered by Rollback</td></tr>
+<tr><td><code>Responses.action.source.attributes<code></td><td>Source file attributes</td></tr>
+<tr><td><code>Responses.action.source.path<code></td><td>Source file path</td></tr>
+<tr><td><code>Responses.action.state<code></td><td>Index of event in events array to use for field lookup</td></tr>
+<tr><td><code>Responses.action.tree<code></td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
+<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
+<tr><td><code>Responses.process.entity_id<code></td><td>Entity id of actionable process</td></tr>
+<tr><td><code>Responses.process.name<code></td><td>Name of actionable process</td></tr>
+<tr><td><code>Responses.process.pid<code></td><td>pid of actionable process</td></tr>
+<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
+<tr><td><code>Target.*<code></td><td>No description found</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
+<tr><td><code>dll.*<code></td><td>No description found</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.*<code></td><td>No description found</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>process.*<code></td><td>No description found</td></tr>
+<tr><td><code>registry.*<code></td><td>No description found</td></tr>
+<tr><td><code>rule.description<code></td><td>The description of the rule generating the event.</td></tr>
+<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td><code>rule.reference<code></td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>rule.version<code></td><td>The version / revision of the rule being used for analysis.</td></tr>
+<tr><td><code>threat.framework<code></td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
+<tr><td><code>threat.tactic.id<code></td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td><code>threat.tactic.name<code></td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
+<tr><td><code>threat.tactic.reference<code></td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td><code>threat.technique.id<code></td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td><code>threat.technique.name<code></td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td><code>threat.technique.reference<code></td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td><code>threat.technique.subtechnique.id<code></td><td>The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
+<tr><td><code>threat.technique.subtechnique.name<code></td><td>The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
+<tr><td><code>threat.technique.subtechnique.reference<code></td><td>The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_malware_alert.md b/scripts/generate-docs/sample_output/alerts/windows/windows_malware_alert.md
new file mode 100644
index 000000000..6118e1dde
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/windows/windows_malware_alert.md
@@ -0,0 +1,217 @@
+# Windows Malware Alert
+
+## Description
+
+This alert is generated when a Malware alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "malicious_file"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
+<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
+<tr><td><code>Responses.action.file.attributes<code></td><td>Destination file attributes</td></tr>
+<tr><td><code>Responses.action.file.path<code></td><td>Destination file path</td></tr>
+<tr><td><code>Responses.action.file.reason<code></td><td>Combined USN file modification reason</td></tr>
+<tr><td><code>Responses.action.key.actions<code></td><td>Actions taken by Registry Rollback for key</td></tr>
+<tr><td><code>Responses.action.key.path<code></td><td>NT path of registry key recovered by Rollback</td></tr>
+<tr><td><code>Responses.action.key.values.actions<code></td><td>Actions taken by Registry Rollback for value</td></tr>
+<tr><td><code>Responses.action.key.values.name<code></td><td>Value name recovered by Rollback</td></tr>
+<tr><td><code>Responses.action.process.path<code></td><td>Path of process killed by Process Rollback</td></tr>
+<tr><td><code>Responses.action.source.attributes<code></td><td>Source file attributes</td></tr>
+<tr><td><code>Responses.action.source.path<code></td><td>Source file path</td></tr>
+<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
+<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>file.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>file.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>file.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>file.Ext.device.bus_type<code></td><td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td></tr>
+<tr><td><code>file.Ext.device.dos_name<code></td><td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td></tr>
+<tr><td><code>file.Ext.device.file_system_type<code></td><td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td></tr>
+<tr><td><code>file.Ext.device.nt_name<code></td><td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td></tr>
+<tr><td><code>file.Ext.device.product_id<code></td><td>ProductID of the device. It is provided by the vendor of the device if any.</td></tr>
+<tr><td><code>file.Ext.device.vendor_id<code></td><td>VendorID of the device. It is provided by the vendor of the device.</td></tr>
+<tr><td><code>file.Ext.device.volume_device_type<code></td><td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td></tr>
+<tr><td><code>file.Ext.malware_classification.identifier<code></td><td>The model's unique identifier.</td></tr>
+<tr><td><code>file.Ext.malware_classification.score<code></td><td>The score produced by the classification model.</td></tr>
+<tr><td><code>file.Ext.malware_classification.threshold<code></td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
+<tr><td><code>file.Ext.malware_classification.version<code></td><td>The version of the model used.</td></tr>
+<tr><td><code>file.Ext.malware_signature.all_names<code></td><td>The concatenated names of all yara signatures</td></tr>
+<tr><td><code>file.Ext.malware_signature.identifier<code></td><td>Malware artifact identifier.</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.matches<code></td><td>An array of bytes representing yara signature matches</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.signature.hash.sha256<code></td><td>Primary malware signature sha256.</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.signature.id<code></td><td>Primary malware signature id.</td></tr>
+<tr><td><code>file.Ext.malware_signature.primary.signature.name<code></td><td>Primary malware signature name.</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.matches<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.signature.hash.sha256<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.signature.id<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.secondary.signature.name<code></td><td>No description found</td></tr>
+<tr><td><code>file.Ext.malware_signature.version<code></td><td>Primary malware signature version.</td></tr>
+<tr><td><code>file.Ext.quarantine_message<code></td><td>Message describing quarantine results.</td></tr>
+<tr><td><code>file.Ext.quarantine_path<code></td><td>Path on endpoint the quarantined file was originally.</td></tr>
+<tr><td><code>file.Ext.quarantine_result<code></td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
+<tr><td><code>file.Ext.temp_file_path<code></td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
+<tr><td><code>file.accessed<code></td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
+<tr><td><code>file.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>file.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>file.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>file.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>file.created<code></td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
+<tr><td><code>file.directory<code></td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.drive_letter<code></td><td>Drive letter where the file is located. This field is only relevant on Windows.  The value should be uppercase, and not include the colon.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.mtime<code></td><td>Last time the file content was modified.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.owner<code></td><td>File owner's username.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.pe.Ext.dotnet<code></td><td>Whether this file is a .NET PE</td></tr>
+<tr><td><code>file.pe.Ext.sections.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>file.pe.Ext.sections.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.pe.Ext.sections.name<code></td><td>The section's name</td></tr>
+<tr><td><code>file.pe.Ext.streams.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>file.pe.Ext.streams.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.pe.Ext.streams.name<code></td><td>The stream's name</td></tr>
+<tr><td><code>file.pe.company<code></td><td>Internal company name of the file, provided at compile-time.</td></tr>
+<tr><td><code>file.pe.description<code></td><td>Internal description of the file, provided at compile-time.</td></tr>
+<tr><td><code>file.pe.file_version<code></td><td>Internal version of the file, provided at compile-time.</td></tr>
+<tr><td><code>file.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td><code>file.pe.product<code></td><td>Internal product name of the file, provided at compile-time.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.services<code></td><td>Services running in this process.</td></tr>
+<tr><td><code>process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
+<tr><td><code>process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
+<tr><td><code>process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
+<tr><td><code>process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
+<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.pe.company<code></td><td>Internal company name of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pe.description<code></td><td>Internal description of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pe.file_version<code></td><td>Internal version of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pe.product<code></td><td>Internal product name of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_memory_threat_alert.md b/scripts/generate-docs/sample_output/alerts/windows/windows_memory_threat_alert.md
new file mode 100644
index 000000000..539bb36df
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/windows/windows_memory_threat_alert.md
@@ -0,0 +1,158 @@
+# Windows Memory Threat Alert
+
+## Description
+
+This alert is generated when a Memory Threat alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "memory_signature"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_base<code></td><td>Base address of the memory allocation containing the memory region.</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_protection<code></td><td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_size<code></td><td>Original memory size requested when the memory was allocated.</td></tr>
+<tr><td><code>process.Ext.memory_region.allocation_type<code></td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_address<code></td><td>The address where bytes_compressed begins.</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_allocation_offset<code></td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_compressed<code></td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
+<tr><td><code>process.Ext.memory_region.bytes_compressed_present<code></td><td>Whether bytes_compressed is present in this event.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.all_names<code></td><td>A sequence of signature names matched.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.identifier<code></td><td>malware signature identifier</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.matches<code></td><td>The first matching details.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256<code></td><td>sha256 hash of file matching signature.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.id<code></td><td>The id of the first yara rule matched.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.name<code></td><td>The name of the first yara rule matched.</td></tr>
+<tr><td><code>process.Ext.memory_region.malware_signature.version<code></td><td>malware signature version</td></tr>
+<tr><td><code>process.Ext.memory_region.region_base<code></td><td>Base address of the memory region.</td></tr>
+<tr><td><code>process.Ext.memory_region.region_protection<code></td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
+<tr><td><code>process.Ext.memory_region.region_size<code></td><td>Size of the memory region.</td></tr>
+<tr><td><code>process.Ext.memory_region.region_start_bytes<code></td><td>First 64 bytes at the region base address.</td></tr>
+<tr><td><code>process.Ext.memory_region.region_state<code></td><td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
+<tr><td><code>process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
+<tr><td><code>process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
+<tr><td><code>process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
+<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_ransomware_alert.md b/scripts/generate-docs/sample_output/alerts/windows/windows_ransomware_alert.md
new file mode 100644
index 000000000..4318a8d5b
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/windows/windows_ransomware_alert.md
@@ -0,0 +1,187 @@
+# Windows Ransomware Alert
+
+## Description
+
+This alert is generated when a Ransomware alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "ransomware"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Ransomware.child_processes.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>Ransomware.child_processes.files.data<code></td><td>File header or MBR bytes.</td></tr>
+<tr><td><code>Ransomware.child_processes.files.entropy<code></td><td>Entropy of file contents.</td></tr>
+<tr><td><code>Ransomware.child_processes.files.extension<code></td><td>File extension, excluding the leading dot.</td></tr>
+<tr><td><code>Ransomware.child_processes.files.metrics<code></td><td>Suspicious ransomware behaviours associated with the file event.</td></tr>
+<tr><td><code>Ransomware.child_processes.files.operation<code></td><td>Operation applied to file.</td></tr>
+<tr><td><code>Ransomware.child_processes.files.path<code></td><td>Full path to the file, including the file name.</td></tr>
+<tr><td><code>Ransomware.child_processes.files.score<code></td><td>Ransomware score for this particular file event.</td></tr>
+<tr><td><code>Ransomware.child_processes.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>Ransomware.child_processes.score<code></td><td>Total ransomware score for aggregated file events.</td></tr>
+<tr><td><code>Ransomware.feature<code></td><td>Ransomware feature which triggered the alert.</td></tr>
+<tr><td><code>Ransomware.files.data<code></td><td>File header or MBR bytes.</td></tr>
+<tr><td><code>Ransomware.files.entropy<code></td><td>Entropy of file contents.</td></tr>
+<tr><td><code>Ransomware.files.extension<code></td><td>File extension, excluding the leading dot.</td></tr>
+<tr><td><code>Ransomware.files.metrics<code></td><td>Suspicious ransomware behaviours associated with the file event.</td></tr>
+<tr><td><code>Ransomware.files.operation<code></td><td>Operation applied to file.</td></tr>
+<tr><td><code>Ransomware.files.path<code></td><td>Full path to the file, including the file name.</td></tr>
+<tr><td><code>Ransomware.files.score<code></td><td>Ransomware score for this particular file event.</td></tr>
+<tr><td><code>Ransomware.score<code></td><td>Total ransomware score for aggregated file events.</td></tr>
+<tr><td><code>Ransomware.version<code></td><td>Ransomware artifact version.</td></tr>
+<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
+<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
+<tr><td><code>Responses.action.file.attributes<code></td><td>Destination file attributes</td></tr>
+<tr><td><code>Responses.action.file.path<code></td><td>Destination file path</td></tr>
+<tr><td><code>Responses.action.file.reason<code></td><td>Combined USN file modification reason</td></tr>
+<tr><td><code>Responses.action.key.actions<code></td><td>Actions taken by Registry Rollback for key</td></tr>
+<tr><td><code>Responses.action.key.path<code></td><td>NT path of registry key recovered by Rollback</td></tr>
+<tr><td><code>Responses.action.source.attributes<code></td><td>Source file attributes</td></tr>
+<tr><td><code>Responses.action.source.path<code></td><td>Source file path</td></tr>
+<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
+<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.mapped_address<code></td><td>The base address where this module is loaded.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.mapped_size<code></td><td>The size of this module's memory mapping, in bytes.</td></tr>
+<tr><td><code>process.Ext.dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.dll.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.dll.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.Ext.dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.Ext.dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.Ext.dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td><code>process.Ext.dll.path<code></td><td>Full file path of the library.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
+<tr><td><code>process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
+<tr><td><code>process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
+<tr><td><code>process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
+<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.pe.company<code></td><td>Internal company name of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pe.description<code></td><td>Internal description of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pe.file_version<code></td><td>Internal version of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pe.product<code></td><td>Internal product name of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_shellcode_thread.md b/scripts/generate-docs/sample_output/alerts/windows/windows_shellcode_thread.md
new file mode 100644
index 000000000..a8063535d
--- /dev/null
+++ b/scripts/generate-docs/sample_output/alerts/windows/windows_shellcode_thread.md
@@ -0,0 +1,274 @@
+# Windows Shellcode Thread Alert
+
+## Description
+
+This alert is generated when a Shellcode Threat alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "shellcode_thread"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Memory_protection.cross_session<code></td><td>Is this process injecting across operating system sessions?</td></tr>
+<tr><td><code>Memory_protection.feature<code></td><td>Memory Protection feature which triggered the alert.</td></tr>
+<tr><td><code>Memory_protection.parent_to_child<code></td><td>Is this process injecting into its child?</td></tr>
+<tr><td><code>Memory_protection.self_injection<code></td><td>Is this alert about a process injecting into itself?</td></tr>
+<tr><td><code>Memory_protection.unique_key_v1<code></td><td>A unique key created by hashing several characteristics of this alert.</td></tr>
+<tr><td><code>Memory_protection.unique_key_v2<code></td><td>A unique key created by hashing several characteristics of this alert.</td></tr>
+<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
+<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
+<tr><td><code>Responses.action.file.attributes<code></td><td>Destination file attributes</td></tr>
+<tr><td><code>Responses.action.file.path<code></td><td>Destination file path</td></tr>
+<tr><td><code>Responses.action.file.reason<code></td><td>Combined USN file modification reason</td></tr>
+<tr><td><code>Responses.action.key.actions<code></td><td>Actions taken by Registry Rollback for key</td></tr>
+<tr><td><code>Responses.action.key.path<code></td><td>NT path of registry key recovered by Rollback</td></tr>
+<tr><td><code>Responses.action.key.values.actions<code></td><td>Actions taken by Registry Rollback for value</td></tr>
+<tr><td><code>Responses.action.key.values.name<code></td><td>Value name recovered by Rollback</td></tr>
+<tr><td><code>Responses.action.source.attributes<code></td><td>Source file attributes</td></tr>
+<tr><td><code>Responses.action.source.path<code></td><td>Source file path</td></tr>
+<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
+<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
+<tr><td><code>Target.process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>Target.process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>Target.process.Ext.dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>Target.process.Ext.dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>Target.process.Ext.dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>Target.process.Ext.dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>Target.process.Ext.dll.Ext.mapped_address<code></td><td>The base address where this module is loaded.</td></tr>
+<tr><td><code>Target.process.Ext.dll.Ext.mapped_size<code></td><td>The size of this module's memory mapping, in bytes.</td></tr>
+<tr><td><code>Target.process.Ext.dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>Target.process.Ext.dll.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>Target.process.Ext.dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>Target.process.Ext.dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>Target.process.Ext.dll.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>Target.process.Ext.dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>Target.process.Ext.dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>Target.process.Ext.dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td><code>Target.process.Ext.dll.path<code></td><td>Full file path of the library.</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.allocation_base<code></td><td>Base address of the memory allocation containing the memory region.</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.allocation_protection<code></td><td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.allocation_size<code></td><td>Original memory size requested when the memory was allocated.</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.allocation_type<code></td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.bytes_address<code></td><td>The address where bytes_compressed begins.</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.bytes_allocation_offset<code></td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.mapped_path<code></td><td>If the memory corresponds to a file mapping, this is the file's path.</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.memory_pe_detected<code></td><td>Whether an executable file was found in memory.</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.region_base<code></td><td>Base address of the memory region.</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.region_protection<code></td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.region_size<code></td><td>Size of the memory region.</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.region_state<code></td><td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td></tr>
+<tr><td><code>Target.process.Ext.memory_region.strings<code></td><td>Array of strings found within the memory region.</td></tr>
+<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>Target.process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
+<tr><td><code>Target.process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
+<tr><td><code>Target.process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
+<tr><td><code>Target.process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>Target.process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
+<tr><td><code>Target.process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
+<tr><td><code>Target.process.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>Target.process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>Target.process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>Target.process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>Target.process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>Target.process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>Target.process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>Target.process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>Target.process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>Target.process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>Target.process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>Target.process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>Target.process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>Target.process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>Target.process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>Target.process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>Target.process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>Target.process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>Target.process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>Target.process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>Target.process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>Target.process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>Target.process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>Target.process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>Target.process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>Target.process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>Target.process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>Target.process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>Target.process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>Target.process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>Target.process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>Target.process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>Target.process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>Target.process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>Target.process.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>Target.process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>Target.process.thread.Ext.call_stack.instruction_pointer<code></td><td>The return address of this stack frame.</td></tr>
+<tr><td><code>Target.process.thread.Ext.call_stack.memory_section.memory_address<code></td><td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td></tr>
+<tr><td><code>Target.process.thread.Ext.call_stack.memory_section.memory_size<code></td><td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td></tr>
+<tr><td><code>Target.process.thread.Ext.call_stack.memory_section.protection<code></td><td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td><code>Target.process.thread.Ext.call_stack.module_name<code></td><td>The name of the DLL/module containing `instruction_pointer`.</td></tr>
+<tr><td><code>Target.process.thread.Ext.call_stack.module_path<code></td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
+<tr><td><code>Target.process.thread.Ext.call_stack.symbol_info<code></td><td>The nearest symbol for `instruction_pointer`.</td></tr>
+<tr><td><code>Target.process.thread.Ext.call_stack_summary<code></td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
+<tr><td><code>Target.process.thread.Ext.original_start_address<code></td><td>When a trampoline was detected, this indicates the original content for the thread start address in memory.</td></tr>
+<tr><td><code>Target.process.thread.Ext.original_start_address_allocation_offset<code></td><td>When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.</td></tr>
+<tr><td><code>Target.process.thread.Ext.original_start_address_bytes<code></td><td>When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.</td></tr>
+<tr><td><code>Target.process.thread.Ext.original_start_address_bytes_disasm<code></td><td>When a trampoline was detected, this holds the disassembled code at the original thread start address.</td></tr>
+<tr><td><code>Target.process.thread.Ext.original_start_address_bytes_disasm_hash<code></td><td>When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td></tr>
+<tr><td><code>Target.process.thread.Ext.original_start_address_module<code></td><td>When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.</td></tr>
+<tr><td><code>Target.process.thread.Ext.start_address<code></td><td>Memory address where the thread began execution.</td></tr>
+<tr><td><code>Target.process.thread.Ext.start_address_allocation_offset<code></td><td>Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.</td></tr>
+<tr><td><code>Target.process.thread.Ext.start_address_bytes<code></td><td>A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.</td></tr>
+<tr><td><code>Target.process.thread.Ext.start_address_bytes_disasm<code></td><td>The bytes at the thread start address, disassembled into human-readable assembly code.</td></tr>
+<tr><td><code>Target.process.thread.Ext.start_address_bytes_disasm_hash<code></td><td>The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td></tr>
+<tr><td><code>Target.process.thread.Ext.start_address_module<code></td><td>The dll/module where the thread began execution.</td></tr>
+<tr><td><code>Target.process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>Target.process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.mapped_address<code></td><td>The base address where this module is loaded.</td></tr>
+<tr><td><code>process.Ext.dll.Ext.mapped_size<code></td><td>The size of this module's memory mapping, in bytes.</td></tr>
+<tr><td><code>process.Ext.dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.dll.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.dll.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.Ext.dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.Ext.dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.Ext.dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td><code>process.Ext.dll.path<code></td><td>Full file path of the library.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
+<tr><td><code>process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
+<tr><td><code>process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
+<tr><td><code>process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
+<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.ppid<code></td><td>Parent process' pid.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack.instruction_pointer<code></td><td>The return address of this stack frame.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack.memory_section.memory_address<code></td><td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td></tr>
+<tr><td><code>process.thread.Ext.call_stack.memory_section.memory_size<code></td><td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td></tr>
+<tr><td><code>process.thread.Ext.call_stack.memory_section.protection<code></td><td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td><code>process.thread.Ext.call_stack.module_name<code></td><td>The name of the DLL/module containing `instruction_pointer`.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack.module_path<code></td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack.symbol_info<code></td><td>The nearest symbol for `instruction_pointer`.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack_final_user_module.name<code></td><td>The file name of the call_stack_final_user_module.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack_summary<code></td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
+<tr><td><code>process.thread.Ext.start_address<code></td><td>Memory address where the thread began execution.</td></tr>
+<tr><td><code>process.thread.Ext.start_address_module<code></td><td>The dll/module where the thread began execution.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_amsi.md b/scripts/generate-docs/sample_output/api/windows/windows_api_amsi.md
new file mode 100644
index 000000000..4eb3f18ca
--- /dev/null
+++ b/scripts/generate-docs/sample_output/api/windows/windows_api_amsi.md
@@ -0,0 +1,89 @@
+# Windows AMSI API
+
+## Description
+
+This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Antimalware-Scan-Interface" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td><code>process.Ext.api.metadata.return_value<code></td><td>Return value of RegisterRawInputDevices API call.</td></tr>
+<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td><code>process.Ext.api.parameters.app_name<code></td><td>The application name requesting the AMSI scan.</td></tr>
+<tr><td><code>process.Ext.api.parameters.buffer<code></td><td>The content associated with an AMSI scan.</td></tr>
+<tr><td><code>process.Ext.api.parameters.content_name<code></td><td>The content name, typically a filename, associated with an AMSI scan.</td></tr>
+<tr><td><code>process.Ext.api.parameters.size<code></td><td>The size.</td></tr>
+<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_asm.md b/scripts/generate-docs/sample_output/api/windows/windows_api_asm.md
new file mode 100644
index 000000000..736ce88a7
--- /dev/null
+++ b/scripts/generate-docs/sample_output/api/windows/windows_api_asm.md
@@ -0,0 +1,92 @@
+# Windows API
+
+## Description
+
+This event is generated when ETW AttackSurfaceMonitor events are generated.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "AttackSurfaceMonitor" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>dll.path<code></td><td>Full file path of the library.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td><code>process.Ext.api.parameters.device<code></td><td>The name of the device object.</td></tr>
+<tr><td><code>process.Ext.api.parameters.io_control_code<code></td><td>The I/O control code for the requested device operation.</td></tr>
+<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_credential_access.md b/scripts/generate-docs/sample_output/api/windows/windows_api_credential_access.md
new file mode 100644
index 000000000..324d9bc6f
--- /dev/null
+++ b/scripts/generate-docs/sample_output/api/windows/windows_api_credential_access.md
@@ -0,0 +1,89 @@
+# Windows API
+
+## Description
+
+This event is generated when a process attempts to access priviledged credentials. 
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "ObjectCallback" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td><code>process.Ext.api.parameters.desired_access<code></td><td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td></tr>
+<tr><td><code>process.Ext.api.parameters.desired_access_numeric<code></td><td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td></tr>
+<tr><td><code>process.Ext.api.parameters.handle_type<code></td><td>This parameter indicates whether the detected access was attempt against a process or a thread.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack.instruction_pointer<code></td><td>The return address of this stack frame.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack.module_path<code></td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack_contains_unbacked<code></td><td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td></tr>
+<tr><td><code>process.thread.Ext.call_stack_final_user_module.path<code></td><td>The file path of the call_stack_final_user_module.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_kernel_audit.md b/scripts/generate-docs/sample_output/api/windows/windows_api_kernel_audit.md
new file mode 100644
index 000000000..3e0dcd4b5
--- /dev/null
+++ b/scripts/generate-docs/sample_output/api/windows/windows_api_kernel_audit.md
@@ -0,0 +1,84 @@
+# Windows API
+
+## Description
+
+This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events are generated.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Kernel-Audit-API-Calls" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_tcpip.md b/scripts/generate-docs/sample_output/api/windows/windows_api_tcpip.md
new file mode 100644
index 000000000..6329c08b0
--- /dev/null
+++ b/scripts/generate-docs/sample_output/api/windows/windows_api_tcpip.md
@@ -0,0 +1,88 @@
+# Windows API
+
+## Description
+
+This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-TCPIP" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_threat_intelligence.md b/scripts/generate-docs/sample_output/api/windows/windows_api_threat_intelligence.md
new file mode 100644
index 000000000..39afbaf30
--- /dev/null
+++ b/scripts/generate-docs/sample_output/api/windows/windows_api_threat_intelligence.md
@@ -0,0 +1,128 @@
+# Windows API
+
+## Description
+
+This event is generated when ETW Threat-Intelligence events are generated.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Threat-Intelligence" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.created_suspended<code></td><td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td></tr>
+<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>Target.process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>Target.process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>Target.process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td><code>process.Ext.api.metadata.target_address_name<code></td><td>The name of the memory region targeted by the API call.</td></tr>
+<tr><td><code>process.Ext.api.metadata.target_address_path<code></td><td>The path of the memory region targeted by the API call.</td></tr>
+<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td><code>process.Ext.api.parameters.address<code></td><td>The target memory address.</td></tr>
+<tr><td><code>process.Ext.api.parameters.allocation_type<code></td><td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td></tr>
+<tr><td><code>process.Ext.api.parameters.argument1<code></td><td>The first argument to the procedure.</td></tr>
+<tr><td><code>process.Ext.api.parameters.argument2<code></td><td>The second argument to the procedure.</td></tr>
+<tr><td><code>process.Ext.api.parameters.argument3<code></td><td>The third argument to the procedure.</td></tr>
+<tr><td><code>process.Ext.api.parameters.context_flags<code></td><td>The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`</td></tr>
+<tr><td><code>process.Ext.api.parameters.desired_access<code></td><td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td></tr>
+<tr><td><code>process.Ext.api.parameters.desired_access_numeric<code></td><td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td></tr>
+<tr><td><code>process.Ext.api.parameters.device<code></td><td>The name of the device object.</td></tr>
+<tr><td><code>process.Ext.api.parameters.driver<code></td><td>The name of the driver object.</td></tr>
+<tr><td><code>process.Ext.api.parameters.eax<code></td><td>The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.</td></tr>
+<tr><td><code>process.Ext.api.parameters.ebp<code></td><td>The x86 EBP frame pointer register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.ebx<code></td><td>The x86 EBX general purpose register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.ecx<code></td><td>The x86 ECX general purpose register. First argument in __fastcall and __thiscall.</td></tr>
+<tr><td><code>process.Ext.api.parameters.edi<code></td><td>The x86 EDI general purpose register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.edx<code></td><td>The x86 EDX general purpose register. Second argument in a __fastcall.</td></tr>
+<tr><td><code>process.Ext.api.parameters.eip<code></td><td>The x86 EIP instruction pointer register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.esi<code></td><td>The x86 ESI general purpose register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.esp<code></td><td>The x86 ESP stack pointer register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.handle_type<code></td><td>This parameter indicates whether the detected access was attempt against a process or a thread.</td></tr>
+<tr><td><code>process.Ext.api.parameters.procedure<code></td><td>The memory address of the procedure or function.</td></tr>
+<tr><td><code>process.Ext.api.parameters.protection<code></td><td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td><code>process.Ext.api.parameters.protection_old<code></td><td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td><code>process.Ext.api.parameters.r8<code></td><td>The x64 R8 general purpose register. Third argument in a __fastcall.</td></tr>
+<tr><td><code>process.Ext.api.parameters.r9<code></td><td>The x64 R9 general purpose register. Fourth argument in a __fastcall.</td></tr>
+<tr><td><code>process.Ext.api.parameters.rax<code></td><td>The x64 RAX general purpose register. Return value in a __fastcall.</td></tr>
+<tr><td><code>process.Ext.api.parameters.rbp<code></td><td>The x64 RBP general purpose register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.rbx<code></td><td>The x64 RBX general purpose register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.rcx<code></td><td>The x64 RCX general purpose register. First argument in a __fastcall.</td></tr>
+<tr><td><code>process.Ext.api.parameters.rdi<code></td><td>The x64 RDI general purpose register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.rdx<code></td><td>The x64 RDX general purpose register. Second argument in a __fastcall.</td></tr>
+<tr><td><code>process.Ext.api.parameters.rip<code></td><td>The x64 RIP instruction pointer register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.rsi<code></td><td>The x64 RSI general purpose register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.rsp<code></td><td>The x64 RSP stack pointer register.</td></tr>
+<tr><td><code>process.Ext.api.parameters.size<code></td><td>The size.</td></tr>
+<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_win32k.md b/scripts/generate-docs/sample_output/api/windows/windows_api_win32k.md
new file mode 100644
index 000000000..a93dd8e7b
--- /dev/null
+++ b/scripts/generate-docs/sample_output/api/windows/windows_api_win32k.md
@@ -0,0 +1,110 @@
+# Windows Win32k API
+
+## Description
+
+This event is generated when keylogging-related Win32k APIs are called.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Win32k" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td><code>process.Ext.api.metadata.background_callcount<code></td><td>This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.</td></tr>
+<tr><td><code>process.Ext.api.metadata.ms_since_last_keyevent<code></td><td>This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.</td></tr>
+<tr><td><code>process.Ext.api.metadata.procedure_symbol<code></td><td>Summary of the hook procedure.</td></tr>
+<tr><td><code>process.Ext.api.metadata.return_value<code></td><td>Return value of RegisterRawInputDevices API call.</td></tr>
+<tr><td><code>process.Ext.api.metadata.start_address_allocation_protection<code></td><td>Memory protection attributes associated with the starting address of a thread.</td></tr>
+<tr><td><code>process.Ext.api.metadata.start_address_module<code></td><td>Name of the module associated with the starting address of a thread.</td></tr>
+<tr><td><code>process.Ext.api.metadata.target_address_name<code></td><td>The name of the memory region targeted by the API call.</td></tr>
+<tr><td><code>process.Ext.api.metadata.target_address_path<code></td><td>The path of the memory region targeted by the API call.</td></tr>
+<tr><td><code>process.Ext.api.metadata.thread_info_flags<code></td><td>Thread info flags.</td></tr>
+<tr><td><code>process.Ext.api.metadata.visible_windows_count<code></td><td>Number of visible windows owned by the caller thread.</td></tr>
+<tr><td><code>process.Ext.api.metadata.windows_count<code></td><td>Number of windows owned by the caller thread.</td></tr>
+<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td><code>process.Ext.api.parameters.address<code></td><td>The target memory address.</td></tr>
+<tr><td><code>process.Ext.api.parameters.allocation_type<code></td><td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td></tr>
+<tr><td><code>process.Ext.api.parameters.flags<code></td><td>Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.</td></tr>
+<tr><td><code>process.Ext.api.parameters.hook_module<code></td><td>DLL containing the hook procedure.</td></tr>
+<tr><td><code>process.Ext.api.parameters.hook_type<code></td><td>Type of hook procedure to be installed.</td></tr>
+<tr><td><code>process.Ext.api.parameters.procedure<code></td><td>The memory address of the procedure or function.</td></tr>
+<tr><td><code>process.Ext.api.parameters.protection<code></td><td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td><code>process.Ext.api.parameters.protection_old<code></td><td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td><code>process.Ext.api.parameters.size<code></td><td>The size.</td></tr>
+<tr><td><code>process.Ext.api.parameters.usage<code></td><td>This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.</td></tr>
+<tr><td><code>process.Ext.api.parameters.usage_page<code></td><td>This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.</td></tr>
+<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_wmi.md b/scripts/generate-docs/sample_output/api/windows/windows_api_wmi.md
new file mode 100644
index 000000000..b5a5c87ee
--- /dev/null
+++ b/scripts/generate-docs/sample_output/api/windows/windows_api_wmi.md
@@ -0,0 +1,99 @@
+# Windows API
+
+## Description
+
+This event is generated when WMI Activity-related APIs are called.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-WMI-Activity" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td><code>process.Ext.api.metadata.client_is_local<code></td><td>Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.</td></tr>
+<tr><td><code>process.Ext.api.metadata.client_machine<code></td><td>Client process's machine name (provided by the client and potentially untrustworthy).</td></tr>
+<tr><td><code>process.Ext.api.metadata.client_machine_fqdn<code></td><td>Client process's machine name FQDN (provided by the client and potentially untrustworthy).</td></tr>
+<tr><td><code>process.Ext.api.metadata.client_process_id<code></td><td>Client process id</td></tr>
+<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td><code>process.Ext.api.parameters.consumer_details<code></td><td>Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name.</td></tr>
+<tr><td><code>process.Ext.api.parameters.consumer_name<code></td><td>Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.</td></tr>
+<tr><td><code>process.Ext.api.parameters.consumer_type<code></td><td>An example list of consumer type.    "ActiveScriptEventConsumer" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.    "CommandLineEventConsumer" - Launches an arbitrary process in the local system context when an event is delivered to it.    "LogFileEventConsumer" - Writes customized strings to a text log file when events are delivered to it.    "NTEventLogEventConsumer" - Logs a specific message to the Windows event log when an event is delivered to it.    "SMTPEventConsumer" - Sends an email message using SMTP each time an event is delivered to it.</td></tr>
+<tr><td><code>process.Ext.api.parameters.event_filter_details<code></td><td>Provide an overview of the query that define when an event should be triggered.</td></tr>
+<tr><td><code>process.Ext.api.parameters.event_filter_name<code></td><td>Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.</td></tr>
+<tr><td><code>process.Ext.api.parameters.namespace<code></td><td>WMI namespace to which the connection is made.</td></tr>
+<tr><td><code>process.Ext.api.parameters.operation<code></td><td>Specifies the connection or request to WMI</td></tr>
+<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/linux/linux_file_create.md b/scripts/generate-docs/sample_output/file/linux/linux_file_create.md
new file mode 100644
index 000000000..ab2cff0dd
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/linux/linux_file_create.md
@@ -0,0 +1,85 @@
+# Linux File Create
+
+## Description
+
+This event is generated when a file is created.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "creation"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/linux/linux_file_delete.md b/scripts/generate-docs/sample_output/file/linux/linux_file_delete.md
new file mode 100644
index 000000000..c3634a767
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/linux/linux_file_delete.md
@@ -0,0 +1,84 @@
+# Linux File Delete
+
+## Description
+
+This event is generated when a file is deleted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "deletion"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/linux/linux_file_endpoint_unquarantine.md b/scripts/generate-docs/sample_output/file/linux/linux_file_endpoint_unquarantine.md
new file mode 100644
index 000000000..7baedaabe
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/linux/linux_file_endpoint_unquarantine.md
@@ -0,0 +1,68 @@
+# Linux Malware Unquarantine
+
+## Description
+
+This event is generated when Endpoint restores a file from the malware quarantine.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "endpoint_unquarantine"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.Ext.correlation.id<code></td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
+<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/linux/linux_file_rename.md b/scripts/generate-docs/sample_output/file/linux/linux_file_rename.md
new file mode 100644
index 000000000..a01747260
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/linux/linux_file_rename.md
@@ -0,0 +1,88 @@
+# Linux File Rename
+
+## Description
+
+This event is generated when a file is renamed.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "rename"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.original.extension<code></td><td>Original file extension prior to a modification event</td></tr>
+<tr><td><code>file.Ext.original.name<code></td><td>Original file name prior to a modification event</td></tr>
+<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_access.md b/scripts/generate-docs/sample_output/file/macos/macos_file_access.md
new file mode 100644
index 000000000..0936150f7
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/macos/macos_file_access.md
@@ -0,0 +1,77 @@
+# macOS File Rename
+
+## Description
+
+This event is generated when a file is accessed.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "open"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_delete.md b/scripts/generate-docs/sample_output/file/macos/macos_file_delete.md
new file mode 100644
index 000000000..6ccd427a9
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/macos/macos_file_delete.md
@@ -0,0 +1,92 @@
+# macOS File Delete
+
+## Description
+
+This event is generated when a file is deleted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "deletion"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_endpoint_unquarantine.md b/scripts/generate-docs/sample_output/file/macos/macos_file_endpoint_unquarantine.md
new file mode 100644
index 000000000..ee6d86b35
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/macos/macos_file_endpoint_unquarantine.md
@@ -0,0 +1,68 @@
+# macOS Malware Unquarantine
+
+## Description
+
+This event is generated when Endpoint restores a file from the malware quarantine.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "endpoint_unquarantine"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.Ext.correlation.id<code></td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
+<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_extended_attributes_delete.md b/scripts/generate-docs/sample_output/file/macos/macos_file_extended_attributes_delete.md
new file mode 100644
index 000000000..3df501790
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/macos/macos_file_extended_attributes_delete.md
@@ -0,0 +1,92 @@
+# macOS File Extended Attributes Delete
+
+## Description
+
+This event is generated when extended file attributes are deleted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "extended_attributes_delete"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.attributes<code></td><td>Array of file attributes.  Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_launch_daemon.md b/scripts/generate-docs/sample_output/file/macos/macos_file_launch_daemon.md
new file mode 100644
index 000000000..885832a23
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/macos/macos_file_launch_daemon.md
@@ -0,0 +1,90 @@
+# macOS Launch Daemon
+
+## Description
+
+This event includes information about a macOS Launch Daemon.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "launch_daemon"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>Persistence.args<code></td><td>Arguments used to execute the persistence item</td></tr>
+<tr><td><code>Persistence.keepalive<code></td><td>Keep alive option boolean</td></tr>
+<tr><td><code>Persistence.name<code></td><td>The persistence item's name</td></tr>
+<tr><td><code>Persistence.path<code></td><td>The file's path</td></tr>
+<tr><td><code>Persistence.runatload<code></td><td>Run at load option boolean</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_modification.md b/scripts/generate-docs/sample_output/file/macos/macos_file_modification.md
new file mode 100644
index 000000000..5ce48f557
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/macos/macos_file_modification.md
@@ -0,0 +1,94 @@
+# macOS File Modification
+
+## Description
+
+This event is generated when a file is modified.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "modification"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_mount.md b/scripts/generate-docs/sample_output/file/macos/macos_file_mount.md
new file mode 100644
index 000000000..da8c26e74
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/macos/macos_file_mount.md
@@ -0,0 +1,89 @@
+# macOS Mount
+
+## Description
+
+This event is generated when a file system is mounted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "mount"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
+<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_rename.md b/scripts/generate-docs/sample_output/file/macos/macos_file_rename.md
new file mode 100644
index 000000000..7b5a2690b
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/macos/macos_file_rename.md
@@ -0,0 +1,95 @@
+# macOS File Rename
+
+## Description
+
+This event is generated when a file is renamed.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "rename"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.original.extension<code></td><td>Original file extension prior to a modification event</td></tr>
+<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_create.md b/scripts/generate-docs/sample_output/file/windows/windows_file_create.md
new file mode 100644
index 000000000..a826ddbe1
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/windows/windows_file_create.md
@@ -0,0 +1,96 @@
+# Windows File Create
+
+## Description
+
+This event is generated when a file is created.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "creation"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
+<tr><td><code>file.Ext.windows.zone_identifier<code></td><td>Windows zone identifier for a file</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.origin_referrer_url<code></td><td>The url of the webpage that linked to the file.</td></tr>
+<tr><td><code>file.origin_url<code></td><td>The url where the file is hosted.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_delete.md b/scripts/generate-docs/sample_output/file/windows/windows_file_delete.md
new file mode 100644
index 000000000..77603e93e
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/windows/windows_file_delete.md
@@ -0,0 +1,91 @@
+# Windows File Delete
+
+## Description
+
+This event is generated when a file is deleted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "deletion"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_endpoint_unquarantine.md b/scripts/generate-docs/sample_output/file/windows/windows_file_endpoint_unquarantine.md
new file mode 100644
index 000000000..5305e448a
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/windows/windows_file_endpoint_unquarantine.md
@@ -0,0 +1,68 @@
+# Windows Malware Unquarantine
+
+## Description
+
+This event is generated when Endpoint restores a file from the malware quarantine.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "endpoint_unquarantine"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.Ext.correlation.id<code></td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
+<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_modification.md b/scripts/generate-docs/sample_output/file/windows/windows_file_modification.md
new file mode 100644
index 000000000..1a9e61a77
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/windows/windows_file_modification.md
@@ -0,0 +1,92 @@
+# Windows File Modification
+
+## Description
+
+This event is generated when a file is modified.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "modification"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_open.md b/scripts/generate-docs/sample_output/file/windows/windows_file_open.md
new file mode 100644
index 000000000..d4cc6b78f
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/windows/windows_file_open.md
@@ -0,0 +1,93 @@
+# Windows File Open
+
+## Description
+
+This event is generated when a file is opened.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "open"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_overwrite.md b/scripts/generate-docs/sample_output/file/windows/windows_file_overwrite.md
new file mode 100644
index 000000000..295147510
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/windows/windows_file_overwrite.md
@@ -0,0 +1,92 @@
+# Windows File Overwrite
+
+## Description
+
+This event is generated when a file is overwritten
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "overwrite"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_rename.md b/scripts/generate-docs/sample_output/file/windows/windows_file_rename.md
new file mode 100644
index 000000000..4c6126a72
--- /dev/null
+++ b/scripts/generate-docs/sample_output/file/windows/windows_file_rename.md
@@ -0,0 +1,96 @@
+# Windows File Rename
+
+## Description
+
+This event is generated when a file is renamed.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "rename"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
+<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
+<tr><td><code>file.Ext.original.extension<code></td><td>Original file extension prior to a modification event</td></tr>
+<tr><td><code>file.Ext.original.name<code></td><td>Original file name prior to a modification event</td></tr>
+<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
+<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/library/macos/macos_library_load.md b/scripts/generate-docs/sample_output/library/macos/macos_library_load.md
new file mode 100644
index 000000000..b18907bcb
--- /dev/null
+++ b/scripts/generate-docs/sample_output/library/macos/macos_library_load.md
@@ -0,0 +1,95 @@
+# Windows Library Load
+
+## Description
+
+This event is generated when a dynlib is loaded.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.library-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.library" and event.module : "endpoint" and host.os.type : "macos" and event.action : "load"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>dll.Ext.size<code></td><td>Size of DLL</td></tr>
+<tr><td><code>dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>dll.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>dll.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td><code>dll.path<code></td><td>Full file path of the library.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/library/windows/windows_library_load.md b/scripts/generate-docs/sample_output/library/windows/windows_library_load.md
new file mode 100644
index 000000000..4953cdbd9
--- /dev/null
+++ b/scripts/generate-docs/sample_output/library/windows/windows_library_load.md
@@ -0,0 +1,101 @@
+# Windows Library Load
+
+## Description
+
+This event is generated when a DLL or driver is loaded.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.library-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.library" and event.module : "endpoint" and host.os.type : "windows" and event.action : "load"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>dll.Ext.defense_evasions<code></td><td>List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump.</td></tr>
+<tr><td><code>dll.Ext.load_index<code></td><td>A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.  The first load index is 1.</td></tr>
+<tr><td><code>dll.Ext.relative_file_creation_time<code></td><td>Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
+<tr><td><code>dll.Ext.relative_file_name_modify_time<code></td><td>Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td></tr>
+<tr><td><code>dll.Ext.size<code></td><td>Size of DLL</td></tr>
+<tr><td><code>dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>dll.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>dll.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td><code>dll.path<code></td><td>Full file path of the library.</td></tr>
+<tr><td><code>dll.pe.file_version<code></td><td>Internal version of the file, provided at compile-time.</td></tr>
+<tr><td><code>dll.pe.imphash<code></td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
+<tr><td><code>dll.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/metadata/metadata.md b/scripts/generate-docs/sample_output/metadata/metadata.md
new file mode 100644
index 000000000..4559efebc
--- /dev/null
+++ b/scripts/generate-docs/sample_output/metadata/metadata.md
@@ -0,0 +1,72 @@
+# Endpoint Metadata
+
+## Description
+
+This is a relatively small state management document that includes details about an installed Endpoint.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux, macOS, Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>metrics-endpoint.metadata-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.metadata" and event.module : "endpoint" and event.action : "endpoint_metadata"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.capabilities<code></td><td>Enabled capabilities</td></tr>
+<tr><td><code>Endpoint.configuration.isolation<code></td><td>Configuration setting for Host Isolation from the network</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.status<code></td><td>the status of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.state.isolation<code></td><td>Current network isolation state of the host</td></tr>
+<tr><td><code>Endpoint.state.tamper_protection<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.status<code></td><td>The current status of the endpoint e.g. enrolled, unenrolled.</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/metrics/metrics.md b/scripts/generate-docs/sample_output/metrics/metrics.md
new file mode 100644
index 000000000..d8eeaf981
--- /dev/null
+++ b/scripts/generate-docs/sample_output/metrics/metrics.md
@@ -0,0 +1,212 @@
+# Endpoint Metrics
+
+## Description
+
+This is an internal state management document that includes metrics on Endpoint's performance.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux, macOS, Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>metrics-endpoint.metrics-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.metrics" and event.module : "endpoint" and event.action : "endpoint_metrics"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.behavior.rtt<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.behavior.timeout_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.malware_score.rtt<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.malware_score.timeout_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.rtt<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.timeout_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.ransomware.rtt<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.ransomware.timeout_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.rtt<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.timeout_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.shell_code.rtt<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.shell_code.timeout_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cpu.endpoint.histogram.counts<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cpu.endpoint.histogram.values<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.cpu.endpoint.latest<code></td><td>Average CPU over the last sample interval</td></tr>
+<tr><td><code>Endpoint.metrics.cpu.endpoint.mean<code></td><td>Average CPU load used by the endpoint</td></tr>
+<tr><td><code>Endpoint.metrics.disks.device<code></td><td>Device name</td></tr>
+<tr><td><code>Endpoint.metrics.disks.endpoint_drive<code></td><td>This field will be present and set to true only for the drive that holds the installed endpoint</td></tr>
+<tr><td><code>Endpoint.metrics.disks.free<code></td><td>The number of bytes marked as free on the disk</td></tr>
+<tr><td><code>Endpoint.metrics.disks.fstype<code></td><td>The file system type for the drive</td></tr>
+<tr><td><code>Endpoint.metrics.disks.mount<code></td><td>The disks mount location</td></tr>
+<tr><td><code>Endpoint.metrics.disks.total<code></td><td>The size of the disk in bytes</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.alerts.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.alerts.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.alerts.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.alerts.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.api_events.sent_bytes<code></td><td>Total size of API Event sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.api_events.sent_count<code></td><td>Number of sent API Event documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.sent_bytes<code></td><td>Total size of API Event sent documents from source</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.sent_count<code></td><td>Number of sent API Event documents from source</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.source<code></td><td>API Event document source name</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes<code></td><td>Total size of suppressed API Event documents from source</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.suppressed_count<code></td><td>Number of suppressed API Event documents from source</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.api_events.suppressed_bytes<code></td><td>Total size of suppressed API Event documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.api_events.suppressed_count<code></td><td>Number of suppressed API Event documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.device_events.sent_bytes<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.device_events.sent_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.device_events.suppressed_bytes<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.device_events.suppressed_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.dns_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.dns_events.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.dns_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.dns_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.file_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.file_events.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.file_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.file_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.library_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.library_events.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.library_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.library_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.network_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.network_events.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.network_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.network_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.overall.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.overall.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.overall.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.overall.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.process_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.process_events.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.process_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.process_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.registry_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.registry_events.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.registry_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.registry_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.security_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.security_events.sent_count<code></td><td>Number of sent documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.security_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.security_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.volume_device_events.sent_bytes<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.volume_device_events.sent_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.volume_device_events.suppressed_bytes<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.documents_volume.volume_device_events.suppressed_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.event_filter.active_global_count<code></td><td>The number of active global event filters</td></tr>
+<tr><td><code>Endpoint.metrics.event_filter.active_user_count<code></td><td>The number of active user event filters</td></tr>
+<tr><td><code>Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent<code></td><td>Perfect of Endpoint's update spent running the rule</td></tr>
+<tr><td><code>Endpoint.metrics.malicious_behavior_rules.id<code></td><td>The rule id</td></tr>
+<tr><td><code>Endpoint.metrics.memory.endpoint.private.latest<code></td><td>The memory usage by the endpoint for the last sample interval</td></tr>
+<tr><td><code>Endpoint.metrics.memory.endpoint.private.mean<code></td><td>Average memory usage by the endpoint since its start</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.amsi_events.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.amsi_events.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.attack_surface_events.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.attack_surface_events.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.authentication_events.week_idle_ms<code></td><td>The total milliseconds spent queueing authentication events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.authentication_events.week_ms<code></td><td>The total milliseconds spent on authentication events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.behavior_protection.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.behavior_protection.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.cred_access_events.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.cred_access_events.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.dns_events.week_idle_ms<code></td><td>The total milliseconds spent queueing DNS events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.dns_events.week_ms<code></td><td>The total milliseconds spent on DNS events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.file_events.week_idle_ms<code></td><td>The total milliseconds spent queueing file events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.file_events.week_ms<code></td><td>The total milliseconds spent on file events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.kernel_api_events.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.kernel_api_events.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.library_load_events.week_idle_ms<code></td><td>The total milliseconds spent queueing library load events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.library_load_events.week_ms<code></td><td>The total milliseconds spent on library load events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.malware.week_idle_ms<code></td><td>The total milliseconds spent queueing malware scanning due to the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.malware.week_ms<code></td><td>The total milliseconds spent on malware scanning due to the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.memory_scan.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.memory_scan.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.network_events.week_idle_ms<code></td><td>The total milliseconds spent queueing network events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.network_events.week_ms<code></td><td>The total milliseconds spent on network events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.overall.week_idle_ms<code></td><td>The total milliseconds spent queueing activity for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.overall.week_ms<code></td><td>The total milliseconds spent monitoring the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.signing_id<code></td><td>'The identifier used to sign the binary.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.team_id<code></td><td>'The team identifier used to sign the binary.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process.executable<code></td><td>Path to the process executable for the impact entry</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process_events.week_idle_ms<code></td><td>The total milliseconds spent queueing process events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process_events.week_ms<code></td><td>The total milliseconds spent on process events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process_injection.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.process_injection.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.ransomware.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.ransomware.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.registry_events.week_idle_ms<code></td><td>The total milliseconds spent queueing registry events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.registry_events.week_ms<code></td><td>The total milliseconds spent on registry events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.tcpip_events.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.tcpip_events.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms<code></td><td>The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.threat_intelligence_events.week_ms<code></td><td>The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.volume_device_events.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.volume_device_events.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.win32k_events.week_idle_ms<code></td><td>The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.win32k_events.week_ms<code></td><td>The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.wmi_events.week_idle_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.system_impact.wmi_events.week_ms<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.threads.cpu.mean<code></td><td>The thread's average CPU use</td></tr>
+<tr><td><code>Endpoint.metrics.threads.name<code></td><td>The thread name</td></tr>
+<tr><td><code>Endpoint.metrics.top_process_trees.values.event_count<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.top_process_trees.values.last_seen<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.top_process_trees.values.sample.command_line<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.top_process_trees.values.sample.entity_id<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.top_process_trees.values.sample.executable<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.top_process_trees.values.sample.parent_command_line<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.top_process_trees.window_end<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.top_process_trees.window_start<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.metrics.uptime.endpoint<code></td><td>Number of seconds since the endpoint was started</td></tr>
+<tr><td><code>Endpoint.metrics.uptime.system<code></td><td>Number of seconds since the system was started</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md b/scripts/generate-docs/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
new file mode 100644
index 000000000..a4f85bf3d
--- /dev/null
+++ b/scripts/generate-docs/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
@@ -0,0 +1,96 @@
+# Linux Network Connection Attempted, Connection Accepted, and Disconnect
+
+## Description
+
+This event is generated when a network session is accepted, attempted or terminated.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "linux" and event.action : "connection_attempted" or "connection_accepted" or "disconnect_received"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>destination.bytes<code></td><td>Bytes sent from the destination to the source.</td></tr>
+<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>network.direction<code></td><td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td></tr>
+<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>source.bytes<code></td><td>Bytes sent from the source to the destination.</td></tr>
+<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/network/linux/linux_network_dns_lookup_result.md b/scripts/generate-docs/sample_output/network/linux/linux_network_dns_lookup_result.md
new file mode 100644
index 000000000..055b1e734
--- /dev/null
+++ b/scripts/generate-docs/sample_output/network/linux/linux_network_dns_lookup_result.md
@@ -0,0 +1,78 @@
+# Linux DNS Lookup Result
+
+## Description
+
+This event is generated when results are returned for a DNS lookup request.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "linux" and event.action : "lookup_result"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
+<tr><td><code>dns.question.name<code></td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
+<tr><td><code>dns.question.type<code></td><td>The type of record being queried.</td></tr>
+<tr><td><code>dns.resolved_ip<code></td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>network.protocol<code></td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md b/scripts/generate-docs/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
new file mode 100644
index 000000000..c6d2a49ee
--- /dev/null
+++ b/scripts/generate-docs/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
@@ -0,0 +1,94 @@
+# macOS Network Connection Attempted and Disconnect Received
+
+## Description
+
+This event is generated when a connection is attempted or a request to terminate a network connection occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "macos" and event.action : "connection_attempted" or "disconnect_received"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>destination.bytes<code></td><td>Bytes sent from the destination to the source.</td></tr>
+<tr><td><code>destination.domain<code></td><td>The domain name of the destination system.  This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.</td></tr>
+<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>source.bytes<code></td><td>Bytes sent from the source to the destination.</td></tr>
+<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/network/macos/macos_network_dns_lookup_result.md b/scripts/generate-docs/sample_output/network/macos/macos_network_dns_lookup_result.md
new file mode 100644
index 000000000..4d2ffb2c2
--- /dev/null
+++ b/scripts/generate-docs/sample_output/network/macos/macos_network_dns_lookup_result.md
@@ -0,0 +1,97 @@
+# macOS DNS Lookup Result
+
+## Description
+
+This event is generated when results are returned for a DNS lookup request.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "macos" and event.action : "lookup_result"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
+<tr><td><code>dns.Ext.options<code></td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
+<tr><td><code>dns.Ext.status<code></td><td>DNS status field, uint32</td></tr>
+<tr><td><code>dns.question.name<code></td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
+<tr><td><code>dns.question.type<code></td><td>The type of record being queried.</td></tr>
+<tr><td><code>dns.resolved_ip<code></td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>network.protocol<code></td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md b/scripts/generate-docs/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
new file mode 100644
index 000000000..07dbf37dc
--- /dev/null
+++ b/scripts/generate-docs/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
@@ -0,0 +1,90 @@
+# Windows Network Connection Attempted, Connection Accepted and Disconnect Received
+
+## Description
+
+This event is generated when a connection is attempted, a connection is accepted, or a request to terminate a network session is received.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "connection_attempted" or "connection_accepted" or "disconnect_received"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>destination.bytes<code></td><td>Bytes sent from the destination to the source.</td></tr>
+<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>network.direction<code></td><td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td></tr>
+<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
+<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+<tr><td><code>source.bytes<code></td><td>Bytes sent from the source to the destination.</td></tr>
+<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_requested.md b/scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_requested.md
new file mode 100644
index 000000000..78261f412
--- /dev/null
+++ b/scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_requested.md
@@ -0,0 +1,84 @@
+# Windows DNS Lookup Request
+
+## Description
+
+This event is generated when a DNS lookup request is initiated.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "lookup_requested"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
+<tr><td><code>dns.Ext.options<code></td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
+<tr><td><code>dns.Ext.status<code></td><td>DNS status field, uint32</td></tr>
+<tr><td><code>dns.question.name<code></td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>network.destination.port<code></td><td>No description found</td></tr>
+<tr><td><code>network.protocol<code></td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_result.md b/scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_result.md
new file mode 100644
index 000000000..24db62975
--- /dev/null
+++ b/scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_result.md
@@ -0,0 +1,85 @@
+# Windows DNS Lookup Result
+
+## Description
+
+This event is generated when results are returned for a DNS lookup request.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "lookup_result"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
+<tr><td><code>dns.Ext.options<code></td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
+<tr><td><code>dns.Ext.status<code></td><td>DNS status field, uint32</td></tr>
+<tr><td><code>dns.question.name<code></td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
+<tr><td><code>dns.resolved_ip<code></td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>network.destination.port<code></td><td>No description found</td></tr>
+<tr><td><code>network.protocol<code></td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/policy/policy_response.md b/scripts/generate-docs/sample_output/policy/policy_response.md
new file mode 100644
index 000000000..e357c54a8
--- /dev/null
+++ b/scripts/generate-docs/sample_output/policy/policy_response.md
@@ -0,0 +1,113 @@
+# Endpoint Policy Response
+
+## Description
+
+This is a state management document that is generated every time Endpoint refreshes it's policy. It contains details of what Endpoint features are and are not in a healthy state.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux, macOS, Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>metrics-endpoint.policy-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.policy" and event.module : "endpoint" and event.action : "endpoint_policy_response"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Endpoint.configuration.isolation<code></td><td>Configuration setting for Host Isolation from the network</td></tr>
+<tr><td><code>Endpoint.policy.applied.actions.message<code></td><td>message about the application of the action to further qualify the status of the action</td></tr>
+<tr><td><code>Endpoint.policy.applied.actions.name<code></td><td>name of the action that was applied</td></tr>
+<tr><td><code>Endpoint.policy.applied.actions.status<code></td><td>the status of the action</td></tr>
+<tr><td><code>Endpoint.policy.applied.actions.status<code></td><td>the status of the action</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
+<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions<code></td><td>all actions that were taken for antivirus registration</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.antivirus_registration.status<code></td><td>the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions<code></td><td>all actions that were taken for attack surface reduction</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.attack_surface_reduction.status<code></td><td>the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions<code></td><td>all actions that were taken for behavior_protection</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.behavior_protection.status<code></td><td>the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.events.concerned_actions<code></td><td>all actions that were taken for event collection</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.events.status<code></td><td>the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions<code></td><td>all actions that were taken for host isolation</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.host_isolation.status<code></td><td>the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.logging.concerned_actions<code></td><td>all actions that were taken for logging</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.logging.status<code></td><td>the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.malware.concerned_actions<code></td><td>all actions that were taken for malware</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.malware.status<code></td><td>the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions<code></td><td>all actions that were taken for memory_protection</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.memory_protection.status<code></td><td>the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.ransomware.concerned_actions<code></td><td>all actions that were taken for ransomware</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.ransomware.status<code></td><td>the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.response_actions.concerned_actions<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.response_actions.status<code></td><td>No description found</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.streaming.concerned_actions<code></td><td>all actions that were taken for data streaming</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.configurations.streaming.status<code></td><td>the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions<code></td><td>all actions that were taken for the diagnostic configuration of behavior protection</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.diagnostic.behavior_protection.status<code></td><td>the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.diagnostic.malware.concerned_actions<code></td><td>all actions that were taken for the diagnostic configuration of malware</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.diagnostic.malware.status<code></td><td>the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions<code></td><td>all actions that were taken for the diagnostic configuration of memory protection</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.diagnostic.memory_protection.status<code></td><td>the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions<code></td><td>all actions that were taken for the diagnostic configuration of ransomware</td></tr>
+<tr><td><code>Endpoint.policy.applied.response.diagnostic.ransomware.status<code></td><td>the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
+<tr><td><code>Endpoint.policy.applied.status<code></td><td>the status of the applied policy</td></tr>
+<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
+<tr><td><code>Endpoint.state.isolation<code></td><td>Current network isolation state of the host</td></tr>
+<tr><td><code>Endpoint.state.tamper_protection<code></td><td>No description found</td></tr>
+<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_already_running.md b/scripts/generate-docs/sample_output/process/linux/linux_process_already_running.md
new file mode 100644
index 000000000..41f8e3748
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/linux/linux_process_already_running.md
@@ -0,0 +1,214 @@
+# Linux Already Running Process
+
+## Description
+
+This event is generated for a process that was already running before Endpoint's process collection was enabled.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "already_running"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_fork_exec_exit.md b/scripts/generate-docs/sample_output/process/linux/linux_process_fork_exec_exit.md
new file mode 100644
index 000000000..d02188e0b
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/linux/linux_process_fork_exec_exit.md
@@ -0,0 +1,218 @@
+# Linux Process Fork, Exec, and Exit
+
+## Description
+
+This event is generated when a process calls `fork()`, `exec()`, exits, or an aggregation of the previous.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "fork" or "exec" or "end"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
+<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_gid_change.md b/scripts/generate-docs/sample_output/process/linux/linux_process_gid_change.md
new file mode 100644
index 000000000..a887352b8
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/linux/linux_process_gid_change.md
@@ -0,0 +1,216 @@
+# Linux Process Group ID Change
+
+## Description
+
+This event is generated when the group id changes for a process.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "gid_change"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_memfd_create.md b/scripts/generate-docs/sample_output/process/linux/linux_process_memfd_create.md
new file mode 100644
index 000000000..97e3adf5b
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/linux/linux_process_memfd_create.md
@@ -0,0 +1,219 @@
+# Linux memfd Creation Events
+
+## Description
+
+This event is generated when when a memfd anonymous file is created.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "memfd_create"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
+<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+<tr><td><code>process.Ext.memfd.flag_hugetlb<code></td><td>The anonymous file will be created in the hugetlbfs filesystem using huge pages.</td></tr>
+<tr><td><code>process.Ext.memfd.flag_allow_seal<code></td><td>Allow sealing operations on this file.</td></tr>
+<tr><td><code>process.Ext.memfd.flags<code></td><td>Flags passed to the memfd operation.</td></tr>
+<tr><td><code>process.Ext.memfd.name<code></td><td>Filename for the created file. Appears in /proc/self/fd.</td></tr>
+<tr><td><code>process.Ext.memfd.flag_exec<code></td><td>Exec flag is set for file.</td></tr>
+<tr><td><code>process.Ext.memfd.flag_cloexec<code></td><td>Sets the the close-on-exec flag on the new file descriptor.</td></tr>
+<tr><td><code>process.Ext.memfd.flag_noexec_seal<code></td><td>Sets both NOEXEC and MFD_ALLOW_SEALING.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_ptrace.md b/scripts/generate-docs/sample_output/process/linux/linux_process_ptrace.md
new file mode 100644
index 000000000..d8b7fe278
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/linux/linux_process_ptrace.md
@@ -0,0 +1,215 @@
+# Linux ptrace_attach Creation Events
+
+## Description
+
+This event is generated when when a process calls ptrace_attach on another process.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "ptrace"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
+<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+<tr><td><code>process.Ext.ptrace.child_pid<code></td><td>PID of the ptrace target.</td></tr>
+<tr><td><code>process.Ext.ptrace.request<code></td><td>ptrace request.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_session_id_change.md b/scripts/generate-docs/sample_output/process/linux/linux_process_session_id_change.md
new file mode 100644
index 000000000..d4aecea04
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/linux/linux_process_session_id_change.md
@@ -0,0 +1,212 @@
+# Linux Session ID Change
+
+## Description
+
+This event is generated when a process's session id changes.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "session_id_change"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_shmget.md b/scripts/generate-docs/sample_output/process/linux/linux_process_shmget.md
new file mode 100644
index 000000000..4bd6c31f3
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/linux/linux_process_shmget.md
@@ -0,0 +1,215 @@
+# Linux shmget Creation Events
+
+## Description
+
+This event is generated when when a process calls shmget().
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "shmget"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
+<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+<tr><td><code>process.Ext.shmget.size<code></td><td>Requested size.</td></tr>
+<tr><td><code>process.Ext.shmget.flags<code></td><td>flags passed to shmget.</td></tr>
+<tr><td><code>process.Ext.shmget.key<code></td><td>Key passed to the shmget request.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_text_output.md b/scripts/generate-docs/sample_output/process/linux/linux_process_text_output.md
new file mode 100644
index 000000000..7177dd69f
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/linux/linux_process_text_output.md
@@ -0,0 +1,218 @@
+# Linux Process Text Output
+
+## Description
+
+This event is generated when a process generates text output.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "text_output"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.io.bytes_skipped.length<code></td><td>No description found</td></tr>
+<tr><td><code>process.io.bytes_skipped.offset<code></td><td>No description found</td></tr>
+<tr><td><code>process.io.max_bytes_per_process_exceeded<code></td><td>If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.</td></tr>
+<tr><td><code>process.io.text<code></td><td>A chunk of output or input sanitized to UTF-8.  Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.</td></tr>
+<tr><td><code>process.io.total_bytes_captured<code></td><td>The total number of bytes captured in this event.</td></tr>
+<tr><td><code>process.io.total_bytes_skipped<code></td><td>The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero</td></tr>
+<tr><td><code>process.io.type<code></td><td>No description found</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.tty.columns<code></td><td>The number of character columns per line. e.g terminal width  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td></tr>
+<tr><td><code>process.tty.rows<code></td><td>The number of character rows in the terminal. e.g terminal height  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_uid_change.md b/scripts/generate-docs/sample_output/process/linux/linux_process_uid_change.md
new file mode 100644
index 000000000..d922b3840
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/linux/linux_process_uid_change.md
@@ -0,0 +1,216 @@
+# Linux Process User ID Change
+
+## Description
+
+This event is generated when the user id changes for a process.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "uid_change"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
+<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
+<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
+<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
+<tr><td><code>container.name<code></td><td>Container name.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
+<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
+<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
+<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
+<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
+<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/macos/macos_process_already_running.md b/scripts/generate-docs/sample_output/process/macos/macos_process_already_running.md
new file mode 100644
index 000000000..a179eb957
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/macos/macos_process_already_running.md
@@ -0,0 +1,93 @@
+# macOS Already Running Process
+
+## Description
+
+This event is generated for a process that was already running before Endpoint's process event collection was enabled.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "already_running"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.effective_parent.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/macos/macos_process_fork_exec_exit.md b/scripts/generate-docs/sample_output/process/macos/macos_process_fork_exec_exit.md
new file mode 100644
index 000000000..54eadfa71
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/macos/macos_process_fork_exec_exit.md
@@ -0,0 +1,111 @@
+# macOS Process Fork, Exec, and Exit
+
+## Description
+
+This event is generated when a process calls `fork()`, `exec()`, or exits.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "fork" or "exec" or "end"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>Target.process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.effective_parent.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>process.Ext.effective_parent.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>process.Ext.effective_parent.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>process.Ext.effective_parent.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
+<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/macos/macos_process_remote_thread.md b/scripts/generate-docs/sample_output/process/macos/macos_process_remote_thread.md
new file mode 100644
index 000000000..044aa13a6
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/macos/macos_process_remote_thread.md
@@ -0,0 +1,106 @@
+# macOS Remote Thread
+
+## Description
+
+This event is generated when a remote thread is created.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "remote_thread"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>Target.process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>Target.process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
+<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.effective_parent.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
+<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/windows/windows_process_already_running.md b/scripts/generate-docs/sample_output/process/windows/windows_process_already_running.md
new file mode 100644
index 000000000..bbbe6b9eb
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/windows/windows_process_already_running.md
@@ -0,0 +1,118 @@
+# Windows Already Running Process
+
+## Description
+
+This event is generated for a process that was already running before Endpoint's process collection was enabled.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "windows" and event.action : "already_running"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.mitigation_policies<code></td><td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.relative_file_creation_time<code></td><td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
+<tr><td><code>process.Ext.session_info.authentication_package<code></td><td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td></tr>
+<tr><td><code>process.Ext.session_info.client_address<code></td><td>Client's IPv4 or IPv6 address as a string, if available.</td></tr>
+<tr><td><code>process.Ext.session_info.id<code></td><td>Session ID</td></tr>
+<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+<tr><td><code>process.Ext.session_info.relative_logon_time<code></td><td>Process creation time, relative to logon time, in seconds.</td></tr>
+<tr><td><code>process.Ext.session_info.relative_password_age<code></td><td>Process creation time, relative to the last time the password was changed, in seconds.</td></tr>
+<tr><td><code>process.Ext.session_info.user_flags<code></td><td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td></tr>
+<tr><td><code>process.Ext.token.elevation_level<code></td><td>What level of elevation the token has</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.Ext.token.security_attributes<code></td><td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.pe.imphash<code></td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
+<tr><td><code>process.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/process/windows/windows_process_create_and_exit.md b/scripts/generate-docs/sample_output/process/windows/windows_process_create_and_exit.md
new file mode 100644
index 000000000..a54aef63b
--- /dev/null
+++ b/scripts/generate-docs/sample_output/process/windows/windows_process_create_and_exit.md
@@ -0,0 +1,143 @@
+# Windows Process Create And Exit
+
+## Description
+
+This event is generated when a process is created or exits.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "windows" and event.action : "start" or "end"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.created_suspended<code></td><td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td></tr>
+<tr><td><code>process.Ext.defense_evasions<code></td><td>List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping.</td></tr>
+<tr><td><code>process.Ext.device.bus_type<code></td><td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td></tr>
+<tr><td><code>process.Ext.device.dos_name<code></td><td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td></tr>
+<tr><td><code>process.Ext.device.file_system_type<code></td><td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td></tr>
+<tr><td><code>process.Ext.device.nt_name<code></td><td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td></tr>
+<tr><td><code>process.Ext.device.product_id<code></td><td>ProductID of the device. It is provided by the vendor of the device if any.</td></tr>
+<tr><td><code>process.Ext.device.vendor_id<code></td><td>VendorID of the device. It is provided by the vendor of the device.</td></tr>
+<tr><td><code>process.Ext.device.volume_device_type<code></td><td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td></tr>
+<tr><td><code>process.Ext.effective_parent.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>process.Ext.effective_parent.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>process.Ext.effective_parent.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>process.Ext.effective_parent.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>process.Ext.mitigation_policies<code></td><td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td></tr>
+<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+<tr><td><code>process.Ext.relative_file_creation_time<code></td><td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
+<tr><td><code>process.Ext.relative_file_name_modify_time<code></td><td>Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td></tr>
+<tr><td><code>process.Ext.session_info.authentication_package<code></td><td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td></tr>
+<tr><td><code>process.Ext.session_info.client_address<code></td><td>Client's IPv4 or IPv6 address as a string, if available.</td></tr>
+<tr><td><code>process.Ext.session_info.id<code></td><td>Session ID</td></tr>
+<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+<tr><td><code>process.Ext.session_info.relative_logon_time<code></td><td>Process creation time, relative to logon time, in seconds.</td></tr>
+<tr><td><code>process.Ext.session_info.relative_password_age<code></td><td>Process creation time, relative to the last time the password was changed, in seconds.</td></tr>
+<tr><td><code>process.Ext.session_info.user_flags<code></td><td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td></tr>
+<tr><td><code>process.Ext.token.elevation_level<code></td><td>What level of elevation the token has</td></tr>
+<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
+<tr><td><code>process.Ext.token.security_attributes<code></td><td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td></tr>
+<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
+<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
+<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
+<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.Ext.real.entity_id<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.Ext.real.pid<code></td><td>For process.parent this will be the ppid of the process that actually spawned the current process.</td></tr>
+<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
+<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.parent.thread.Ext.call_stack.callsite_leading_bytes<code></td><td>Hex opcode bytes preceding the callsite</td></tr>
+<tr><td><code>process.parent.thread.Ext.call_stack.callsite_trailing_bytes<code></td><td>Hex opcode bytes after the callsite (where control will return to)</td></tr>
+<tr><td><code>process.parent.thread.Ext.call_stack.protection<code></td><td>Protection of the page containing this instruction.  This is `R-X' by default if omitted.</td></tr>
+<tr><td><code>process.parent.thread.Ext.call_stack.symbol_info<code></td><td>The nearest symbol for `instruction_pointer`.</td></tr>
+<tr><td><code>process.parent.thread.Ext.call_stack_contains_unbacked<code></td><td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td></tr>
+<tr><td><code>process.parent.thread.Ext.call_stack_summary<code></td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
+<tr><td><code>process.pe.imphash<code></td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
+<tr><td><code>process.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/registry/windows/windows_registry_modification.md b/scripts/generate-docs/sample_output/registry/windows/windows_registry_modification.md
new file mode 100644
index 000000000..0b08810e8
--- /dev/null
+++ b/scripts/generate-docs/sample_output/registry/windows/windows_registry_modification.md
@@ -0,0 +1,89 @@
+# Windows Registry Modification
+
+## Description
+
+This event is generated when the registry is modified.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.registry-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.registry" and event.module : "endpoint" and host.os.type : "windows" and event.action : "modification"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>registry.data.bytes<code></td><td>Original bytes written with base64 encoding.  For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.</td></tr>
+<tr><td><code>registry.data.strings<code></td><td>Content when writing string types.  Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).</td></tr>
+<tr><td><code>registry.data.type<code></td><td>Standard registry type for encoding contents</td></tr>
+<tr><td><code>registry.hive<code></td><td>Abbreviated name for the hive.</td></tr>
+<tr><td><code>registry.key<code></td><td>Hive-relative path of keys.</td></tr>
+<tr><td><code>registry.path<code></td><td>Full path, including hive, key and value</td></tr>
+<tr><td><code>registry.value<code></td><td>Name of the value written.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/registry/windows/windows_registry_query.md b/scripts/generate-docs/sample_output/registry/windows/windows_registry_query.md
new file mode 100644
index 000000000..c0dce2bb0
--- /dev/null
+++ b/scripts/generate-docs/sample_output/registry/windows/windows_registry_query.md
@@ -0,0 +1,87 @@
+# Windows Registry Query
+
+## Description
+
+This event is generated when the Windows registry is queried.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.registry-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.registry" and event.module : "endpoint" and host.os.type : "windows" and event.action : "query"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
+<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
+<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
+<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>registry.data.type<code></td><td>Standard registry type for encoding contents</td></tr>
+<tr><td><code>registry.hive<code></td><td>Abbreviated name for the hive.</td></tr>
+<tr><td><code>registry.key<code></td><td>Hive-relative path of keys.</td></tr>
+<tr><td><code>registry.path<code></td><td>Full path, including hive, key and value</td></tr>
+<tr><td><code>registry.value<code></td><td>Name of the value written.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/security/macos/macos_security_gatekeeper_override.md b/scripts/generate-docs/sample_output/security/macos/macos_security_gatekeeper_override.md
new file mode 100644
index 000000000..0c198f700
--- /dev/null
+++ b/scripts/generate-docs/sample_output/security/macos/macos_security_gatekeeper_override.md
@@ -0,0 +1,93 @@
+# macOS Gatekeeper Override Exception
+
+## Description
+
+This event is generated when a user grants a gatekeeper exception
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "gatekeeper_override"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>file.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>file.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
+<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
+<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/security/macos/macos_security_log_on.md b/scripts/generate-docs/sample_output/security/macos/macos_security_log_on.md
new file mode 100644
index 000000000..5ddf4bdb7
--- /dev/null
+++ b/scripts/generate-docs/sample_output/security/macos/macos_security_log_on.md
@@ -0,0 +1,90 @@
+# macOS User Log On
+
+## Description
+
+This event is generated when a user logs on to the computer.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "log_on"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
+<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
+<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/security/macos/macos_security_rdp_log_on.md b/scripts/generate-docs/sample_output/security/macos/macos_security_rdp_log_on.md
new file mode 100644
index 000000000..418dd949c
--- /dev/null
+++ b/scripts/generate-docs/sample_output/security/macos/macos_security_rdp_log_on.md
@@ -0,0 +1,90 @@
+# macOS Screensharing Log On
+
+## Description
+
+This event is generated when a user logs on to the computer with screensharing.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "rdp_log_on"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
+<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
+<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/security/macos/macos_security_ssh_log_on.md b/scripts/generate-docs/sample_output/security/macos/macos_security_ssh_log_on.md
new file mode 100644
index 000000000..9e04138a0
--- /dev/null
+++ b/scripts/generate-docs/sample_output/security/macos/macos_security_ssh_log_on.md
@@ -0,0 +1,90 @@
+# macOS SSH Log On
+
+## Description
+
+This event is generated when a user logs on to the computer with SSH.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "ssh_log_on"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
+<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
+<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/security/windows/windows_security_log_off.md b/scripts/generate-docs/sample_output/security/windows/windows_security_log_off.md
new file mode 100644
index 000000000..67597fab7
--- /dev/null
+++ b/scripts/generate-docs/sample_output/security/windows/windows_security_log_off.md
@@ -0,0 +1,85 @@
+# Windows User Log Off
+
+## Description
+
+This event is generated when a user logs off of the computer.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "windows" and event.action : "log_off"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
+<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
+<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/security/windows/windows_security_log_on.md b/scripts/generate-docs/sample_output/security/windows/windows_security_log_on.md
new file mode 100644
index 000000000..bed4f54f9
--- /dev/null
+++ b/scripts/generate-docs/sample_output/security/windows/windows_security_log_on.md
@@ -0,0 +1,88 @@
+# Windows User Log On
+
+## Description
+
+This event is generated when a user logs on to the computer.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "windows" and event.action : "log_on"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
+<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
+<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>winlog.event_data.PrivilegeList<code></td><td>An array of sensitive privileges, assigned to the new logon.</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_mount.md b/scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_mount.md
new file mode 100644
index 000000000..90b49fec9
--- /dev/null
+++ b/scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_mount.md
@@ -0,0 +1,86 @@
+# Windows Device Mount
+
+## Description
+
+This event is generated when a device is mounted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.volume_device-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.volume_device" and event.module : "endpoint" and host.os.type : "windows" and event.action : "mount"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
+<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>volume.bus_type<code></td><td>No description found</td></tr>
+<tr><td><code>volume.device_type<code></td><td>No description found</td></tr>
+<tr><td><code>volume.dos_name<code></td><td>No description found</td></tr>
+<tr><td><code>volume.file_system_type<code></td><td>No description found</td></tr>
+<tr><td><code>volume.nt_name<code></td><td>No description found</td></tr>
+<tr><td><code>volume.product_name<code></td><td>No description found</td></tr>
+<tr><td><code>volume.serial_number<code></td><td>No description found</td></tr>
+<tr><td><code>volume.vendor_name<code></td><td>No description found</td></tr>
+</table>
diff --git a/scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_unmount.md b/scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_unmount.md
new file mode 100644
index 000000000..a1e5a1f42
--- /dev/null
+++ b/scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_unmount.md
@@ -0,0 +1,77 @@
+# Windows Device Unmount
+
+## Description
+
+This event is generated when a device is unmounted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.volume_device-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.volume_device" and event.module : "endpoint" and host.os.type : "windows" and event.action : "unmount"</code></td>
+</tr>
+</table>
+
+## Fields
+
+<table>
+<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
+<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
+<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
+<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
+<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
+<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
+<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
+<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
+<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
+<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><td><code>volume.bus_type<code></td><td>No description found</td></tr>
+<tr><td><code>volume.device_type<code></td><td>No description found</td></tr>
+<tr><td><code>volume.dos_name<code></td><td>No description found</td></tr>
+<tr><td><code>volume.file_system_type<code></td><td>No description found</td></tr>
+<tr><td><code>volume.nt_name<code></td><td>No description found</td></tr>
+<tr><td><code>volume.product_name<code></td><td>No description found</td></tr>
+<tr><td><code>volume.serial_number<code></td><td>No description found</td></tr>
+<tr><td><code>volume.vendor_name<code></td><td>No description found</td></tr>
+</table>

From 16b62ba392d28cbf63ebc6c179e87ba96694b63d Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Tue, 25 Mar 2025 22:08:00 +0000
Subject: [PATCH 10/25] move the samples

---
 .../sample_output/alerts/linux/linux_malicious_behavior_alert.md  | 0
 .../doc}/sample_output/alerts/linux/linux_malware_alert.md        | 0
 .../doc}/sample_output/alerts/linux/linux_memory_threat_alert.md  | 0
 .../sample_output/alerts/macos/macos_malicious_behavior_alert.md  | 0
 .../doc}/sample_output/alerts/macos/macos_malware_alert.md        | 0
 .../doc}/sample_output/alerts/macos/macos_memory_threat_alert.md  | 0
 .../alerts/windows/windows_malicious_behavior_alert.md            | 0
 .../doc}/sample_output/alerts/windows/windows_malware_alert.md    | 0
 .../sample_output/alerts/windows/windows_memory_threat_alert.md   | 0
 .../doc}/sample_output/alerts/windows/windows_ransomware_alert.md | 0
 .../doc}/sample_output/alerts/windows/windows_shellcode_thread.md | 0
 .../doc}/sample_output/api/windows/windows_api_amsi.md            | 0
 .../doc}/sample_output/api/windows/windows_api_asm.md             | 0
 .../sample_output/api/windows/windows_api_credential_access.md    | 0
 .../doc}/sample_output/api/windows/windows_api_kernel_audit.md    | 0
 .../doc}/sample_output/api/windows/windows_api_tcpip.md           | 0
 .../sample_output/api/windows/windows_api_threat_intelligence.md  | 0
 .../doc}/sample_output/api/windows/windows_api_win32k.md          | 0
 .../doc}/sample_output/api/windows/windows_api_wmi.md             | 0
 .../doc}/sample_output/file/linux/linux_file_create.md            | 0
 .../doc}/sample_output/file/linux/linux_file_delete.md            | 0
 .../sample_output/file/linux/linux_file_endpoint_unquarantine.md  | 0
 .../doc}/sample_output/file/linux/linux_file_rename.md            | 0
 .../doc}/sample_output/file/macos/macos_file_access.md            | 0
 .../doc}/sample_output/file/macos/macos_file_delete.md            | 0
 .../sample_output/file/macos/macos_file_endpoint_unquarantine.md  | 0
 .../file/macos/macos_file_extended_attributes_delete.md           | 0
 .../doc}/sample_output/file/macos/macos_file_launch_daemon.md     | 0
 .../doc}/sample_output/file/macos/macos_file_modification.md      | 0
 .../doc}/sample_output/file/macos/macos_file_mount.md             | 0
 .../doc}/sample_output/file/macos/macos_file_rename.md            | 0
 .../doc}/sample_output/file/windows/windows_file_create.md        | 0
 .../doc}/sample_output/file/windows/windows_file_delete.md        | 0
 .../file/windows/windows_file_endpoint_unquarantine.md            | 0
 .../doc}/sample_output/file/windows/windows_file_modification.md  | 0
 .../doc}/sample_output/file/windows/windows_file_open.md          | 0
 .../doc}/sample_output/file/windows/windows_file_overwrite.md     | 0
 .../doc}/sample_output/file/windows/windows_file_rename.md        | 0
 .../doc}/sample_output/library/macos/macos_library_load.md        | 0
 .../doc}/sample_output/library/windows/windows_library_load.md    | 0
 .../doc}/sample_output/metadata/metadata.md                       | 0
 .../doc}/sample_output/metrics/metrics.md                         | 0
 .../linux/linux_network_attempted_accepted_and_disconnect.md      | 0
 .../network/linux/linux_network_dns_lookup_result.md              | 0
 .../macos/macos_network_connection_attempted_and_disconnect.md    | 0
 .../network/macos/macos_network_dns_lookup_result.md              | 0
 .../windows/windows_network_attempted_accepted_and_disconnect.md  | 0
 .../network/windows/windows_network_dns_lookup_requested.md       | 0
 .../network/windows/windows_network_dns_lookup_result.md          | 0
 .../doc}/sample_output/policy/policy_response.md                  | 0
 .../sample_output/process/linux/linux_process_already_running.md  | 0
 .../sample_output/process/linux/linux_process_fork_exec_exit.md   | 0
 .../doc}/sample_output/process/linux/linux_process_gid_change.md  | 0
 .../sample_output/process/linux/linux_process_memfd_create.md     | 0
 .../doc}/sample_output/process/linux/linux_process_ptrace.md      | 0
 .../process/linux/linux_process_session_id_change.md              | 0
 .../doc}/sample_output/process/linux/linux_process_shmget.md      | 0
 .../doc}/sample_output/process/linux/linux_process_text_output.md | 0
 .../doc}/sample_output/process/linux/linux_process_uid_change.md  | 0
 .../sample_output/process/macos/macos_process_already_running.md  | 0
 .../sample_output/process/macos/macos_process_fork_exec_exit.md   | 0
 .../sample_output/process/macos/macos_process_remote_thread.md    | 0
 .../process/windows/windows_process_already_running.md            | 0
 .../process/windows/windows_process_create_and_exit.md            | 0
 .../registry/windows/windows_registry_modification.md             | 0
 .../doc}/sample_output/registry/windows/windows_registry_query.md | 0
 .../security/macos/macos_security_gatekeeper_override.md          | 0
 .../doc}/sample_output/security/macos/macos_security_log_on.md    | 0
 .../sample_output/security/macos/macos_security_rdp_log_on.md     | 0
 .../sample_output/security/macos/macos_security_ssh_log_on.md     | 0
 .../sample_output/security/windows/windows_security_log_off.md    | 0
 .../sample_output/security/windows/windows_security_log_on.md     | 0
 .../volume_device/windows/windows_volume_device_mount.md          | 0
 .../volume_device/windows/windows_volume_device_unmount.md        | 0
 74 files changed, 0 insertions(+), 0 deletions(-)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/linux/linux_malicious_behavior_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/linux/linux_malware_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/linux/linux_memory_threat_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/macos/macos_malicious_behavior_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/macos/macos_malware_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/macos/macos_memory_threat_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/windows/windows_malicious_behavior_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/windows/windows_malware_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/windows/windows_memory_threat_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/windows/windows_ransomware_alert.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/alerts/windows/windows_shellcode_thread.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/api/windows/windows_api_amsi.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/api/windows/windows_api_asm.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/api/windows/windows_api_credential_access.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/api/windows/windows_api_kernel_audit.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/api/windows/windows_api_tcpip.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/api/windows/windows_api_threat_intelligence.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/api/windows/windows_api_win32k.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/api/windows/windows_api_wmi.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/linux/linux_file_create.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/linux/linux_file_delete.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/linux/linux_file_endpoint_unquarantine.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/linux/linux_file_rename.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/macos/macos_file_access.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/macos/macos_file_delete.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/macos/macos_file_endpoint_unquarantine.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/macos/macos_file_extended_attributes_delete.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/macos/macos_file_launch_daemon.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/macos/macos_file_modification.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/macos/macos_file_mount.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/macos/macos_file_rename.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/windows/windows_file_create.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/windows/windows_file_delete.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/windows/windows_file_endpoint_unquarantine.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/windows/windows_file_modification.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/windows/windows_file_open.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/windows/windows_file_overwrite.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/file/windows/windows_file_rename.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/library/macos/macos_library_load.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/library/windows/windows_library_load.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/metadata/metadata.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/metrics/metrics.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/network/linux/linux_network_dns_lookup_result.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/network/macos/macos_network_dns_lookup_result.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/network/windows/windows_network_dns_lookup_requested.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/network/windows/windows_network_dns_lookup_result.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/policy/policy_response.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/linux/linux_process_already_running.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/linux/linux_process_fork_exec_exit.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/linux/linux_process_gid_change.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/linux/linux_process_memfd_create.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/linux/linux_process_ptrace.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/linux/linux_process_session_id_change.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/linux/linux_process_shmget.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/linux/linux_process_text_output.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/linux/linux_process_uid_change.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/macos/macos_process_already_running.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/macos/macos_process_fork_exec_exit.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/macos/macos_process_remote_thread.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/windows/windows_process_already_running.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/process/windows/windows_process_create_and_exit.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/registry/windows/windows_registry_modification.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/registry/windows/windows_registry_query.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/security/macos/macos_security_gatekeeper_override.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/security/macos/macos_security_log_on.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/security/macos/macos_security_rdp_log_on.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/security/macos/macos_security_ssh_log_on.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/security/windows/windows_security_log_off.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/security/windows/windows_security_log_on.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/volume_device/windows/windows_volume_device_mount.md (100%)
 rename {scripts/generate-docs => custom_documentation/doc}/sample_output/volume_device/windows/windows_volume_device_unmount.md (100%)

diff --git a/scripts/generate-docs/sample_output/alerts/linux/linux_malicious_behavior_alert.md b/custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/linux/linux_malicious_behavior_alert.md
rename to custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/linux/linux_malware_alert.md b/custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/linux/linux_malware_alert.md
rename to custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/linux/linux_memory_threat_alert.md b/custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/linux/linux_memory_threat_alert.md
rename to custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/macos/macos_malicious_behavior_alert.md b/custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/macos/macos_malicious_behavior_alert.md
rename to custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/macos/macos_malware_alert.md b/custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/macos/macos_malware_alert.md
rename to custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/macos/macos_memory_threat_alert.md b/custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/macos/macos_memory_threat_alert.md
rename to custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_malicious_behavior_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/windows/windows_malicious_behavior_alert.md
rename to custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_malware_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/windows/windows_malware_alert.md
rename to custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_memory_threat_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/windows/windows_memory_threat_alert.md
rename to custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_ransomware_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/windows/windows_ransomware_alert.md
rename to custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md
diff --git a/scripts/generate-docs/sample_output/alerts/windows/windows_shellcode_thread.md b/custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md
similarity index 100%
rename from scripts/generate-docs/sample_output/alerts/windows/windows_shellcode_thread.md
rename to custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_amsi.md b/custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md
similarity index 100%
rename from scripts/generate-docs/sample_output/api/windows/windows_api_amsi.md
rename to custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_asm.md b/custom_documentation/doc/sample_output/api/windows/windows_api_asm.md
similarity index 100%
rename from scripts/generate-docs/sample_output/api/windows/windows_api_asm.md
rename to custom_documentation/doc/sample_output/api/windows/windows_api_asm.md
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_credential_access.md b/custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md
similarity index 100%
rename from scripts/generate-docs/sample_output/api/windows/windows_api_credential_access.md
rename to custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_kernel_audit.md b/custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md
similarity index 100%
rename from scripts/generate-docs/sample_output/api/windows/windows_api_kernel_audit.md
rename to custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_tcpip.md b/custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md
similarity index 100%
rename from scripts/generate-docs/sample_output/api/windows/windows_api_tcpip.md
rename to custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_threat_intelligence.md b/custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md
similarity index 100%
rename from scripts/generate-docs/sample_output/api/windows/windows_api_threat_intelligence.md
rename to custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_win32k.md b/custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md
similarity index 100%
rename from scripts/generate-docs/sample_output/api/windows/windows_api_win32k.md
rename to custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md
diff --git a/scripts/generate-docs/sample_output/api/windows/windows_api_wmi.md b/custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md
similarity index 100%
rename from scripts/generate-docs/sample_output/api/windows/windows_api_wmi.md
rename to custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md
diff --git a/scripts/generate-docs/sample_output/file/linux/linux_file_create.md b/custom_documentation/doc/sample_output/file/linux/linux_file_create.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/linux/linux_file_create.md
rename to custom_documentation/doc/sample_output/file/linux/linux_file_create.md
diff --git a/scripts/generate-docs/sample_output/file/linux/linux_file_delete.md b/custom_documentation/doc/sample_output/file/linux/linux_file_delete.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/linux/linux_file_delete.md
rename to custom_documentation/doc/sample_output/file/linux/linux_file_delete.md
diff --git a/scripts/generate-docs/sample_output/file/linux/linux_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/linux/linux_file_endpoint_unquarantine.md
rename to custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md
diff --git a/scripts/generate-docs/sample_output/file/linux/linux_file_rename.md b/custom_documentation/doc/sample_output/file/linux/linux_file_rename.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/linux/linux_file_rename.md
rename to custom_documentation/doc/sample_output/file/linux/linux_file_rename.md
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_access.md b/custom_documentation/doc/sample_output/file/macos/macos_file_access.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/macos/macos_file_access.md
rename to custom_documentation/doc/sample_output/file/macos/macos_file_access.md
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_delete.md b/custom_documentation/doc/sample_output/file/macos/macos_file_delete.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/macos/macos_file_delete.md
rename to custom_documentation/doc/sample_output/file/macos/macos_file_delete.md
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/macos/macos_file_endpoint_unquarantine.md
rename to custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_extended_attributes_delete.md b/custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/macos/macos_file_extended_attributes_delete.md
rename to custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_launch_daemon.md b/custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/macos/macos_file_launch_daemon.md
rename to custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_modification.md b/custom_documentation/doc/sample_output/file/macos/macos_file_modification.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/macos/macos_file_modification.md
rename to custom_documentation/doc/sample_output/file/macos/macos_file_modification.md
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_mount.md b/custom_documentation/doc/sample_output/file/macos/macos_file_mount.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/macos/macos_file_mount.md
rename to custom_documentation/doc/sample_output/file/macos/macos_file_mount.md
diff --git a/scripts/generate-docs/sample_output/file/macos/macos_file_rename.md b/custom_documentation/doc/sample_output/file/macos/macos_file_rename.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/macos/macos_file_rename.md
rename to custom_documentation/doc/sample_output/file/macos/macos_file_rename.md
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_create.md b/custom_documentation/doc/sample_output/file/windows/windows_file_create.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/windows/windows_file_create.md
rename to custom_documentation/doc/sample_output/file/windows/windows_file_create.md
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_delete.md b/custom_documentation/doc/sample_output/file/windows/windows_file_delete.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/windows/windows_file_delete.md
rename to custom_documentation/doc/sample_output/file/windows/windows_file_delete.md
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/windows/windows_file_endpoint_unquarantine.md
rename to custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_modification.md b/custom_documentation/doc/sample_output/file/windows/windows_file_modification.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/windows/windows_file_modification.md
rename to custom_documentation/doc/sample_output/file/windows/windows_file_modification.md
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_open.md b/custom_documentation/doc/sample_output/file/windows/windows_file_open.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/windows/windows_file_open.md
rename to custom_documentation/doc/sample_output/file/windows/windows_file_open.md
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_overwrite.md b/custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/windows/windows_file_overwrite.md
rename to custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md
diff --git a/scripts/generate-docs/sample_output/file/windows/windows_file_rename.md b/custom_documentation/doc/sample_output/file/windows/windows_file_rename.md
similarity index 100%
rename from scripts/generate-docs/sample_output/file/windows/windows_file_rename.md
rename to custom_documentation/doc/sample_output/file/windows/windows_file_rename.md
diff --git a/scripts/generate-docs/sample_output/library/macos/macos_library_load.md b/custom_documentation/doc/sample_output/library/macos/macos_library_load.md
similarity index 100%
rename from scripts/generate-docs/sample_output/library/macos/macos_library_load.md
rename to custom_documentation/doc/sample_output/library/macos/macos_library_load.md
diff --git a/scripts/generate-docs/sample_output/library/windows/windows_library_load.md b/custom_documentation/doc/sample_output/library/windows/windows_library_load.md
similarity index 100%
rename from scripts/generate-docs/sample_output/library/windows/windows_library_load.md
rename to custom_documentation/doc/sample_output/library/windows/windows_library_load.md
diff --git a/scripts/generate-docs/sample_output/metadata/metadata.md b/custom_documentation/doc/sample_output/metadata/metadata.md
similarity index 100%
rename from scripts/generate-docs/sample_output/metadata/metadata.md
rename to custom_documentation/doc/sample_output/metadata/metadata.md
diff --git a/scripts/generate-docs/sample_output/metrics/metrics.md b/custom_documentation/doc/sample_output/metrics/metrics.md
similarity index 100%
rename from scripts/generate-docs/sample_output/metrics/metrics.md
rename to custom_documentation/doc/sample_output/metrics/metrics.md
diff --git a/scripts/generate-docs/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
similarity index 100%
rename from scripts/generate-docs/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
rename to custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
diff --git a/scripts/generate-docs/sample_output/network/linux/linux_network_dns_lookup_result.md b/custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md
similarity index 100%
rename from scripts/generate-docs/sample_output/network/linux/linux_network_dns_lookup_result.md
rename to custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md
diff --git a/scripts/generate-docs/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md b/custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
similarity index 100%
rename from scripts/generate-docs/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
rename to custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
diff --git a/scripts/generate-docs/sample_output/network/macos/macos_network_dns_lookup_result.md b/custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md
similarity index 100%
rename from scripts/generate-docs/sample_output/network/macos/macos_network_dns_lookup_result.md
rename to custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md
diff --git a/scripts/generate-docs/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
similarity index 100%
rename from scripts/generate-docs/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
rename to custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
diff --git a/scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_requested.md b/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md
similarity index 100%
rename from scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_requested.md
rename to custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md
diff --git a/scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_result.md b/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md
similarity index 100%
rename from scripts/generate-docs/sample_output/network/windows/windows_network_dns_lookup_result.md
rename to custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md
diff --git a/scripts/generate-docs/sample_output/policy/policy_response.md b/custom_documentation/doc/sample_output/policy/policy_response.md
similarity index 100%
rename from scripts/generate-docs/sample_output/policy/policy_response.md
rename to custom_documentation/doc/sample_output/policy/policy_response.md
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_already_running.md b/custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/linux/linux_process_already_running.md
rename to custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_fork_exec_exit.md b/custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/linux/linux_process_fork_exec_exit.md
rename to custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_gid_change.md b/custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/linux/linux_process_gid_change.md
rename to custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_memfd_create.md b/custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/linux/linux_process_memfd_create.md
rename to custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_ptrace.md b/custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/linux/linux_process_ptrace.md
rename to custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_session_id_change.md b/custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/linux/linux_process_session_id_change.md
rename to custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_shmget.md b/custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/linux/linux_process_shmget.md
rename to custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_text_output.md b/custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/linux/linux_process_text_output.md
rename to custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md
diff --git a/scripts/generate-docs/sample_output/process/linux/linux_process_uid_change.md b/custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/linux/linux_process_uid_change.md
rename to custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md
diff --git a/scripts/generate-docs/sample_output/process/macos/macos_process_already_running.md b/custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/macos/macos_process_already_running.md
rename to custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md
diff --git a/scripts/generate-docs/sample_output/process/macos/macos_process_fork_exec_exit.md b/custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/macos/macos_process_fork_exec_exit.md
rename to custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md
diff --git a/scripts/generate-docs/sample_output/process/macos/macos_process_remote_thread.md b/custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/macos/macos_process_remote_thread.md
rename to custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md
diff --git a/scripts/generate-docs/sample_output/process/windows/windows_process_already_running.md b/custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/windows/windows_process_already_running.md
rename to custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md
diff --git a/scripts/generate-docs/sample_output/process/windows/windows_process_create_and_exit.md b/custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md
similarity index 100%
rename from scripts/generate-docs/sample_output/process/windows/windows_process_create_and_exit.md
rename to custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md
diff --git a/scripts/generate-docs/sample_output/registry/windows/windows_registry_modification.md b/custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md
similarity index 100%
rename from scripts/generate-docs/sample_output/registry/windows/windows_registry_modification.md
rename to custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md
diff --git a/scripts/generate-docs/sample_output/registry/windows/windows_registry_query.md b/custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md
similarity index 100%
rename from scripts/generate-docs/sample_output/registry/windows/windows_registry_query.md
rename to custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md
diff --git a/scripts/generate-docs/sample_output/security/macos/macos_security_gatekeeper_override.md b/custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md
similarity index 100%
rename from scripts/generate-docs/sample_output/security/macos/macos_security_gatekeeper_override.md
rename to custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md
diff --git a/scripts/generate-docs/sample_output/security/macos/macos_security_log_on.md b/custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md
similarity index 100%
rename from scripts/generate-docs/sample_output/security/macos/macos_security_log_on.md
rename to custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md
diff --git a/scripts/generate-docs/sample_output/security/macos/macos_security_rdp_log_on.md b/custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md
similarity index 100%
rename from scripts/generate-docs/sample_output/security/macos/macos_security_rdp_log_on.md
rename to custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md
diff --git a/scripts/generate-docs/sample_output/security/macos/macos_security_ssh_log_on.md b/custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md
similarity index 100%
rename from scripts/generate-docs/sample_output/security/macos/macos_security_ssh_log_on.md
rename to custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md
diff --git a/scripts/generate-docs/sample_output/security/windows/windows_security_log_off.md b/custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md
similarity index 100%
rename from scripts/generate-docs/sample_output/security/windows/windows_security_log_off.md
rename to custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md
diff --git a/scripts/generate-docs/sample_output/security/windows/windows_security_log_on.md b/custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md
similarity index 100%
rename from scripts/generate-docs/sample_output/security/windows/windows_security_log_on.md
rename to custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md
diff --git a/scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_mount.md b/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md
similarity index 100%
rename from scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_mount.md
rename to custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md
diff --git a/scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_unmount.md b/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md
similarity index 100%
rename from scripts/generate-docs/sample_output/volume_device/windows/windows_volume_device_unmount.md
rename to custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md

From 645575d8898c93f28ea7e09828f21177a9b527c5 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Tue, 25 Mar 2025 22:09:48 +0000
Subject: [PATCH 11/25] sample readme

---
 custom_documentation/doc/sample_output/README.md | 12 ++++++++++++
 1 file changed, 12 insertions(+)
 create mode 100644 custom_documentation/doc/sample_output/README.md

diff --git a/custom_documentation/doc/sample_output/README.md b/custom_documentation/doc/sample_output/README.md
new file mode 100644
index 000000000..5d024aeab
--- /dev/null
+++ b/custom_documentation/doc/sample_output/README.md
@@ -0,0 +1,12 @@
+## Endpoint Event Documentation
+
+**This documentation is still beta**
+
+The subdirectories document all ECS fields that may exist in documents generated by Endpoint into
+logs and metrics datastreams. Only fields included by Endpoint are documented, those added during
+integration pipeline enrichment in Elasticsearch are not within the scope of this documentation.
+
+Endpoint state management documents are described in a cross-platform way because they are largely
+identical on each OS. Events are documented per-OS. Documentation for each state management or event
+document includes the relevant OS(es), the data stream the document is found in, a KQL filter to
+match on the document, and all the fields associated with the document.

From a2d320ded25b81214cc08d97998beceb18616687 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Thu, 27 Mar 2025 15:23:33 +0000
Subject: [PATCH 12/25] Updated Documentation

---
 .../doc/sample_output/README.md               |   12 -
 .../linux/linux_malicious_behavior_alert.md   |  631 +++++--
 .../alerts/linux/linux_malware_alert.md       | 1297 ++++++++++++---
 .../alerts/linux/linux_memory_threat_alert.md | 1141 ++++++++++---
 .../macos/macos_malicious_behavior_alert.md   |  553 +++++-
 .../alerts/macos/macos_malware_alert.md       |  805 +++++++--
 .../alerts/macos/macos_memory_threat_alert.md |  685 ++++++--
 .../windows_malicious_behavior_alert.md       |  607 +++++--
 .../alerts/windows/windows_malware_alert.md   | 1135 ++++++++++---
 .../windows/windows_memory_threat_alert.md    |  781 +++++++--
 .../windows/windows_ransomware_alert.md       |  955 +++++++++--
 .../windows/windows_shellcode_thread.md       | 1477 ++++++++++++++---
 .../api/windows/windows_api_amsi.md           |  373 ++++-
 .../api/windows/windows_api_asm.md            |  391 ++++-
 .../windows/windows_api_credential_access.md  |  373 ++++-
 .../api/windows/windows_api_kernel_audit.md   |  343 +++-
 .../api/windows/windows_api_tcpip.md          |  367 +++-
 .../windows_api_threat_intelligence.md        |  607 +++++--
 .../api/windows/windows_api_win32k.md         |  499 +++++-
 .../api/windows/windows_api_wmi.md            |  433 ++++-
 .../file/linux/linux_file_create.md           |  343 +++-
 .../file/linux/linux_file_delete.md           |  337 +++-
 .../linux/linux_file_endpoint_unquarantine.md |  241 ++-
 .../file/linux/linux_file_rename.md           |  361 +++-
 .../file/macos/macos_file_access.md           |  295 +++-
 .../file/macos/macos_file_delete.md           |  385 ++++-
 .../macos/macos_file_endpoint_unquarantine.md |  241 ++-
 .../macos_file_extended_attributes_delete.md  |  385 ++++-
 .../file/macos/macos_file_launch_daemon.md    |  373 ++++-
 .../file/macos/macos_file_modification.md     |  397 ++++-
 .../file/macos/macos_file_mount.md            |  367 +++-
 .../file/macos/macos_file_rename.md           |  403 ++++-
 .../file/windows/windows_file_create.md       |  409 ++++-
 .../file/windows/windows_file_delete.md       |  379 ++++-
 .../windows_file_endpoint_unquarantine.md     |  241 ++-
 .../file/windows/windows_file_modification.md |  385 ++++-
 .../file/windows/windows_file_open.md         |  391 ++++-
 .../file/windows/windows_file_overwrite.md    |  385 ++++-
 .../file/windows/windows_file_rename.md       |  409 ++++-
 .../library/macos/macos_library_load.md       |  403 ++++-
 .../library/windows/windows_library_load.md   |  439 ++++-
 .../doc/sample_output/metadata/metadata.md    |  265 ++-
 .../doc/sample_output/metrics/metrics.md      | 1105 ++++++++++--
 ...twork_attempted_accepted_and_disconnect.md |  409 ++++-
 .../linux/linux_network_dns_lookup_result.md  |  307 +++-
 ...ork_connection_attempted_and_disconnect.md |  397 ++++-
 .../macos/macos_network_dns_lookup_result.md  |  415 ++++-
 ...twork_attempted_accepted_and_disconnect.md |  373 ++++-
 .../windows_network_dns_lookup_requested.md   |  337 +++-
 .../windows_network_dns_lookup_result.md      |  343 +++-
 .../sample_output/policy/policy_response.md   |  511 +++++-
 .../linux/linux_process_already_running.md    | 1117 ++++++++++---
 .../linux/linux_process_fork_exec_exit.md     | 1141 ++++++++++---
 .../process/linux/linux_process_gid_change.md | 1129 ++++++++++---
 .../linux/linux_process_memfd_create.md       | 1153 ++++++++++---
 .../process/linux/linux_process_ptrace.md     | 1129 ++++++++++---
 .../linux/linux_process_session_id_change.md  | 1105 ++++++++++--
 .../process/linux/linux_process_shmget.md     | 1129 ++++++++++---
 .../linux/linux_process_text_output.md        | 1141 ++++++++++---
 .../process/linux/linux_process_uid_change.md | 1135 ++++++++++---
 .../macos/macos_process_already_running.md    |  391 ++++-
 .../macos/macos_process_fork_exec_exit.md     |  499 +++++-
 .../macos/macos_process_remote_thread.md      |  469 +++++-
 .../windows_process_already_running.md        |  541 +++++-
 .../windows_process_create_and_exit.md        |  691 ++++++--
 .../windows/windows_registry_modification.md  |  367 +++-
 .../windows/windows_registry_query.md         |  355 +++-
 .../macos_security_gatekeeper_override.md     |  391 ++++-
 .../security/macos/macos_security_log_on.md   |  373 ++++-
 .../macos/macos_security_rdp_log_on.md        |  373 ++++-
 .../macos/macos_security_ssh_log_on.md        |  373 ++++-
 .../windows/windows_security_log_off.md       |  343 +++-
 .../windows/windows_security_log_on.md        |  361 +++-
 .../windows/windows_volume_device_mount.md    |  349 +++-
 .../windows/windows_volume_device_unmount.md  |  295 +++-
 scripts/generate-docs/pydocgen/__main__.py    |    2 +
 scripts/generate-docs/pydocgen/markdown.py    |  252 +--
 77 files changed, 35025 insertions(+), 7075 deletions(-)
 delete mode 100644 custom_documentation/doc/sample_output/README.md

diff --git a/custom_documentation/doc/sample_output/README.md b/custom_documentation/doc/sample_output/README.md
deleted file mode 100644
index 5d024aeab..000000000
--- a/custom_documentation/doc/sample_output/README.md
+++ /dev/null
@@ -1,12 +0,0 @@
-## Endpoint Event Documentation
-
-**This documentation is still beta**
-
-The subdirectories document all ECS fields that may exist in documents generated by Endpoint into
-logs and metrics datastreams. Only fields included by Endpoint are documented, those added during
-integration pipeline enrichment in Elasticsearch are not within the scope of this documentation.
-
-Endpoint state management documents are described in a cross-platform way because they are largely
-identical on each OS. Events are documented per-OS. Documentation for each state management or event
-document includes the relevant OS(es), the data stream the document is found in, a KQL filter to
-match on the document, and all the fields associated with the document.
diff --git a/custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md b/custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md
index 3517e2d22..7ceda2076 100644
--- a/custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md
@@ -25,109 +25,530 @@ This alert is generated when a Malicious Behavior alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Events.*<code></td><td>No description found</td></tr>
-<tr><td><code>Events._label<code></td><td>No description found</td></tr>
-<tr><td><code>Events._state<code></td><td>No description found</td></tr>
-<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
-<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
-<tr><td><code>Responses.action.field<code></td><td>Field in the triggering event to use as input for action</td></tr>
-<tr><td><code>Responses.action.state<code></td><td>Index of event in events array to use for field lookup</td></tr>
-<tr><td><code>Responses.action.tree<code></td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
-<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
-<tr><td><code>Responses.process.entity_id<code></td><td>Entity id of actionable process</td></tr>
-<tr><td><code>Responses.process.name<code></td><td>Name of actionable process</td></tr>
-<tr><td><code>Responses.process.pid<code></td><td>pid of actionable process</td></tr>
-<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.*<code></td><td>No description found</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.*<code></td><td>No description found</td></tr>
-<tr><td><code>rule.description<code></td><td>The description of the rule generating the event.</td></tr>
-<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td><code>rule.reference<code></td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>rule.version<code></td><td>The version / revision of the rule being used for analysis.</td></tr>
-<tr><td><code>threat.framework<code></td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
-<tr><td><code>threat.tactic.id<code></td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td><code>threat.tactic.name<code></td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
-<tr><td><code>threat.tactic.reference<code></td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td><code>threat.technique.id<code></td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td><code>threat.technique.name<code></td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td><code>threat.technique.reference<code></td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td><code>threat.technique.subtechnique<code></td><td>No description found</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the artifact for linux malicious behavior alert.</td>
+<td><code>stable</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Events.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Events._label</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Events._state</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.@timestamp</code></td>
+<td>Timestamp in which action was taken</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.action</code></td>
+<td>Response action name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.field</code></td>
+<td>Field in the triggering event to use as input for action</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.state</code></td>
+<td>Index of event in events array to use for field lookup</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.tree</code></td>
+<td>Indicates whether or not an action was taken against an entire process tree</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.message</code></td>
+<td>Result message</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.process.entity_id</code></td>
+<td>Entity id of actionable process</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.process.name</code></td>
+<td>Name of actionable process</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.process.pid</code></td>
+<td>pid of actionable process</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.result</code></td>
+<td>Response action result code</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.account.id</code></td>
+<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
+<td><code>666777888999</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>rule.description</code></td>
+<td>The description of the rule generating the event.</td>
+<td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td>
+</tr>
+<tr>
+<td><code>rule.id</code></td>
+<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
+<td><code>101</code></td>
+</tr>
+<tr>
+<td><code>rule.name</code></td>
+<td>The name of the rule or signature generating the event.</td>
+<td><code>BLOCK_DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.reference</code></td>
+<td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td>
+<td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>rule.version</code></td>
+<td>The version / revision of the rule being used for analysis.</td>
+<td><code>1.1</code></td>
+</tr>
+<tr>
+<td><code>threat.framework</code></td>
+<td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td>
+<td><code>MITRE ATT&CK</code></td>
+</tr>
+<tr>
+<td><code>threat.tactic.id</code></td>
+<td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
+<td><code>TA0002</code></td>
+</tr>
+<tr>
+<td><code>threat.tactic.name</code></td>
+<td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td>
+<td><code>Execution</code></td>
+</tr>
+<tr>
+<td><code>threat.tactic.reference</code></td>
+<td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
+<td><code>https://attack.mitre.org/tactics/TA0002/</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.id</code></td>
+<td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
+<td><code>T1059</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.name</code></td>
+<td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
+<td><code>Command and Scripting Interpreter</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.reference</code></td>
+<td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
+<td><code>https://attack.mitre.org/techniques/T1059/</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.subtechnique</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md b/custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md
index 4ebab56c5..a5a74e497 100644
--- a/custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md
@@ -25,220 +25,1085 @@ This alert is generated when a Malware alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.malware_classification.identifier<code></td><td>The model's unique identifier.</td></tr>
-<tr><td><code>file.Ext.malware_classification.score<code></td><td>The score produced by the classification model.</td></tr>
-<tr><td><code>file.Ext.malware_classification.threshold<code></td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
-<tr><td><code>file.Ext.malware_classification.version<code></td><td>The version of the model used.</td></tr>
-<tr><td><code>file.Ext.malware_signature.all_names<code></td><td>The concatenated names of all yara signatures</td></tr>
-<tr><td><code>file.Ext.malware_signature.identifier<code></td><td>Malware artifact identifier.</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.matches<code></td><td>An array of bytes representing yara signature matches</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.signature.hash.sha256<code></td><td>Primary malware signature sha256.</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.signature.id<code></td><td>Primary malware signature id.</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.signature.name<code></td><td>Primary malware signature name.</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.matches<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.signature.hash.sha256<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.signature.id<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.signature.name<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.version<code></td><td>Primary malware signature version.</td></tr>
-<tr><td><code>file.Ext.quarantine_message<code></td><td>Message describing quarantine results.</td></tr>
-<tr><td><code>file.Ext.quarantine_path<code></td><td>Path on endpoint the quarantined file was originally.</td></tr>
-<tr><td><code>file.Ext.quarantine_result<code></td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
-<tr><td><code>file.Ext.temp_file_path<code></td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
-<tr><td><code>file.accessed<code></td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
-<tr><td><code>file.created<code></td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
-<tr><td><code>file.directory<code></td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td><code>file.mtime<code></td><td>Last time the file content was modified.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.owner<code></td><td>File owner's username.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the linux artifact.</td>
+<td><code>stable</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.identifier</code></td>
+<td>The model's unique identifier.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.score</code></td>
+<td>The score produced by the classification model.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.threshold</code></td>
+<td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.version</code></td>
+<td>The version of the model used.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.all_names</code></td>
+<td>The concatenated names of all yara signatures</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.identifier</code></td>
+<td>Malware artifact identifier.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.matches</code></td>
+<td>An array of bytes representing yara signature matches</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.signature.hash.sha256</code></td>
+<td>Primary malware signature sha256.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.signature.id</code></td>
+<td>Primary malware signature id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.signature.name</code></td>
+<td>Primary malware signature name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.matches</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.signature.hash.sha256</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.signature.id</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.signature.name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.version</code></td>
+<td>Primary malware signature version.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.quarantine_message</code></td>
+<td>Message describing quarantine results.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.quarantine_path</code></td>
+<td>Path on endpoint the quarantined file was originally.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.quarantine_result</code></td>
+<td>Boolean representing whether or not file quarantine succeeded.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.temp_file_path</code></td>
+<td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.accessed</code></td>
+<td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.created</code></td>
+<td>File creation time.  Note that not all filesystems store the creation time.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.directory</code></td>
+<td>Directory where the file is located. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.inode</code></td>
+<td>Inode representing the file in the filesystem.</td>
+<td><code>256383</code></td>
+</tr>
+<tr>
+<td><code>file.mtime</code></td>
+<td>Last time the file content was modified.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.owner</code></td>
+<td>File owner's username.</td>
+<td><code>alice</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pgid</code></td>
+<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pgid</code></td>
+<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>rule.id</code></td>
+<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
+<td><code>101</code></td>
+</tr>
+<tr>
+<td><code>rule.name</code></td>
+<td>The name of the rule or signature generating the event.</td>
+<td><code>BLOCK_DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md b/custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md
index 8ef84a28f..352ab7515 100644
--- a/custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md
@@ -25,194 +25,955 @@ This alert is generated when a Memory Threat alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_base<code></td><td>Base address of the memory allocation containing the memory region.</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_size<code></td><td>Original memory size requested when the memory was allocated.</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_type<code></td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_address<code></td><td>The address where bytes_compressed begins.</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_allocation_offset<code></td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_compressed<code></td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_compressed_present<code></td><td>Whether bytes_compressed is present in this event.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.all_names<code></td><td>A sequence of signature names matched.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.identifier<code></td><td>malware signature identifier</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.matches<code></td><td>The first matching details.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256<code></td><td>sha256 hash of file matching signature.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.id<code></td><td>The id of the first yara rule matched.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.name<code></td><td>The name of the first yara rule matched.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.version<code></td><td>malware signature version</td></tr>
-<tr><td><code>process.Ext.memory_region.region_base<code></td><td>Base address of the memory region.</td></tr>
-<tr><td><code>process.Ext.memory_region.region_protection<code></td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
-<tr><td><code>process.Ext.memory_region.region_size<code></td><td>Size of the memory region.</td></tr>
-<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the linux artifact.</td>
+<td><code>stable</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_base</code></td>
+<td>Base address of the memory allocation containing the memory region.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_size</code></td>
+<td>Original memory size requested when the memory was allocated.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_type</code></td>
+<td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td>
+<td><code>PRIVATE</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_address</code></td>
+<td>The address where bytes_compressed begins.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_allocation_offset</code></td>
+<td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_compressed</code></td>
+<td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td>
+<td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_compressed_present</code></td>
+<td>Whether bytes_compressed is present in this event.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.all_names</code></td>
+<td>A sequence of signature names matched.</td>
+<td><code>Windows.EICAR.Not-a-virus</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.identifier</code></td>
+<td>malware signature identifier</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.matches</code></td>
+<td>The first matching details.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256</code></td>
+<td>sha256 hash of file matching signature.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.signature.id</code></td>
+<td>The id of the first yara rule matched.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.signature.name</code></td>
+<td>The name of the first yara rule matched.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.version</code></td>
+<td>malware signature version</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_base</code></td>
+<td>Base address of the memory region.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_protection</code></td>
+<td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td>
+<td><code>RWX</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_size</code></td>
+<td>Size of the memory region.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pgid</code></td>
+<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.pgid</code></td>
+<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>rule.id</code></td>
+<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
+<td><code>101</code></td>
+</tr>
+<tr>
+<td><code>rule.name</code></td>
+<td>The name of the rule or signature generating the event.</td>
+<td><code>BLOCK_DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md b/custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md
index c27390fbb..2d56f7734 100644
--- a/custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md
@@ -25,96 +25,465 @@ This alert is generated when a Malicious Behavior alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Events.*<code></td><td>No description found</td></tr>
-<tr><td><code>Events._label<code></td><td>No description found</td></tr>
-<tr><td><code>Events._state<code></td><td>No description found</td></tr>
-<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
-<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
-<tr><td><code>Responses.action.field<code></td><td>Field in the triggering event to use as input for action</td></tr>
-<tr><td><code>Responses.action.state<code></td><td>Index of event in events array to use for field lookup</td></tr>
-<tr><td><code>Responses.action.tree<code></td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
-<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
-<tr><td><code>Responses.process.entity_id<code></td><td>Entity id of actionable process</td></tr>
-<tr><td><code>Responses.process.name<code></td><td>Name of actionable process</td></tr>
-<tr><td><code>Responses.process.pid<code></td><td>pid of actionable process</td></tr>
-<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.*<code></td><td>No description found</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.*<code></td><td>No description found</td></tr>
-<tr><td><code>rule.description<code></td><td>The description of the rule generating the event.</td></tr>
-<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td><code>rule.reference<code></td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>rule.version<code></td><td>The version / revision of the rule being used for analysis.</td></tr>
-<tr><td><code>threat.framework<code></td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
-<tr><td><code>threat.tactic.id<code></td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td><code>threat.tactic.name<code></td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
-<tr><td><code>threat.tactic.reference<code></td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td><code>threat.technique.id<code></td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td><code>threat.technique.name<code></td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td><code>threat.technique.reference<code></td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td><code>threat.technique.subtechnique<code></td><td>No description found</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the macos artifact.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Events.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Events._label</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Events._state</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.@timestamp</code></td>
+<td>Timestamp in which action was taken</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.action</code></td>
+<td>Response action name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.field</code></td>
+<td>Field in the triggering event to use as input for action</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.state</code></td>
+<td>Index of event in events array to use for field lookup</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.tree</code></td>
+<td>Indicates whether or not an action was taken against an entire process tree</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.message</code></td>
+<td>Result message</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.process.entity_id</code></td>
+<td>Entity id of actionable process</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.process.name</code></td>
+<td>Name of actionable process</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.process.pid</code></td>
+<td>pid of actionable process</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.result</code></td>
+<td>Response action result code</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>rule.description</code></td>
+<td>The description of the rule generating the event.</td>
+<td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td>
+</tr>
+<tr>
+<td><code>rule.id</code></td>
+<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
+<td><code>101</code></td>
+</tr>
+<tr>
+<td><code>rule.name</code></td>
+<td>The name of the rule or signature generating the event.</td>
+<td><code>BLOCK_DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.reference</code></td>
+<td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td>
+<td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>rule.version</code></td>
+<td>The version / revision of the rule being used for analysis.</td>
+<td><code>1.1</code></td>
+</tr>
+<tr>
+<td><code>threat.framework</code></td>
+<td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td>
+<td><code>MITRE ATT&CK</code></td>
+</tr>
+<tr>
+<td><code>threat.tactic.id</code></td>
+<td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
+<td><code>TA0002</code></td>
+</tr>
+<tr>
+<td><code>threat.tactic.name</code></td>
+<td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td>
+<td><code>Execution</code></td>
+</tr>
+<tr>
+<td><code>threat.tactic.reference</code></td>
+<td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
+<td><code>https://attack.mitre.org/tactics/TA0002/</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.id</code></td>
+<td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
+<td><code>T1059</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.name</code></td>
+<td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
+<td><code>Command and Scripting Interpreter</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.reference</code></td>
+<td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
+<td><code>https://attack.mitre.org/techniques/T1059/</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.subtechnique</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md b/custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md
index bb4a498cf..f1436d045 100644
--- a/custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md
@@ -25,138 +25,675 @@ This alert is generated when a macOS Malware alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.malware_classification.identifier<code></td><td>The model's unique identifier.</td></tr>
-<tr><td><code>file.Ext.malware_classification.score<code></td><td>The score produced by the classification model.</td></tr>
-<tr><td><code>file.Ext.malware_classification.threshold<code></td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
-<tr><td><code>file.Ext.malware_classification.version<code></td><td>The version of the model used.</td></tr>
-<tr><td><code>file.Ext.malware_signature.all_names<code></td><td>The concatenated names of all yara signatures</td></tr>
-<tr><td><code>file.Ext.malware_signature.identifier<code></td><td>Malware artifact identifier.</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.matches<code></td><td>An array of bytes representing yara signature matches</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.signature.hash.sha256<code></td><td>Primary malware signature sha256.</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.signature.id<code></td><td>Primary malware signature id.</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.signature.name<code></td><td>Primary malware signature name.</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.matches<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.signature.hash.sha256<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.signature.id<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.signature.name<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.version<code></td><td>Primary malware signature version.</td></tr>
-<tr><td><code>file.Ext.quarantine_message<code></td><td>Message describing quarantine results.</td></tr>
-<tr><td><code>file.Ext.quarantine_path<code></td><td>Path on endpoint the quarantined file was originally.</td></tr>
-<tr><td><code>file.Ext.quarantine_result<code></td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
-<tr><td><code>file.Ext.temp_file_path<code></td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
-<tr><td><code>file.accessed<code></td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
-<tr><td><code>file.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>file.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>file.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>file.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>file.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>file.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>file.created<code></td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
-<tr><td><code>file.directory<code></td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.mtime<code></td><td>Last time the file content was modified.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.owner<code></td><td>File owner's username.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the macos artifact.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.identifier</code></td>
+<td>The model's unique identifier.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.score</code></td>
+<td>The score produced by the classification model.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.threshold</code></td>
+<td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.version</code></td>
+<td>The version of the model used.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.all_names</code></td>
+<td>The concatenated names of all yara signatures</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.identifier</code></td>
+<td>Malware artifact identifier.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.matches</code></td>
+<td>An array of bytes representing yara signature matches</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.signature.hash.sha256</code></td>
+<td>Primary malware signature sha256.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.signature.id</code></td>
+<td>Primary malware signature id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.signature.name</code></td>
+<td>Primary malware signature name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.matches</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.signature.hash.sha256</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.signature.id</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.signature.name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.version</code></td>
+<td>Primary malware signature version.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.quarantine_message</code></td>
+<td>Message describing quarantine results.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.quarantine_path</code></td>
+<td>Path on endpoint the quarantined file was originally.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.quarantine_result</code></td>
+<td>Boolean representing whether or not file quarantine succeeded.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.temp_file_path</code></td>
+<td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.accessed</code></td>
+<td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>file.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>file.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>file.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>file.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>file.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>file.created</code></td>
+<td>File creation time.  Note that not all filesystems store the creation time.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.directory</code></td>
+<td>Directory where the file is located. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.mtime</code></td>
+<td>Last time the file content was modified.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.owner</code></td>
+<td>File owner's username.</td>
+<td><code>alice</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pgid</code></td>
+<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.pgid</code></td>
+<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>rule.id</code></td>
+<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
+<td><code>101</code></td>
+</tr>
+<tr>
+<td><code>rule.name</code></td>
+<td>The name of the rule or signature generating the event.</td>
+<td><code>BLOCK_DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md b/custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md
index c15a31dd5..b82cd654c 100644
--- a/custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md
@@ -25,118 +25,575 @@ This alert is generated when a macOS Memory Thread alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_base<code></td><td>Base address of the memory allocation containing the memory region.</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_size<code></td><td>Original memory size requested when the memory was allocated.</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_type<code></td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_address<code></td><td>The address where bytes_compressed begins.</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_allocation_offset<code></td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_compressed<code></td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_compressed_present<code></td><td>Whether bytes_compressed is present in this event.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.all_names<code></td><td>A sequence of signature names matched.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.identifier<code></td><td>malware signature identifier</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.matches<code></td><td>The first matching details.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256<code></td><td>sha256 hash of file matching signature.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.id<code></td><td>The id of the first yara rule matched.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.name<code></td><td>The name of the first yara rule matched.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.version<code></td><td>malware signature version</td></tr>
-<tr><td><code>process.Ext.memory_region.region_base<code></td><td>Base address of the memory region.</td></tr>
-<tr><td><code>process.Ext.memory_region.region_protection<code></td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
-<tr><td><code>process.Ext.memory_region.region_size<code></td><td>Size of the memory region.</td></tr>
-<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.pgid<code></td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the macos artifact.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_base</code></td>
+<td>Base address of the memory allocation containing the memory region.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_size</code></td>
+<td>Original memory size requested when the memory was allocated.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_type</code></td>
+<td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td>
+<td><code>PRIVATE</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_address</code></td>
+<td>The address where bytes_compressed begins.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_allocation_offset</code></td>
+<td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_compressed</code></td>
+<td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td>
+<td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_compressed_present</code></td>
+<td>Whether bytes_compressed is present in this event.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.all_names</code></td>
+<td>A sequence of signature names matched.</td>
+<td><code>Windows.EICAR.Not-a-virus</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.identifier</code></td>
+<td>malware signature identifier</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.matches</code></td>
+<td>The first matching details.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256</code></td>
+<td>sha256 hash of file matching signature.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.signature.id</code></td>
+<td>The id of the first yara rule matched.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.signature.name</code></td>
+<td>The name of the first yara rule matched.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.version</code></td>
+<td>malware signature version</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_base</code></td>
+<td>Base address of the memory region.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_protection</code></td>
+<td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td>
+<td><code>RWX</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_size</code></td>
+<td>Size of the memory region.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pgid</code></td>
+<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.pgid</code></td>
+<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>rule.id</code></td>
+<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
+<td><code>101</code></td>
+</tr>
+<tr>
+<td><code>rule.name</code></td>
+<td>The name of the rule or signature generating the event.</td>
+<td><code>BLOCK_DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md
index 05b1ac596..26f968edd 100644
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md
@@ -25,105 +25,510 @@ This alert occurs when a Malicious Behavior alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Events.*<code></td><td>No description found</td></tr>
-<tr><td><code>Events._label<code></td><td>No description found</td></tr>
-<tr><td><code>Events._state<code></td><td>No description found</td></tr>
-<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
-<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
-<tr><td><code>Responses.action.field<code></td><td>Field in the triggering event to use as input for action</td></tr>
-<tr><td><code>Responses.action.file.attributes<code></td><td>Destination file attributes</td></tr>
-<tr><td><code>Responses.action.file.path<code></td><td>Destination file path</td></tr>
-<tr><td><code>Responses.action.file.reason<code></td><td>Combined USN file modification reason</td></tr>
-<tr><td><code>Responses.action.key.actions<code></td><td>Actions taken by Registry Rollback for key</td></tr>
-<tr><td><code>Responses.action.key.path<code></td><td>NT path of registry key recovered by Rollback</td></tr>
-<tr><td><code>Responses.action.key.values.actions<code></td><td>Actions taken by Registry Rollback for value</td></tr>
-<tr><td><code>Responses.action.key.values.name<code></td><td>Value name recovered by Rollback</td></tr>
-<tr><td><code>Responses.action.source.attributes<code></td><td>Source file attributes</td></tr>
-<tr><td><code>Responses.action.source.path<code></td><td>Source file path</td></tr>
-<tr><td><code>Responses.action.state<code></td><td>Index of event in events array to use for field lookup</td></tr>
-<tr><td><code>Responses.action.tree<code></td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
-<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
-<tr><td><code>Responses.process.entity_id<code></td><td>Entity id of actionable process</td></tr>
-<tr><td><code>Responses.process.name<code></td><td>Name of actionable process</td></tr>
-<tr><td><code>Responses.process.pid<code></td><td>pid of actionable process</td></tr>
-<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
-<tr><td><code>Target.*<code></td><td>No description found</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
-<tr><td><code>dll.*<code></td><td>No description found</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.*<code></td><td>No description found</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>process.*<code></td><td>No description found</td></tr>
-<tr><td><code>registry.*<code></td><td>No description found</td></tr>
-<tr><td><code>rule.description<code></td><td>The description of the rule generating the event.</td></tr>
-<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td><code>rule.reference<code></td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>rule.version<code></td><td>The version / revision of the rule being used for analysis.</td></tr>
-<tr><td><code>threat.framework<code></td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
-<tr><td><code>threat.tactic.id<code></td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td><code>threat.tactic.name<code></td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
-<tr><td><code>threat.tactic.reference<code></td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td><code>threat.technique.id<code></td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td><code>threat.technique.name<code></td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td><code>threat.technique.reference<code></td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td><code>threat.technique.subtechnique.id<code></td><td>The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
-<tr><td><code>threat.technique.subtechnique.name<code></td><td>The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
-<tr><td><code>threat.technique.subtechnique.reference<code></td><td>The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the windows artifact.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Events.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Events._label</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Events._state</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.@timestamp</code></td>
+<td>Timestamp in which action was taken</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.action</code></td>
+<td>Response action name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.field</code></td>
+<td>Field in the triggering event to use as input for action</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.attributes</code></td>
+<td>Destination file attributes</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.path</code></td>
+<td>Destination file path</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.reason</code></td>
+<td>Combined USN file modification reason</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.actions</code></td>
+<td>Actions taken by Registry Rollback for key</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.path</code></td>
+<td>NT path of registry key recovered by Rollback</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.values.actions</code></td>
+<td>Actions taken by Registry Rollback for value</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.values.name</code></td>
+<td>Value name recovered by Rollback</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.source.attributes</code></td>
+<td>Source file attributes</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.source.path</code></td>
+<td>Source file path</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.state</code></td>
+<td>Index of event in events array to use for field lookup</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.tree</code></td>
+<td>Indicates whether or not an action was taken against an entire process tree</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.message</code></td>
+<td>Result message</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.process.entity_id</code></td>
+<td>Entity id of actionable process</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.process.name</code></td>
+<td>Name of actionable process</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.process.pid</code></td>
+<td>pid of actionable process</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.result</code></td>
+<td>Response action result code</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>destination.ip</code></td>
+<td>IP address of the destination (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.port</code></td>
+<td>Port of the destination.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>network.transport</code></td>
+<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
+<td><code>tcp</code></td>
+</tr>
+<tr>
+<td><code>network.type</code></td>
+<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
+<td><code>ipv4</code></td>
+</tr>
+<tr>
+<td><code>process.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>registry.*</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>rule.description</code></td>
+<td>The description of the rule generating the event.</td>
+<td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td>
+</tr>
+<tr>
+<td><code>rule.id</code></td>
+<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
+<td><code>101</code></td>
+</tr>
+<tr>
+<td><code>rule.name</code></td>
+<td>The name of the rule or signature generating the event.</td>
+<td><code>BLOCK_DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.reference</code></td>
+<td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td>
+<td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>rule.version</code></td>
+<td>The version / revision of the rule being used for analysis.</td>
+<td><code>1.1</code></td>
+</tr>
+<tr>
+<td><code>threat.framework</code></td>
+<td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td>
+<td><code>MITRE ATT&CK</code></td>
+</tr>
+<tr>
+<td><code>threat.tactic.id</code></td>
+<td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
+<td><code>TA0002</code></td>
+</tr>
+<tr>
+<td><code>threat.tactic.name</code></td>
+<td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td>
+<td><code>Execution</code></td>
+</tr>
+<tr>
+<td><code>threat.tactic.reference</code></td>
+<td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
+<td><code>https://attack.mitre.org/tactics/TA0002/</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.id</code></td>
+<td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
+<td><code>T1059</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.name</code></td>
+<td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
+<td><code>Command and Scripting Interpreter</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.reference</code></td>
+<td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
+<td><code>https://attack.mitre.org/techniques/T1059/</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.subtechnique.id</code></td>
+<td>The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td>
+<td><code>T1059.001</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.subtechnique.name</code></td>
+<td>The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td>
+<td><code>PowerShell</code></td>
+</tr>
+<tr>
+<td><code>threat.technique.subtechnique.reference</code></td>
+<td>The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td>
+<td><code>https://attack.mitre.org/techniques/T1059/001/</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md
index 6118e1dde..1c4df94d3 100644
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md
@@ -25,193 +25,950 @@ This alert is generated when a Malware alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
-<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
-<tr><td><code>Responses.action.file.attributes<code></td><td>Destination file attributes</td></tr>
-<tr><td><code>Responses.action.file.path<code></td><td>Destination file path</td></tr>
-<tr><td><code>Responses.action.file.reason<code></td><td>Combined USN file modification reason</td></tr>
-<tr><td><code>Responses.action.key.actions<code></td><td>Actions taken by Registry Rollback for key</td></tr>
-<tr><td><code>Responses.action.key.path<code></td><td>NT path of registry key recovered by Rollback</td></tr>
-<tr><td><code>Responses.action.key.values.actions<code></td><td>Actions taken by Registry Rollback for value</td></tr>
-<tr><td><code>Responses.action.key.values.name<code></td><td>Value name recovered by Rollback</td></tr>
-<tr><td><code>Responses.action.process.path<code></td><td>Path of process killed by Process Rollback</td></tr>
-<tr><td><code>Responses.action.source.attributes<code></td><td>Source file attributes</td></tr>
-<tr><td><code>Responses.action.source.path<code></td><td>Source file path</td></tr>
-<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
-<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>file.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>file.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>file.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>file.Ext.device.bus_type<code></td><td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td></tr>
-<tr><td><code>file.Ext.device.dos_name<code></td><td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td></tr>
-<tr><td><code>file.Ext.device.file_system_type<code></td><td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td></tr>
-<tr><td><code>file.Ext.device.nt_name<code></td><td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td></tr>
-<tr><td><code>file.Ext.device.product_id<code></td><td>ProductID of the device. It is provided by the vendor of the device if any.</td></tr>
-<tr><td><code>file.Ext.device.vendor_id<code></td><td>VendorID of the device. It is provided by the vendor of the device.</td></tr>
-<tr><td><code>file.Ext.device.volume_device_type<code></td><td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td></tr>
-<tr><td><code>file.Ext.malware_classification.identifier<code></td><td>The model's unique identifier.</td></tr>
-<tr><td><code>file.Ext.malware_classification.score<code></td><td>The score produced by the classification model.</td></tr>
-<tr><td><code>file.Ext.malware_classification.threshold<code></td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
-<tr><td><code>file.Ext.malware_classification.version<code></td><td>The version of the model used.</td></tr>
-<tr><td><code>file.Ext.malware_signature.all_names<code></td><td>The concatenated names of all yara signatures</td></tr>
-<tr><td><code>file.Ext.malware_signature.identifier<code></td><td>Malware artifact identifier.</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.matches<code></td><td>An array of bytes representing yara signature matches</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.signature.hash.sha256<code></td><td>Primary malware signature sha256.</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.signature.id<code></td><td>Primary malware signature id.</td></tr>
-<tr><td><code>file.Ext.malware_signature.primary.signature.name<code></td><td>Primary malware signature name.</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.matches<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.signature.hash.sha256<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.signature.id<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.secondary.signature.name<code></td><td>No description found</td></tr>
-<tr><td><code>file.Ext.malware_signature.version<code></td><td>Primary malware signature version.</td></tr>
-<tr><td><code>file.Ext.quarantine_message<code></td><td>Message describing quarantine results.</td></tr>
-<tr><td><code>file.Ext.quarantine_path<code></td><td>Path on endpoint the quarantined file was originally.</td></tr>
-<tr><td><code>file.Ext.quarantine_result<code></td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
-<tr><td><code>file.Ext.temp_file_path<code></td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
-<tr><td><code>file.accessed<code></td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
-<tr><td><code>file.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>file.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>file.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>file.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>file.created<code></td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
-<tr><td><code>file.directory<code></td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.drive_letter<code></td><td>Drive letter where the file is located. This field is only relevant on Windows.  The value should be uppercase, and not include the colon.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.mtime<code></td><td>Last time the file content was modified.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.owner<code></td><td>File owner's username.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.pe.Ext.dotnet<code></td><td>Whether this file is a .NET PE</td></tr>
-<tr><td><code>file.pe.Ext.sections.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>file.pe.Ext.sections.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.pe.Ext.sections.name<code></td><td>The section's name</td></tr>
-<tr><td><code>file.pe.Ext.streams.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>file.pe.Ext.streams.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.pe.Ext.streams.name<code></td><td>The stream's name</td></tr>
-<tr><td><code>file.pe.company<code></td><td>Internal company name of the file, provided at compile-time.</td></tr>
-<tr><td><code>file.pe.description<code></td><td>Internal description of the file, provided at compile-time.</td></tr>
-<tr><td><code>file.pe.file_version<code></td><td>Internal version of the file, provided at compile-time.</td></tr>
-<tr><td><code>file.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td><code>file.pe.product<code></td><td>Internal product name of the file, provided at compile-time.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.services<code></td><td>Services running in this process.</td></tr>
-<tr><td><code>process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
-<tr><td><code>process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
-<tr><td><code>process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
-<tr><td><code>process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
-<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.pe.company<code></td><td>Internal company name of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pe.description<code></td><td>Internal description of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pe.file_version<code></td><td>Internal version of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pe.product<code></td><td>Internal product name of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the windows artifact.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.@timestamp</code></td>
+<td>Timestamp in which action was taken</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.action</code></td>
+<td>Response action name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.attributes</code></td>
+<td>Destination file attributes</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.path</code></td>
+<td>Destination file path</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.reason</code></td>
+<td>Combined USN file modification reason</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.actions</code></td>
+<td>Actions taken by Registry Rollback for key</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.path</code></td>
+<td>NT path of registry key recovered by Rollback</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.values.actions</code></td>
+<td>Actions taken by Registry Rollback for value</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.values.name</code></td>
+<td>Value name recovered by Rollback</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.process.path</code></td>
+<td>Path of process killed by Process Rollback</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.source.attributes</code></td>
+<td>Source file attributes</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.source.path</code></td>
+<td>Source file path</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.message</code></td>
+<td>Result message</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.result</code></td>
+<td>Response action result code</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>file.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>file.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>file.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>file.Ext.device.bus_type</code></td>
+<td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.device.dos_name</code></td>
+<td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.device.file_system_type</code></td>
+<td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.device.nt_name</code></td>
+<td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.device.product_id</code></td>
+<td>ProductID of the device. It is provided by the vendor of the device if any.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.device.vendor_id</code></td>
+<td>VendorID of the device. It is provided by the vendor of the device.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.device.volume_device_type</code></td>
+<td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.identifier</code></td>
+<td>The model's unique identifier.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.score</code></td>
+<td>The score produced by the classification model.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.threshold</code></td>
+<td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_classification.version</code></td>
+<td>The version of the model used.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.all_names</code></td>
+<td>The concatenated names of all yara signatures</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.identifier</code></td>
+<td>Malware artifact identifier.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.matches</code></td>
+<td>An array of bytes representing yara signature matches</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.signature.hash.sha256</code></td>
+<td>Primary malware signature sha256.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.signature.id</code></td>
+<td>Primary malware signature id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.primary.signature.name</code></td>
+<td>Primary malware signature name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.matches</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.signature.hash.sha256</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.signature.id</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.secondary.signature.name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.malware_signature.version</code></td>
+<td>Primary malware signature version.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.quarantine_message</code></td>
+<td>Message describing quarantine results.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.quarantine_path</code></td>
+<td>Path on endpoint the quarantined file was originally.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.quarantine_result</code></td>
+<td>Boolean representing whether or not file quarantine succeeded.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.temp_file_path</code></td>
+<td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.accessed</code></td>
+<td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>file.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>file.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>file.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>file.created</code></td>
+<td>File creation time.  Note that not all filesystems store the creation time.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.directory</code></td>
+<td>Directory where the file is located. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>file.drive_letter</code></td>
+<td>Drive letter where the file is located. This field is only relevant on Windows.  The value should be uppercase, and not include the colon.</td>
+<td><code>C</code></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.mtime</code></td>
+<td>Last time the file content was modified.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.owner</code></td>
+<td>File owner's username.</td>
+<td><code>alice</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.pe.Ext.dotnet</code></td>
+<td>Whether this file is a .NET PE</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>file.pe.Ext.sections.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.pe.Ext.sections.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.pe.Ext.sections.name</code></td>
+<td>The section's name</td>
+<td><code>.reloc</code></td>
+</tr>
+<tr>
+<td><code>file.pe.Ext.streams.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.pe.Ext.streams.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.pe.Ext.streams.name</code></td>
+<td>The stream's name</td>
+<td><code>.reloc</code></td>
+</tr>
+<tr>
+<td><code>file.pe.company</code></td>
+<td>Internal company name of the file, provided at compile-time.</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>file.pe.description</code></td>
+<td>Internal description of the file, provided at compile-time.</td>
+<td><code>Paint</code></td>
+</tr>
+<tr>
+<td><code>file.pe.file_version</code></td>
+<td>Internal version of the file, provided at compile-time.</td>
+<td><code>6.3.9600.17415</code></td>
+</tr>
+<tr>
+<td><code>file.pe.original_file_name</code></td>
+<td>Internal name of the file, provided at compile-time.</td>
+<td><code>MSPAINT.EXE</code></td>
+</tr>
+<tr>
+<td><code>file.pe.product</code></td>
+<td>Internal product name of the file, provided at compile-time.</td>
+<td><code>Microsoft® Windows® Operating System</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.services</code></td>
+<td>Services running in this process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.domain</code></td>
+<td>Domain of token user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation</code></td>
+<td>Whether the token is elevated or not</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation_type</code></td>
+<td>What level of elevation the token has</td>
+<td><code>one of "default", "full", "limited"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.sid</code></td>
+<td>Token user's Security Identifier (SID).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.user</code></td>
+<td>Username of token owner.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.pe.company</code></td>
+<td>Internal company name of the file, provided at compile-time.</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.pe.description</code></td>
+<td>Internal description of the file, provided at compile-time.</td>
+<td><code>Paint</code></td>
+</tr>
+<tr>
+<td><code>process.pe.file_version</code></td>
+<td>Internal version of the file, provided at compile-time.</td>
+<td><code>6.3.9600.17415</code></td>
+</tr>
+<tr>
+<td><code>process.pe.original_file_name</code></td>
+<td>Internal name of the file, provided at compile-time.</td>
+<td><code>MSPAINT.EXE</code></td>
+</tr>
+<tr>
+<td><code>process.pe.product</code></td>
+<td>Internal product name of the file, provided at compile-time.</td>
+<td><code>Microsoft® Windows® Operating System</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>rule.id</code></td>
+<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
+<td><code>101</code></td>
+</tr>
+<tr>
+<td><code>rule.name</code></td>
+<td>The name of the rule or signature generating the event.</td>
+<td><code>BLOCK_DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md
index 539bb36df..e42baf677 100644
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md
@@ -25,134 +25,655 @@ This alert is generated when a Memory Threat alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_base<code></td><td>Base address of the memory allocation containing the memory region.</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_protection<code></td><td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_size<code></td><td>Original memory size requested when the memory was allocated.</td></tr>
-<tr><td><code>process.Ext.memory_region.allocation_type<code></td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_address<code></td><td>The address where bytes_compressed begins.</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_allocation_offset<code></td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_compressed<code></td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
-<tr><td><code>process.Ext.memory_region.bytes_compressed_present<code></td><td>Whether bytes_compressed is present in this event.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.all_names<code></td><td>A sequence of signature names matched.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.identifier<code></td><td>malware signature identifier</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.matches<code></td><td>The first matching details.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256<code></td><td>sha256 hash of file matching signature.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.id<code></td><td>The id of the first yara rule matched.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.primary.signature.name<code></td><td>The name of the first yara rule matched.</td></tr>
-<tr><td><code>process.Ext.memory_region.malware_signature.version<code></td><td>malware signature version</td></tr>
-<tr><td><code>process.Ext.memory_region.region_base<code></td><td>Base address of the memory region.</td></tr>
-<tr><td><code>process.Ext.memory_region.region_protection<code></td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
-<tr><td><code>process.Ext.memory_region.region_size<code></td><td>Size of the memory region.</td></tr>
-<tr><td><code>process.Ext.memory_region.region_start_bytes<code></td><td>First 64 bytes at the region base address.</td></tr>
-<tr><td><code>process.Ext.memory_region.region_state<code></td><td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
-<tr><td><code>process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
-<tr><td><code>process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
-<tr><td><code>process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
-<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>rule.id<code></td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td><code>rule.name<code></td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the windows artifact.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_base</code></td>
+<td>Base address of the memory allocation containing the memory region.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_protection</code></td>
+<td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td>
+<td><code>RWX</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_size</code></td>
+<td>Original memory size requested when the memory was allocated.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.allocation_type</code></td>
+<td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td>
+<td><code>PRIVATE</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_address</code></td>
+<td>The address where bytes_compressed begins.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_allocation_offset</code></td>
+<td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_compressed</code></td>
+<td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td>
+<td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.bytes_compressed_present</code></td>
+<td>Whether bytes_compressed is present in this event.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.all_names</code></td>
+<td>A sequence of signature names matched.</td>
+<td><code>Windows.EICAR.Not-a-virus</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.identifier</code></td>
+<td>malware signature identifier</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.matches</code></td>
+<td>The first matching details.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256</code></td>
+<td>sha256 hash of file matching signature.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.signature.id</code></td>
+<td>The id of the first yara rule matched.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.primary.signature.name</code></td>
+<td>The name of the first yara rule matched.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.malware_signature.version</code></td>
+<td>malware signature version</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_base</code></td>
+<td>Base address of the memory region.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_protection</code></td>
+<td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td>
+<td><code>RWX</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_size</code></td>
+<td>Size of the memory region.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_start_bytes</code></td>
+<td>First 64 bytes at the region base address.</td>
+<td><code>4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memory_region.region_state</code></td>
+<td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td>
+<td><code>COMMIT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.domain</code></td>
+<td>Domain of token user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation</code></td>
+<td>Whether the token is elevated or not</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation_type</code></td>
+<td>What level of elevation the token has</td>
+<td><code>one of "default", "full", "limited"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.sid</code></td>
+<td>Token user's Security Identifier (SID).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.user</code></td>
+<td>Username of token owner.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>rule.id</code></td>
+<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
+<td><code>101</code></td>
+</tr>
+<tr>
+<td><code>rule.name</code></td>
+<td>The name of the rule or signature generating the event.</td>
+<td><code>BLOCK_DNS_over_TLS</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md
index 4318a8d5b..61154353d 100644
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md
+++ b/custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md
@@ -25,163 +25,800 @@ This alert is generated when a Ransomware alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Ransomware.child_processes.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>Ransomware.child_processes.files.data<code></td><td>File header or MBR bytes.</td></tr>
-<tr><td><code>Ransomware.child_processes.files.entropy<code></td><td>Entropy of file contents.</td></tr>
-<tr><td><code>Ransomware.child_processes.files.extension<code></td><td>File extension, excluding the leading dot.</td></tr>
-<tr><td><code>Ransomware.child_processes.files.metrics<code></td><td>Suspicious ransomware behaviours associated with the file event.</td></tr>
-<tr><td><code>Ransomware.child_processes.files.operation<code></td><td>Operation applied to file.</td></tr>
-<tr><td><code>Ransomware.child_processes.files.path<code></td><td>Full path to the file, including the file name.</td></tr>
-<tr><td><code>Ransomware.child_processes.files.score<code></td><td>Ransomware score for this particular file event.</td></tr>
-<tr><td><code>Ransomware.child_processes.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>Ransomware.child_processes.score<code></td><td>Total ransomware score for aggregated file events.</td></tr>
-<tr><td><code>Ransomware.feature<code></td><td>Ransomware feature which triggered the alert.</td></tr>
-<tr><td><code>Ransomware.files.data<code></td><td>File header or MBR bytes.</td></tr>
-<tr><td><code>Ransomware.files.entropy<code></td><td>Entropy of file contents.</td></tr>
-<tr><td><code>Ransomware.files.extension<code></td><td>File extension, excluding the leading dot.</td></tr>
-<tr><td><code>Ransomware.files.metrics<code></td><td>Suspicious ransomware behaviours associated with the file event.</td></tr>
-<tr><td><code>Ransomware.files.operation<code></td><td>Operation applied to file.</td></tr>
-<tr><td><code>Ransomware.files.path<code></td><td>Full path to the file, including the file name.</td></tr>
-<tr><td><code>Ransomware.files.score<code></td><td>Ransomware score for this particular file event.</td></tr>
-<tr><td><code>Ransomware.score<code></td><td>Total ransomware score for aggregated file events.</td></tr>
-<tr><td><code>Ransomware.version<code></td><td>Ransomware artifact version.</td></tr>
-<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
-<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
-<tr><td><code>Responses.action.file.attributes<code></td><td>Destination file attributes</td></tr>
-<tr><td><code>Responses.action.file.path<code></td><td>Destination file path</td></tr>
-<tr><td><code>Responses.action.file.reason<code></td><td>Combined USN file modification reason</td></tr>
-<tr><td><code>Responses.action.key.actions<code></td><td>Actions taken by Registry Rollback for key</td></tr>
-<tr><td><code>Responses.action.key.path<code></td><td>NT path of registry key recovered by Rollback</td></tr>
-<tr><td><code>Responses.action.source.attributes<code></td><td>Source file attributes</td></tr>
-<tr><td><code>Responses.action.source.path<code></td><td>Source file path</td></tr>
-<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
-<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.mapped_address<code></td><td>The base address where this module is loaded.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.mapped_size<code></td><td>The size of this module's memory mapping, in bytes.</td></tr>
-<tr><td><code>process.Ext.dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.dll.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.dll.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.Ext.dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.Ext.dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.Ext.dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td><code>process.Ext.dll.path<code></td><td>Full file path of the library.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
-<tr><td><code>process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
-<tr><td><code>process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
-<tr><td><code>process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
-<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.pe.company<code></td><td>Internal company name of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pe.description<code></td><td>Internal description of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pe.file_version<code></td><td>Internal version of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pe.product<code></td><td>Internal product name of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the windows artifact.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.files.data</code></td>
+<td>File header or MBR bytes.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.files.entropy</code></td>
+<td>Entropy of file contents.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.files.extension</code></td>
+<td>File extension, excluding the leading dot.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.files.metrics</code></td>
+<td>Suspicious ransomware behaviours associated with the file event.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.files.operation</code></td>
+<td>Operation applied to file.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.files.path</code></td>
+<td>Full path to the file, including the file name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.files.score</code></td>
+<td>Ransomware score for this particular file event.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>Ransomware.child_processes.score</code></td>
+<td>Total ransomware score for aggregated file events.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.feature</code></td>
+<td>Ransomware feature which triggered the alert.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.files.data</code></td>
+<td>File header or MBR bytes.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.files.entropy</code></td>
+<td>Entropy of file contents.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.files.extension</code></td>
+<td>File extension, excluding the leading dot.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.files.metrics</code></td>
+<td>Suspicious ransomware behaviours associated with the file event.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.files.operation</code></td>
+<td>Operation applied to file.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.files.path</code></td>
+<td>Full path to the file, including the file name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.files.score</code></td>
+<td>Ransomware score for this particular file event.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.score</code></td>
+<td>Total ransomware score for aggregated file events.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Ransomware.version</code></td>
+<td>Ransomware artifact version.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.@timestamp</code></td>
+<td>Timestamp in which action was taken</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.action</code></td>
+<td>Response action name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.attributes</code></td>
+<td>Destination file attributes</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.path</code></td>
+<td>Destination file path</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.reason</code></td>
+<td>Combined USN file modification reason</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.actions</code></td>
+<td>Actions taken by Registry Rollback for key</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.path</code></td>
+<td>NT path of registry key recovered by Rollback</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.source.attributes</code></td>
+<td>Source file attributes</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.source.path</code></td>
+<td>Source file path</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.message</code></td>
+<td>Result message</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.result</code></td>
+<td>Response action result code</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.mapped_address</code></td>
+<td>The base address where this module is loaded.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.mapped_size</code></td>
+<td>The size of this module's memory mapping, in bytes.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.name</code></td>
+<td>Name of the library.  This generally maps to the name of the file on disk.</td>
+<td><code>kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.path</code></td>
+<td>Full file path of the library.</td>
+<td><code>C:\Windows\System32\kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.domain</code></td>
+<td>Domain of token user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation</code></td>
+<td>Whether the token is elevated or not</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation_type</code></td>
+<td>What level of elevation the token has</td>
+<td><code>one of "default", "full", "limited"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.sid</code></td>
+<td>Token user's Security Identifier (SID).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.user</code></td>
+<td>Username of token owner.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.pe.company</code></td>
+<td>Internal company name of the file, provided at compile-time.</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.pe.description</code></td>
+<td>Internal description of the file, provided at compile-time.</td>
+<td><code>Paint</code></td>
+</tr>
+<tr>
+<td><code>process.pe.file_version</code></td>
+<td>Internal version of the file, provided at compile-time.</td>
+<td><code>6.3.9600.17415</code></td>
+</tr>
+<tr>
+<td><code>process.pe.original_file_name</code></td>
+<td>Internal name of the file, provided at compile-time.</td>
+<td><code>MSPAINT.EXE</code></td>
+</tr>
+<tr>
+<td><code>process.pe.product</code></td>
+<td>Internal product name of the file, provided at compile-time.</td>
+<td><code>Microsoft® Windows® Operating System</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md b/custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md
index a8063535d..4c9001b64 100644
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md
+++ b/custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md
@@ -25,250 +25,1235 @@ This alert is generated when a Shellcode Threat alert occurs.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Memory_protection.cross_session<code></td><td>Is this process injecting across operating system sessions?</td></tr>
-<tr><td><code>Memory_protection.feature<code></td><td>Memory Protection feature which triggered the alert.</td></tr>
-<tr><td><code>Memory_protection.parent_to_child<code></td><td>Is this process injecting into its child?</td></tr>
-<tr><td><code>Memory_protection.self_injection<code></td><td>Is this alert about a process injecting into itself?</td></tr>
-<tr><td><code>Memory_protection.unique_key_v1<code></td><td>A unique key created by hashing several characteristics of this alert.</td></tr>
-<tr><td><code>Memory_protection.unique_key_v2<code></td><td>A unique key created by hashing several characteristics of this alert.</td></tr>
-<tr><td><code>Responses.@timestamp<code></td><td>Timestamp in which action was taken</td></tr>
-<tr><td><code>Responses.action.action<code></td><td>Response action name</td></tr>
-<tr><td><code>Responses.action.file.attributes<code></td><td>Destination file attributes</td></tr>
-<tr><td><code>Responses.action.file.path<code></td><td>Destination file path</td></tr>
-<tr><td><code>Responses.action.file.reason<code></td><td>Combined USN file modification reason</td></tr>
-<tr><td><code>Responses.action.key.actions<code></td><td>Actions taken by Registry Rollback for key</td></tr>
-<tr><td><code>Responses.action.key.path<code></td><td>NT path of registry key recovered by Rollback</td></tr>
-<tr><td><code>Responses.action.key.values.actions<code></td><td>Actions taken by Registry Rollback for value</td></tr>
-<tr><td><code>Responses.action.key.values.name<code></td><td>Value name recovered by Rollback</td></tr>
-<tr><td><code>Responses.action.source.attributes<code></td><td>Source file attributes</td></tr>
-<tr><td><code>Responses.action.source.path<code></td><td>Source file path</td></tr>
-<tr><td><code>Responses.message<code></td><td>Result message</td></tr>
-<tr><td><code>Responses.result<code></td><td>Response action result code</td></tr>
-<tr><td><code>Target.process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>Target.process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>Target.process.Ext.dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>Target.process.Ext.dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>Target.process.Ext.dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>Target.process.Ext.dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>Target.process.Ext.dll.Ext.mapped_address<code></td><td>The base address where this module is loaded.</td></tr>
-<tr><td><code>Target.process.Ext.dll.Ext.mapped_size<code></td><td>The size of this module's memory mapping, in bytes.</td></tr>
-<tr><td><code>Target.process.Ext.dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>Target.process.Ext.dll.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>Target.process.Ext.dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>Target.process.Ext.dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>Target.process.Ext.dll.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>Target.process.Ext.dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>Target.process.Ext.dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>Target.process.Ext.dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td><code>Target.process.Ext.dll.path<code></td><td>Full file path of the library.</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.allocation_base<code></td><td>Base address of the memory allocation containing the memory region.</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.allocation_protection<code></td><td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.allocation_size<code></td><td>Original memory size requested when the memory was allocated.</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.allocation_type<code></td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.bytes_address<code></td><td>The address where bytes_compressed begins.</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.bytes_allocation_offset<code></td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.mapped_path<code></td><td>If the memory corresponds to a file mapping, this is the file's path.</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.memory_pe_detected<code></td><td>Whether an executable file was found in memory.</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.region_base<code></td><td>Base address of the memory region.</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.region_protection<code></td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.region_size<code></td><td>Size of the memory region.</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.region_state<code></td><td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td></tr>
-<tr><td><code>Target.process.Ext.memory_region.strings<code></td><td>Array of strings found within the memory region.</td></tr>
-<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>Target.process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
-<tr><td><code>Target.process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
-<tr><td><code>Target.process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
-<tr><td><code>Target.process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>Target.process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
-<tr><td><code>Target.process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
-<tr><td><code>Target.process.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>Target.process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>Target.process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>Target.process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>Target.process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>Target.process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>Target.process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>Target.process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>Target.process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>Target.process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>Target.process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>Target.process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>Target.process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>Target.process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>Target.process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>Target.process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>Target.process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>Target.process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>Target.process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>Target.process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>Target.process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>Target.process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>Target.process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>Target.process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>Target.process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>Target.process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>Target.process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>Target.process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>Target.process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>Target.process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>Target.process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>Target.process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>Target.process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>Target.process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>Target.process.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>Target.process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>Target.process.thread.Ext.call_stack.instruction_pointer<code></td><td>The return address of this stack frame.</td></tr>
-<tr><td><code>Target.process.thread.Ext.call_stack.memory_section.memory_address<code></td><td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td></tr>
-<tr><td><code>Target.process.thread.Ext.call_stack.memory_section.memory_size<code></td><td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td></tr>
-<tr><td><code>Target.process.thread.Ext.call_stack.memory_section.protection<code></td><td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td><code>Target.process.thread.Ext.call_stack.module_name<code></td><td>The name of the DLL/module containing `instruction_pointer`.</td></tr>
-<tr><td><code>Target.process.thread.Ext.call_stack.module_path<code></td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
-<tr><td><code>Target.process.thread.Ext.call_stack.symbol_info<code></td><td>The nearest symbol for `instruction_pointer`.</td></tr>
-<tr><td><code>Target.process.thread.Ext.call_stack_summary<code></td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
-<tr><td><code>Target.process.thread.Ext.original_start_address<code></td><td>When a trampoline was detected, this indicates the original content for the thread start address in memory.</td></tr>
-<tr><td><code>Target.process.thread.Ext.original_start_address_allocation_offset<code></td><td>When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.</td></tr>
-<tr><td><code>Target.process.thread.Ext.original_start_address_bytes<code></td><td>When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.</td></tr>
-<tr><td><code>Target.process.thread.Ext.original_start_address_bytes_disasm<code></td><td>When a trampoline was detected, this holds the disassembled code at the original thread start address.</td></tr>
-<tr><td><code>Target.process.thread.Ext.original_start_address_bytes_disasm_hash<code></td><td>When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td></tr>
-<tr><td><code>Target.process.thread.Ext.original_start_address_module<code></td><td>When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.</td></tr>
-<tr><td><code>Target.process.thread.Ext.start_address<code></td><td>Memory address where the thread began execution.</td></tr>
-<tr><td><code>Target.process.thread.Ext.start_address_allocation_offset<code></td><td>Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.</td></tr>
-<tr><td><code>Target.process.thread.Ext.start_address_bytes<code></td><td>A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.</td></tr>
-<tr><td><code>Target.process.thread.Ext.start_address_bytes_disasm<code></td><td>The bytes at the thread start address, disassembled into human-readable assembly code.</td></tr>
-<tr><td><code>Target.process.thread.Ext.start_address_bytes_disasm_hash<code></td><td>The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td></tr>
-<tr><td><code>Target.process.thread.Ext.start_address_module<code></td><td>The dll/module where the thread began execution.</td></tr>
-<tr><td><code>Target.process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>Target.process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.risk_score<code></td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.severity<code></td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.mapped_address<code></td><td>The base address where this module is loaded.</td></tr>
-<tr><td><code>process.Ext.dll.Ext.mapped_size<code></td><td>The size of this module's memory mapping, in bytes.</td></tr>
-<tr><td><code>process.Ext.dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.dll.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.dll.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.Ext.dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.Ext.dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.Ext.dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td><code>process.Ext.dll.path<code></td><td>Full file path of the library.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.token.domain<code></td><td>Domain of token user.</td></tr>
-<tr><td><code>process.Ext.token.elevation<code></td><td>Whether the token is elevated or not</td></tr>
-<tr><td><code>process.Ext.token.elevation_type<code></td><td>What level of elevation the token has</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.Ext.token.sid<code></td><td>Token user's Security Identifier (SID).</td></tr>
-<tr><td><code>process.Ext.token.user<code></td><td>Username of token owner.</td></tr>
-<tr><td><code>process.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.architecture<code></td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.parent.Ext.user<code></td><td>User associated with the running process.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.parent.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.ppid<code></td><td>Parent process' pid.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack.instruction_pointer<code></td><td>The return address of this stack frame.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack.memory_section.memory_address<code></td><td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td></tr>
-<tr><td><code>process.thread.Ext.call_stack.memory_section.memory_size<code></td><td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td></tr>
-<tr><td><code>process.thread.Ext.call_stack.memory_section.protection<code></td><td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td><code>process.thread.Ext.call_stack.module_name<code></td><td>The name of the DLL/module containing `instruction_pointer`.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack.module_path<code></td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack.symbol_info<code></td><td>The nearest symbol for `instruction_pointer`.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack_final_user_module.name<code></td><td>The file name of the call_stack_final_user_module.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack_summary<code></td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
-<tr><td><code>process.thread.Ext.start_address<code></td><td>Memory address where the thread began execution.</td></tr>
-<tr><td><code>process.thread.Ext.start_address_module<code></td><td>The dll/module where the thread began execution.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>rule.ruleset<code></td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the windows artifact.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Memory_protection.cross_session</code></td>
+<td>Is this process injecting across operating system sessions?</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Memory_protection.feature</code></td>
+<td>Memory Protection feature which triggered the alert.</td>
+<td><code>shellcode_thread</code></td>
+</tr>
+<tr>
+<td><code>Memory_protection.parent_to_child</code></td>
+<td>Is this process injecting into its child?</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Memory_protection.self_injection</code></td>
+<td>Is this alert about a process injecting into itself?</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Memory_protection.unique_key_v1</code></td>
+<td>A unique key created by hashing several characteristics of this alert.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Memory_protection.unique_key_v2</code></td>
+<td>A unique key created by hashing several characteristics of this alert.</td>
+<td><code>00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67</code></td>
+</tr>
+<tr>
+<td><code>Responses.@timestamp</code></td>
+<td>Timestamp in which action was taken</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.action</code></td>
+<td>Response action name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.attributes</code></td>
+<td>Destination file attributes</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.path</code></td>
+<td>Destination file path</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.file.reason</code></td>
+<td>Combined USN file modification reason</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.actions</code></td>
+<td>Actions taken by Registry Rollback for key</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.path</code></td>
+<td>NT path of registry key recovered by Rollback</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.values.actions</code></td>
+<td>Actions taken by Registry Rollback for value</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.key.values.name</code></td>
+<td>Value name recovered by Rollback</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.source.attributes</code></td>
+<td>Source file attributes</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.action.source.path</code></td>
+<td>Source file path</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.message</code></td>
+<td>Result message</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Responses.result</code></td>
+<td>Response action result code</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.Ext.mapped_address</code></td>
+<td>The base address where this module is loaded.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.Ext.mapped_size</code></td>
+<td>The size of this module's memory mapping, in bytes.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.name</code></td>
+<td>Name of the library.  This generally maps to the name of the file on disk.</td>
+<td><code>kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.dll.path</code></td>
+<td>Full file path of the library.</td>
+<td><code>C:\Windows\System32\kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.allocation_base</code></td>
+<td>Base address of the memory allocation containing the memory region.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.allocation_protection</code></td>
+<td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td>
+<td><code>RWX</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.allocation_size</code></td>
+<td>Original memory size requested when the memory was allocated.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.allocation_type</code></td>
+<td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td>
+<td><code>PRIVATE</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.bytes_address</code></td>
+<td>The address where bytes_compressed begins.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.bytes_allocation_offset</code></td>
+<td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.mapped_path</code></td>
+<td>If the memory corresponds to a file mapping, this is the file's path.</td>
+<td><code>C:\Windows\System32\mshtml.dll</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.memory_pe_detected</code></td>
+<td>Whether an executable file was found in memory.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.region_base</code></td>
+<td>Base address of the memory region.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.region_protection</code></td>
+<td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td>
+<td><code>RWX</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.region_size</code></td>
+<td>Size of the memory region.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.region_state</code></td>
+<td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td>
+<td><code>COMMIT</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.memory_region.strings</code></td>
+<td>Array of strings found within the memory region.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.token.domain</code></td>
+<td>Domain of token user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.token.elevation</code></td>
+<td>Whether the token is elevated or not</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.token.elevation_type</code></td>
+<td>What level of elevation the token has</td>
+<td><code>one of "default", "full", "limited"</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.token.sid</code></td>
+<td>Token user's Security Identifier (SID).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.token.user</code></td>
+<td>Username of token owner.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>Target.process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>Target.process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>Target.process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Target.process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.parent.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>Target.process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>Target.process.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>Target.process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.call_stack.instruction_pointer</code></td>
+<td>The return address of this stack frame.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.call_stack.memory_section.memory_address</code></td>
+<td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.call_stack.memory_section.memory_size</code></td>
+<td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.call_stack.memory_section.protection</code></td>
+<td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.call_stack.module_name</code></td>
+<td>The name of the DLL/module containing `instruction_pointer`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.call_stack.module_path</code></td>
+<td>The path to the DLL/module containing `instruction_pointer`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.call_stack.symbol_info</code></td>
+<td>The nearest symbol for `instruction_pointer`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.call_stack_summary</code></td>
+<td>Concatentation of the non-repeated modules in the call stack.</td>
+<td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.original_start_address</code></td>
+<td>When a trampoline was detected, this indicates the original content for the thread start address in memory.</td>
+<td><code>4194304</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.original_start_address_allocation_offset</code></td>
+<td>When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.original_start_address_bytes</code></td>
+<td>When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.</td>
+<td><code>48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.original_start_address_bytes_disasm</code></td>
+<td>When a trampoline was detected, this holds the disassembled code at the original thread start address.</td>
+<td><code>mov rax, 0x4141414141414141\njmp rax</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.original_start_address_bytes_disasm_hash</code></td>
+<td>When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td>
+<td><code>aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.original_start_address_module</code></td>
+<td>When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.</td>
+<td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.start_address</code></td>
+<td>Memory address where the thread began execution.</td>
+<td><code>4194304</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.start_address_allocation_offset</code></td>
+<td>Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.start_address_bytes</code></td>
+<td>A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.</td>
+<td><code>c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.start_address_bytes_disasm</code></td>
+<td>The bytes at the thread start address, disassembled into human-readable assembly code.</td>
+<td><code>ret\nint3</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.start_address_bytes_disasm_hash</code></td>
+<td>The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td>
+<td><code>aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.Ext.start_address_module</code></td>
+<td>The dll/module where the thread began execution.</td>
+<td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td>
+</tr>
+<tr>
+<td><code>Target.process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>Target.process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.risk_score</code></td>
+<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.severity</code></td>
+<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
+<td><code>7</code></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.mapped_address</code></td>
+<td>The base address where this module is loaded.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.Ext.mapped_size</code></td>
+<td>The size of this module's memory mapping, in bytes.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.name</code></td>
+<td>Name of the library.  This generally maps to the name of the file on disk.</td>
+<td><code>kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.dll.path</code></td>
+<td>Full file path of the library.</td>
+<td><code>C:\Windows\System32\kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.domain</code></td>
+<td>Domain of token user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation</code></td>
+<td>Whether the token is elevated or not</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation_type</code></td>
+<td>What level of elevation the token has</td>
+<td><code>one of "default", "full", "limited"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.sid</code></td>
+<td>Token user's Security Identifier (SID).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.user</code></td>
+<td>Username of token owner.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.architecture</code></td>
+<td>Process architecture.  It can differ from host architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.user</code></td>
+<td>User associated with the running process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.ppid</code></td>
+<td>Parent process' pid.</td>
+<td><code>4241</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack.instruction_pointer</code></td>
+<td>The return address of this stack frame.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack.memory_section.memory_address</code></td>
+<td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack.memory_section.memory_size</code></td>
+<td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack.memory_section.protection</code></td>
+<td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack.module_name</code></td>
+<td>The name of the DLL/module containing `instruction_pointer`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack.module_path</code></td>
+<td>The path to the DLL/module containing `instruction_pointer`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack.symbol_info</code></td>
+<td>The nearest symbol for `instruction_pointer`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack_final_user_module.name</code></td>
+<td>The file name of the call_stack_final_user_module.</td>
+<td><code>example.dll</code></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack_summary</code></td>
+<td>Concatentation of the non-repeated modules in the call stack.</td>
+<td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.start_address</code></td>
+<td>Memory address where the thread began execution.</td>
+<td><code>4194304</code></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.start_address_module</code></td>
+<td>The dll/module where the thread began execution.</td>
+<td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>rule.ruleset</code></td>
+<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
+<td><code>Standard_Protocol_Filters</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md b/custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md
index 4eb3f18ca..b25880e8c 100644
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md
+++ b/custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md
@@ -24,66 +24,315 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td><code>process.Ext.api.metadata.return_value<code></td><td>Return value of RegisterRawInputDevices API call.</td></tr>
-<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td><code>process.Ext.api.parameters.app_name<code></td><td>The application name requesting the AMSI scan.</td></tr>
-<tr><td><code>process.Ext.api.parameters.buffer<code></td><td>The content associated with an AMSI scan.</td></tr>
-<tr><td><code>process.Ext.api.parameters.content_name<code></td><td>The content name, typically a filename, associated with an AMSI scan.</td></tr>
-<tr><td><code>process.Ext.api.parameters.size<code></td><td>The size.</td></tr>
-<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.provider</code></td>
+<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
+<td><code>kernel</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.behaviors</code></td>
+<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
+<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.return_value</code></td>
+<td>Return value of RegisterRawInputDevices API call.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.name</code></td>
+<td>The name of the API, usually the name of the function or system call.</td>
+<td><code>VirtualAlloc</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.app_name</code></td>
+<td>The application name requesting the AMSI scan.</td>
+<td><code>PowerShell</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.buffer</code></td>
+<td>The content associated with an AMSI scan.</td>
+<td><code>[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport("kernel32.dll")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20);</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.content_name</code></td>
+<td>The content name, typically a filename, associated with an AMSI scan.</td>
+<td><code>C:\script.ps1</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.size</code></td>
+<td>The size.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.summary</code></td>
+<td>The summary of the API call and its parameters.</td>
+<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_asm.md b/custom_documentation/doc/sample_output/api/windows/windows_api_asm.md
index 736ce88a7..beb7ca1f7 100644
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_asm.md
+++ b/custom_documentation/doc/sample_output/api/windows/windows_api_asm.md
@@ -24,69 +24,330 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>dll.path<code></td><td>Full file path of the library.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td><code>process.Ext.api.parameters.device<code></td><td>The name of the device object.</td></tr>
-<tr><td><code>process.Ext.api.parameters.io_control_code<code></td><td>The I/O control code for the requested device operation.</td></tr>
-<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>dll.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.path</code></td>
+<td>Full file path of the library.</td>
+<td><code>C:\Windows\System32\kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.provider</code></td>
+<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
+<td><code>kernel</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.behaviors</code></td>
+<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
+<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.name</code></td>
+<td>The name of the API, usually the name of the function or system call.</td>
+<td><code>VirtualAlloc</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.device</code></td>
+<td>The name of the device object.</td>
+<td><code>\Device\NPCAP</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.io_control_code</code></td>
+<td>The I/O control code for the requested device operation.</td>
+<td><code>27365</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.summary</code></td>
+<td>The summary of the API call and its parameters.</td>
+<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md b/custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md
index 324d9bc6f..0e624ba3f 100644
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md
+++ b/custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md
@@ -24,66 +24,315 @@ This event is generated when a process attempts to access priviledged credential
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td><code>process.Ext.api.parameters.desired_access<code></td><td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td></tr>
-<tr><td><code>process.Ext.api.parameters.desired_access_numeric<code></td><td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td></tr>
-<tr><td><code>process.Ext.api.parameters.handle_type<code></td><td>This parameter indicates whether the detected access was attempt against a process or a thread.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack.instruction_pointer<code></td><td>The return address of this stack frame.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack.module_path<code></td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack_contains_unbacked<code></td><td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td></tr>
-<tr><td><code>process.thread.Ext.call_stack_final_user_module.path<code></td><td>The file path of the call_stack_final_user_module.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.provider</code></td>
+<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
+<td><code>kernel</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.name</code></td>
+<td>The name of the API, usually the name of the function or system call.</td>
+<td><code>VirtualAlloc</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.desired_access</code></td>
+<td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.desired_access_numeric</code></td>
+<td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.handle_type</code></td>
+<td>This parameter indicates whether the detected access was attempt against a process or a thread.</td>
+<td><code>process</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack.instruction_pointer</code></td>
+<td>The return address of this stack frame.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack.module_path</code></td>
+<td>The path to the DLL/module containing `instruction_pointer`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack_contains_unbacked</code></td>
+<td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.Ext.call_stack_final_user_module.path</code></td>
+<td>The file path of the call_stack_final_user_module.</td>
+<td><code>C:\Program Files\Example\example.dll</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md b/custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md
index 3e0dcd4b5..e1b9b50b0 100644
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md
+++ b/custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md
@@ -24,61 +24,290 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.provider</code></td>
+<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
+<td><code>kernel</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.behaviors</code></td>
+<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
+<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.name</code></td>
+<td>The name of the API, usually the name of the function or system call.</td>
+<td><code>VirtualAlloc</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.summary</code></td>
+<td>The summary of the API call and its parameters.</td>
+<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md b/custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md
index 6329c08b0..0c42f5b71 100644
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md
+++ b/custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md
@@ -24,65 +24,310 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>destination.ip</code></td>
+<td>IP address of the destination (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.port</code></td>
+<td>Port of the destination.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.provider</code></td>
+<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
+<td><code>kernel</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>network.transport</code></td>
+<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
+<td><code>tcp</code></td>
+</tr>
+<tr>
+<td><code>network.type</code></td>
+<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
+<td><code>ipv4</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.behaviors</code></td>
+<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
+<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.name</code></td>
+<td>The name of the API, usually the name of the function or system call.</td>
+<td><code>VirtualAlloc</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.summary</code></td>
+<td>The summary of the API call and its parameters.</td>
+<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md b/custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md
index 39afbaf30..818c490f4 100644
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md
+++ b/custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md
@@ -24,105 +24,510 @@ This event is generated when ETW Threat-Intelligence events are generated.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.created_suspended<code></td><td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td></tr>
-<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>Target.process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>Target.process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>Target.process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td><code>process.Ext.api.metadata.target_address_name<code></td><td>The name of the memory region targeted by the API call.</td></tr>
-<tr><td><code>process.Ext.api.metadata.target_address_path<code></td><td>The path of the memory region targeted by the API call.</td></tr>
-<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td><code>process.Ext.api.parameters.address<code></td><td>The target memory address.</td></tr>
-<tr><td><code>process.Ext.api.parameters.allocation_type<code></td><td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td></tr>
-<tr><td><code>process.Ext.api.parameters.argument1<code></td><td>The first argument to the procedure.</td></tr>
-<tr><td><code>process.Ext.api.parameters.argument2<code></td><td>The second argument to the procedure.</td></tr>
-<tr><td><code>process.Ext.api.parameters.argument3<code></td><td>The third argument to the procedure.</td></tr>
-<tr><td><code>process.Ext.api.parameters.context_flags<code></td><td>The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`</td></tr>
-<tr><td><code>process.Ext.api.parameters.desired_access<code></td><td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td></tr>
-<tr><td><code>process.Ext.api.parameters.desired_access_numeric<code></td><td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td></tr>
-<tr><td><code>process.Ext.api.parameters.device<code></td><td>The name of the device object.</td></tr>
-<tr><td><code>process.Ext.api.parameters.driver<code></td><td>The name of the driver object.</td></tr>
-<tr><td><code>process.Ext.api.parameters.eax<code></td><td>The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.</td></tr>
-<tr><td><code>process.Ext.api.parameters.ebp<code></td><td>The x86 EBP frame pointer register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.ebx<code></td><td>The x86 EBX general purpose register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.ecx<code></td><td>The x86 ECX general purpose register. First argument in __fastcall and __thiscall.</td></tr>
-<tr><td><code>process.Ext.api.parameters.edi<code></td><td>The x86 EDI general purpose register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.edx<code></td><td>The x86 EDX general purpose register. Second argument in a __fastcall.</td></tr>
-<tr><td><code>process.Ext.api.parameters.eip<code></td><td>The x86 EIP instruction pointer register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.esi<code></td><td>The x86 ESI general purpose register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.esp<code></td><td>The x86 ESP stack pointer register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.handle_type<code></td><td>This parameter indicates whether the detected access was attempt against a process or a thread.</td></tr>
-<tr><td><code>process.Ext.api.parameters.procedure<code></td><td>The memory address of the procedure or function.</td></tr>
-<tr><td><code>process.Ext.api.parameters.protection<code></td><td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td><code>process.Ext.api.parameters.protection_old<code></td><td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td><code>process.Ext.api.parameters.r8<code></td><td>The x64 R8 general purpose register. Third argument in a __fastcall.</td></tr>
-<tr><td><code>process.Ext.api.parameters.r9<code></td><td>The x64 R9 general purpose register. Fourth argument in a __fastcall.</td></tr>
-<tr><td><code>process.Ext.api.parameters.rax<code></td><td>The x64 RAX general purpose register. Return value in a __fastcall.</td></tr>
-<tr><td><code>process.Ext.api.parameters.rbp<code></td><td>The x64 RBP general purpose register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.rbx<code></td><td>The x64 RBX general purpose register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.rcx<code></td><td>The x64 RCX general purpose register. First argument in a __fastcall.</td></tr>
-<tr><td><code>process.Ext.api.parameters.rdi<code></td><td>The x64 RDI general purpose register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.rdx<code></td><td>The x64 RDX general purpose register. Second argument in a __fastcall.</td></tr>
-<tr><td><code>process.Ext.api.parameters.rip<code></td><td>The x64 RIP instruction pointer register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.rsi<code></td><td>The x64 RSI general purpose register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.rsp<code></td><td>The x64 RSP stack pointer register.</td></tr>
-<tr><td><code>process.Ext.api.parameters.size<code></td><td>The size.</td></tr>
-<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.created_suspended</code></td>
+<td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>Target.process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Target.process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.provider</code></td>
+<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
+<td><code>kernel</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.behaviors</code></td>
+<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
+<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.target_address_name</code></td>
+<td>The name of the memory region targeted by the API call.</td>
+<td><code>Unbacked</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.target_address_path</code></td>
+<td>The path of the memory region targeted by the API call.</td>
+<td><code>C:\programdata\example.dll</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.name</code></td>
+<td>The name of the API, usually the name of the function or system call.</td>
+<td><code>VirtualAlloc</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.address</code></td>
+<td>The target memory address.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.allocation_type</code></td>
+<td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td>
+<td><code>COMMIT|RESERVE</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.argument1</code></td>
+<td>The first argument to the procedure.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.argument2</code></td>
+<td>The second argument to the procedure.</td>
+<td><code>2</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.argument3</code></td>
+<td>The third argument to the procedure.</td>
+<td><code>3</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.context_flags</code></td>
+<td>The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`</td>
+<td><code>1048607</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.desired_access</code></td>
+<td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.desired_access_numeric</code></td>
+<td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.device</code></td>
+<td>The name of the device object.</td>
+<td><code>\Device\NPCAP</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.driver</code></td>
+<td>The name of the driver object.</td>
+<td><code>\Driver\npcap</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.eax</code></td>
+<td>The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.ebp</code></td>
+<td>The x86 EBP frame pointer register.</td>
+<td><code>15006644</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.ebx</code></td>
+<td>The x86 EBX general purpose register.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.ecx</code></td>
+<td>The x86 ECX general purpose register. First argument in __fastcall and __thiscall.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.edi</code></td>
+<td>The x86 EDI general purpose register.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.edx</code></td>
+<td>The x86 EDX general purpose register. Second argument in a __fastcall.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.eip</code></td>
+<td>The x86 EIP instruction pointer register.</td>
+<td><code>1472790528</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.esi</code></td>
+<td>The x86 ESI general purpose register.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.esp</code></td>
+<td>The x86 ESP stack pointer register.</td>
+<td><code>15007744</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.handle_type</code></td>
+<td>This parameter indicates whether the detected access was attempt against a process or a thread.</td>
+<td><code>process</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.procedure</code></td>
+<td>The memory address of the procedure or function.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.protection</code></td>
+<td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
+<td><code>RWX|GUARD</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.protection_old</code></td>
+<td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
+<td><code>RCX</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.r8</code></td>
+<td>The x64 R8 general purpose register. Third argument in a __fastcall.</td>
+<td><code>3</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.r9</code></td>
+<td>The x64 R9 general purpose register. Fourth argument in a __fastcall.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.rax</code></td>
+<td>The x64 RAX general purpose register. Return value in a __fastcall.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.rbp</code></td>
+<td>The x64 RBP general purpose register.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.rbx</code></td>
+<td>The x64 RBX general purpose register.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.rcx</code></td>
+<td>The x64 RCX general purpose register. First argument in a __fastcall.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.rdi</code></td>
+<td>The x64 RDI general purpose register.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.rdx</code></td>
+<td>The x64 RDX general purpose register. Second argument in a __fastcall.</td>
+<td><code>2</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.rip</code></td>
+<td>The x64 RIP instruction pointer register.</td>
+<td><code>140706153693184</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.rsi</code></td>
+<td>The x64 RSI general purpose register.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.rsp</code></td>
+<td>The x64 RSP stack pointer register.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.size</code></td>
+<td>The size.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.summary</code></td>
+<td>The summary of the API call and its parameters.</td>
+<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md b/custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md
index a93dd8e7b..66e339a92 100644
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md
+++ b/custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md
@@ -24,87 +24,420 @@ This event is generated when keylogging-related Win32k APIs are called.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td><code>process.Ext.api.metadata.background_callcount<code></td><td>This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.</td></tr>
-<tr><td><code>process.Ext.api.metadata.ms_since_last_keyevent<code></td><td>This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.</td></tr>
-<tr><td><code>process.Ext.api.metadata.procedure_symbol<code></td><td>Summary of the hook procedure.</td></tr>
-<tr><td><code>process.Ext.api.metadata.return_value<code></td><td>Return value of RegisterRawInputDevices API call.</td></tr>
-<tr><td><code>process.Ext.api.metadata.start_address_allocation_protection<code></td><td>Memory protection attributes associated with the starting address of a thread.</td></tr>
-<tr><td><code>process.Ext.api.metadata.start_address_module<code></td><td>Name of the module associated with the starting address of a thread.</td></tr>
-<tr><td><code>process.Ext.api.metadata.target_address_name<code></td><td>The name of the memory region targeted by the API call.</td></tr>
-<tr><td><code>process.Ext.api.metadata.target_address_path<code></td><td>The path of the memory region targeted by the API call.</td></tr>
-<tr><td><code>process.Ext.api.metadata.thread_info_flags<code></td><td>Thread info flags.</td></tr>
-<tr><td><code>process.Ext.api.metadata.visible_windows_count<code></td><td>Number of visible windows owned by the caller thread.</td></tr>
-<tr><td><code>process.Ext.api.metadata.windows_count<code></td><td>Number of windows owned by the caller thread.</td></tr>
-<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td><code>process.Ext.api.parameters.address<code></td><td>The target memory address.</td></tr>
-<tr><td><code>process.Ext.api.parameters.allocation_type<code></td><td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td></tr>
-<tr><td><code>process.Ext.api.parameters.flags<code></td><td>Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.</td></tr>
-<tr><td><code>process.Ext.api.parameters.hook_module<code></td><td>DLL containing the hook procedure.</td></tr>
-<tr><td><code>process.Ext.api.parameters.hook_type<code></td><td>Type of hook procedure to be installed.</td></tr>
-<tr><td><code>process.Ext.api.parameters.procedure<code></td><td>The memory address of the procedure or function.</td></tr>
-<tr><td><code>process.Ext.api.parameters.protection<code></td><td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td><code>process.Ext.api.parameters.protection_old<code></td><td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td><code>process.Ext.api.parameters.size<code></td><td>The size.</td></tr>
-<tr><td><code>process.Ext.api.parameters.usage<code></td><td>This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.</td></tr>
-<tr><td><code>process.Ext.api.parameters.usage_page<code></td><td>This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.</td></tr>
-<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.provider</code></td>
+<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
+<td><code>kernel</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.behaviors</code></td>
+<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
+<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.background_callcount</code></td>
+<td>This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.</td>
+<td><code>6021</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.ms_since_last_keyevent</code></td>
+<td>This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.</td>
+<td><code>94</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.procedure_symbol</code></td>
+<td>Summary of the hook procedure.</td>
+<td><code>taskbar.dll</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.return_value</code></td>
+<td>Return value of RegisterRawInputDevices API call.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.start_address_allocation_protection</code></td>
+<td>Memory protection attributes associated with the starting address of a thread.</td>
+<td><code>RCX</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.start_address_module</code></td>
+<td>Name of the module associated with the starting address of a thread.</td>
+<td><code>C:\Windows\System32\DellTPad\ApMsgFwd.exe</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.target_address_name</code></td>
+<td>The name of the memory region targeted by the API call.</td>
+<td><code>Unbacked</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.target_address_path</code></td>
+<td>The path of the memory region targeted by the API call.</td>
+<td><code>C:\programdata\example.dll</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.thread_info_flags</code></td>
+<td>Thread info flags.</td>
+<td><code>16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.visible_windows_count</code></td>
+<td>Number of visible windows owned by the caller thread.</td>
+<td><code>0</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.windows_count</code></td>
+<td>Number of windows owned by the caller thread.</td>
+<td><code>2</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.name</code></td>
+<td>The name of the API, usually the name of the function or system call.</td>
+<td><code>VirtualAlloc</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.address</code></td>
+<td>The target memory address.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.allocation_type</code></td>
+<td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td>
+<td><code>COMMIT|RESERVE</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.flags</code></td>
+<td>Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.</td>
+<td><code>INPUTSINK</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.hook_module</code></td>
+<td>DLL containing the hook procedure.</td>
+<td><code>c:\windows\system32\taskbar.dll</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.hook_type</code></td>
+<td>Type of hook procedure to be installed.</td>
+<td><code>WH_KEYBOARD_LL</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.procedure</code></td>
+<td>The memory address of the procedure or function.</td>
+<td><code>2431737462784</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.protection</code></td>
+<td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
+<td><code>RWX|GUARD</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.protection_old</code></td>
+<td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
+<td><code>RCX</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.size</code></td>
+<td>The size.</td>
+<td><code>4096</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.usage</code></td>
+<td>This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.</td>
+<td><code>KEYBOARD</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.usage_page</code></td>
+<td>This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.</td>
+<td><code>GENERIC</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.summary</code></td>
+<td>The summary of the API call and its parameters.</td>
+<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md b/custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md
index b5a5c87ee..b9590446b 100644
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md
+++ b/custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md
@@ -24,76 +24,365 @@ This event is generated when WMI Activity-related APIs are called.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.provider<code></td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.api.behaviors<code></td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td><code>process.Ext.api.metadata.client_is_local<code></td><td>Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.</td></tr>
-<tr><td><code>process.Ext.api.metadata.client_machine<code></td><td>Client process's machine name (provided by the client and potentially untrustworthy).</td></tr>
-<tr><td><code>process.Ext.api.metadata.client_machine_fqdn<code></td><td>Client process's machine name FQDN (provided by the client and potentially untrustworthy).</td></tr>
-<tr><td><code>process.Ext.api.metadata.client_process_id<code></td><td>Client process id</td></tr>
-<tr><td><code>process.Ext.api.name<code></td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td><code>process.Ext.api.parameters.consumer_details<code></td><td>Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name.</td></tr>
-<tr><td><code>process.Ext.api.parameters.consumer_name<code></td><td>Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.</td></tr>
-<tr><td><code>process.Ext.api.parameters.consumer_type<code></td><td>An example list of consumer type.    "ActiveScriptEventConsumer" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.    "CommandLineEventConsumer" - Launches an arbitrary process in the local system context when an event is delivered to it.    "LogFileEventConsumer" - Writes customized strings to a text log file when events are delivered to it.    "NTEventLogEventConsumer" - Logs a specific message to the Windows event log when an event is delivered to it.    "SMTPEventConsumer" - Sends an email message using SMTP each time an event is delivered to it.</td></tr>
-<tr><td><code>process.Ext.api.parameters.event_filter_details<code></td><td>Provide an overview of the query that define when an event should be triggered.</td></tr>
-<tr><td><code>process.Ext.api.parameters.event_filter_name<code></td><td>Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.</td></tr>
-<tr><td><code>process.Ext.api.parameters.namespace<code></td><td>WMI namespace to which the connection is made.</td></tr>
-<tr><td><code>process.Ext.api.parameters.operation<code></td><td>Specifies the connection or request to WMI</td></tr>
-<tr><td><code>process.Ext.api.summary<code></td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Target.process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.provider</code></td>
+<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
+<td><code>kernel</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.behaviors</code></td>
+<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
+<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.client_is_local</code></td>
+<td>Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.client_machine</code></td>
+<td>Client process's machine name (provided by the client and potentially untrustworthy).</td>
+<td><code>DESKTOP-EXAMPLE</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.client_machine_fqdn</code></td>
+<td>Client process's machine name FQDN (provided by the client and potentially untrustworthy).</td>
+<td><code>DESKTOP-EXAMPLE.elastic.co</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.metadata.client_process_id</code></td>
+<td>Client process id</td>
+<td><code>3600</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.name</code></td>
+<td>The name of the API, usually the name of the function or system call.</td>
+<td><code>VirtualAlloc</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.consumer_details</code></td>
+<td>Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.consumer_name</code></td>
+<td>Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.</td>
+<td><code>ExampleConsumer</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.consumer_type</code></td>
+<td>An example list of consumer type.    "ActiveScriptEventConsumer" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.    "CommandLineEventConsumer" - Launches an arbitrary process in the local system context when an event is delivered to it.    "LogFileEventConsumer" - Writes customized strings to a text log file when events are delivered to it.    "NTEventLogEventConsumer" - Logs a specific message to the Windows event log when an event is delivered to it.    "SMTPEventConsumer" - Sends an email message using SMTP each time an event is delivered to it.</td>
+<td><code>CommandLineEventConsumer</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.event_filter_details</code></td>
+<td>Provide an overview of the query that define when an event should be triggered.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.event_filter_name</code></td>
+<td>Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.</td>
+<td><code>ExampleFilter</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.namespace</code></td>
+<td>WMI namespace to which the connection is made.</td>
+<td><code>root\Microsoft\Windows\DeviceGuard</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.parameters.operation</code></td>
+<td>Specifies the connection or request to WMI</td>
+<td><code>Win32_Process::Create</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.api.summary</code></td>
+<td>The summary of the API call and its parameters.</td>
+<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/linux/linux_file_create.md b/custom_documentation/doc/sample_output/file/linux/linux_file_create.md
index ab2cff0dd..072fcbfd1 100644
--- a/custom_documentation/doc/sample_output/file/linux/linux_file_create.md
+++ b/custom_documentation/doc/sample_output/file/linux/linux_file_create.md
@@ -25,61 +25,290 @@ This event is generated when a file is created.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/linux/linux_file_delete.md b/custom_documentation/doc/sample_output/file/linux/linux_file_delete.md
index c3634a767..9bdcf7945 100644
--- a/custom_documentation/doc/sample_output/file/linux/linux_file_delete.md
+++ b/custom_documentation/doc/sample_output/file/linux/linux_file_delete.md
@@ -25,60 +25,285 @@ This event is generated when a file is deleted.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md
index 7baedaabe..f0e21ed97 100644
--- a/custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md
+++ b/custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md
@@ -25,44 +25,205 @@ This event is generated when Endpoint restores a file from the malware quarantin
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.Ext.correlation.id<code></td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
-<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.Ext.correlation.id</code></td>
+<td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.path</code></td>
+<td>Original file path prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/linux/linux_file_rename.md b/custom_documentation/doc/sample_output/file/linux/linux_file_rename.md
index a01747260..37a126982 100644
--- a/custom_documentation/doc/sample_output/file/linux/linux_file_rename.md
+++ b/custom_documentation/doc/sample_output/file/linux/linux_file_rename.md
@@ -25,64 +25,305 @@ This event is generated when a file is renamed.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.original.extension<code></td><td>Original file extension prior to a modification event</td></tr>
-<tr><td><code>file.Ext.original.name<code></td><td>Original file name prior to a modification event</td></tr>
-<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.extension</code></td>
+<td>Original file extension prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.name</code></td>
+<td>Original file name prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.path</code></td>
+<td>Original file path prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_access.md b/custom_documentation/doc/sample_output/file/macos/macos_file_access.md
index 0936150f7..cf4ccfb10 100644
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_access.md
+++ b/custom_documentation/doc/sample_output/file/macos/macos_file_access.md
@@ -25,53 +25,250 @@ This event is generated when a file is accessed.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.inode</code></td>
+<td>Inode representing the file in the filesystem.</td>
+<td><code>256383</code></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_delete.md b/custom_documentation/doc/sample_output/file/macos/macos_file_delete.md
index 6ccd427a9..02bde259a 100644
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_delete.md
+++ b/custom_documentation/doc/sample_output/file/macos/macos_file_delete.md
@@ -25,68 +25,325 @@ This event is generated when a file is deleted.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.inode</code></td>
+<td>Inode representing the file in the filesystem.</td>
+<td><code>256383</code></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md
index ee6d86b35..920c63712 100644
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md
+++ b/custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md
@@ -25,44 +25,205 @@ This event is generated when Endpoint restores a file from the malware quarantin
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.Ext.correlation.id<code></td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
-<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.Ext.correlation.id</code></td>
+<td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.path</code></td>
+<td>Original file path prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md b/custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md
index 3df501790..79b405a10 100644
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md
+++ b/custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md
@@ -25,68 +25,325 @@ This event is generated when extended file attributes are deleted.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.attributes<code></td><td>Array of file attributes.  Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.attributes</code></td>
+<td>Array of file attributes.  Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.</td>
+<td><code>["readonly", "system"]</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.inode</code></td>
+<td>Inode representing the file in the filesystem.</td>
+<td><code>256383</code></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md b/custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md
index 885832a23..b2cda42f5 100644
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md
+++ b/custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md
@@ -25,66 +25,315 @@ This event includes information about a macOS Launch Daemon.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>Persistence.args<code></td><td>Arguments used to execute the persistence item</td></tr>
-<tr><td><code>Persistence.keepalive<code></td><td>Keep alive option boolean</td></tr>
-<tr><td><code>Persistence.name<code></td><td>The persistence item's name</td></tr>
-<tr><td><code>Persistence.path<code></td><td>The file's path</td></tr>
-<tr><td><code>Persistence.runatload<code></td><td>Run at load option boolean</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>Persistence.args</code></td>
+<td>Arguments used to execute the persistence item</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Persistence.keepalive</code></td>
+<td>Keep alive option boolean</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Persistence.name</code></td>
+<td>The persistence item's name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Persistence.path</code></td>
+<td>The file's path</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Persistence.runatload</code></td>
+<td>Run at load option boolean</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_modification.md b/custom_documentation/doc/sample_output/file/macos/macos_file_modification.md
index 5ce48f557..3454295dd 100644
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_modification.md
+++ b/custom_documentation/doc/sample_output/file/macos/macos_file_modification.md
@@ -25,70 +25,335 @@ This event is generated when a file is modified.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.header_bytes</code></td>
+<td>First 16 bytes of file used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.inode</code></td>
+<td>Inode representing the file in the filesystem.</td>
+<td><code>256383</code></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_mount.md b/custom_documentation/doc/sample_output/file/macos/macos_file_mount.md
index da8c26e74..2084a1e82 100644
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_mount.md
+++ b/custom_documentation/doc/sample_output/file/macos/macos_file_mount.md
@@ -25,65 +25,310 @@ This event is generated when a file system is mounted.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
-<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.path</code></td>
+<td>Original file path prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.inode</code></td>
+<td>Inode representing the file in the filesystem.</td>
+<td><code>256383</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_rename.md b/custom_documentation/doc/sample_output/file/macos/macos_file_rename.md
index 7b5a2690b..141f4d1df 100644
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_rename.md
+++ b/custom_documentation/doc/sample_output/file/macos/macos_file_rename.md
@@ -25,71 +25,340 @@ This event is generated when a file is renamed.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.original.extension<code></td><td>Original file extension prior to a modification event</td></tr>
-<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.inode<code></td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.extension</code></td>
+<td>Original file extension prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.path</code></td>
+<td>Original file path prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.inode</code></td>
+<td>Inode representing the file in the filesystem.</td>
+<td><code>256383</code></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_create.md b/custom_documentation/doc/sample_output/file/windows/windows_file_create.md
index a826ddbe1..98906c489 100644
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_create.md
+++ b/custom_documentation/doc/sample_output/file/windows/windows_file_create.md
@@ -25,72 +25,345 @@ This event is generated when a file is created.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
-<tr><td><code>file.Ext.windows.zone_identifier<code></td><td>Windows zone identifier for a file</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.origin_referrer_url<code></td><td>The url of the webpage that linked to the file.</td></tr>
-<tr><td><code>file.origin_url<code></td><td>The url where the file is hosted.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.entropy</code></td>
+<td>Entropy calculation of file's header and footer used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.header_bytes</code></td>
+<td>First 16 bytes of file used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.monotonic_id</code></td>
+<td>File event monotonic ID.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.windows.zone_identifier</code></td>
+<td>Windows zone identifier for a file</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.origin_referrer_url</code></td>
+<td>The url of the webpage that linked to the file.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.origin_url</code></td>
+<td>The url where the file is hosted.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_delete.md b/custom_documentation/doc/sample_output/file/windows/windows_file_delete.md
index 77603e93e..03dcabca9 100644
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_delete.md
+++ b/custom_documentation/doc/sample_output/file/windows/windows_file_delete.md
@@ -25,67 +25,320 @@ This event is generated when a file is deleted.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.entropy</code></td>
+<td>Entropy calculation of file's header and footer used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.monotonic_id</code></td>
+<td>File event monotonic ID.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md
index 5305e448a..e63d6b373 100644
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md
+++ b/custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md
@@ -25,44 +25,205 @@ This event is generated when Endpoint restores a file from the malware quarantin
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.Ext.correlation.id<code></td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
-<tr><td><code>file.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>file.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.Ext.correlation.id</code></td>
+<td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.path</code></td>
+<td>Original file path prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_modification.md b/custom_documentation/doc/sample_output/file/windows/windows_file_modification.md
index 1a9e61a77..0737706e3 100644
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_modification.md
+++ b/custom_documentation/doc/sample_output/file/windows/windows_file_modification.md
@@ -25,68 +25,325 @@ This event is generated when a file is modified.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.entropy</code></td>
+<td>Entropy calculation of file's header and footer used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.header_bytes</code></td>
+<td>First 16 bytes of file used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.monotonic_id</code></td>
+<td>File event monotonic ID.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_open.md b/custom_documentation/doc/sample_output/file/windows/windows_file_open.md
index d4cc6b78f..10b5a6c03 100644
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_open.md
+++ b/custom_documentation/doc/sample_output/file/windows/windows_file_open.md
@@ -25,69 +25,330 @@ This event is generated when a file is opened.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.entropy</code></td>
+<td>Entropy calculation of file's header and footer used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.header_bytes</code></td>
+<td>First 16 bytes of file used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.monotonic_id</code></td>
+<td>File event monotonic ID.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md b/custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md
index 295147510..abf0063ee 100644
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md
+++ b/custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md
@@ -25,68 +25,325 @@ This event is generated when a file is overwritten
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.entropy</code></td>
+<td>Entropy calculation of file's header and footer used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.header_bytes</code></td>
+<td>First 16 bytes of file used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.monotonic_id</code></td>
+<td>File event monotonic ID.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_rename.md b/custom_documentation/doc/sample_output/file/windows/windows_file_rename.md
index 4c6126a72..8afc5a176 100644
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_rename.md
+++ b/custom_documentation/doc/sample_output/file/windows/windows_file_rename.md
@@ -25,72 +25,345 @@ This event is generated when a file is renamed.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.Ext.entropy<code></td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.header_bytes<code></td><td>First 16 bytes of file used to check file integrity.</td></tr>
-<tr><td><code>file.Ext.monotonic_id<code></td><td>File event monotonic ID.</td></tr>
-<tr><td><code>file.Ext.original.extension<code></td><td>Original file extension prior to a modification event</td></tr>
-<tr><td><code>file.Ext.original.name<code></td><td>Original file name prior to a modification event</td></tr>
-<tr><td><code>file.Ext.original.path<code></td><td>Original file path prior to a modification event</td></tr>
-<tr><td><code>file.extension<code></td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td><code>file.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>file.name<code></td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>file.size<code></td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.id<code></td><td>Thread ID.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.entropy</code></td>
+<td>Entropy calculation of file's header and footer used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.header_bytes</code></td>
+<td>First 16 bytes of file used to check file integrity.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.monotonic_id</code></td>
+<td>File event monotonic ID.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.extension</code></td>
+<td>Original file extension prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.name</code></td>
+<td>Original file name prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.Ext.original.path</code></td>
+<td>Original file path prior to a modification event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.extension</code></td>
+<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
+<td><code>png</code></td>
+</tr>
+<tr>
+<td><code>file.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.name</code></td>
+<td>Name of the file including the extension, without the directory.</td>
+<td><code>example.png</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>file.size</code></td>
+<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
+<td><code>16384</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.id</code></td>
+<td>Thread ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/library/macos/macos_library_load.md b/custom_documentation/doc/sample_output/library/macos/macos_library_load.md
index b18907bcb..55198a076 100644
--- a/custom_documentation/doc/sample_output/library/macos/macos_library_load.md
+++ b/custom_documentation/doc/sample_output/library/macos/macos_library_load.md
@@ -25,71 +25,340 @@ This event is generated when a dynlib is loaded.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>dll.Ext.size<code></td><td>Size of DLL</td></tr>
-<tr><td><code>dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>dll.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>dll.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td><code>dll.path<code></td><td>Full file path of the library.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.size</code></td>
+<td>Size of DLL</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>dll.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>dll.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>dll.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>dll.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.name</code></td>
+<td>Name of the library.  This generally maps to the name of the file on disk.</td>
+<td><code>kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>dll.path</code></td>
+<td>Full file path of the library.</td>
+<td><code>C:\Windows\System32\kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/library/windows/windows_library_load.md b/custom_documentation/doc/sample_output/library/windows/windows_library_load.md
index 4953cdbd9..0291a7a1f 100644
--- a/custom_documentation/doc/sample_output/library/windows/windows_library_load.md
+++ b/custom_documentation/doc/sample_output/library/windows/windows_library_load.md
@@ -25,77 +25,370 @@ This event is generated when a DLL or driver is loaded.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>dll.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>dll.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>dll.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>dll.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>dll.Ext.defense_evasions<code></td><td>List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump.</td></tr>
-<tr><td><code>dll.Ext.load_index<code></td><td>A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.  The first load index is 1.</td></tr>
-<tr><td><code>dll.Ext.relative_file_creation_time<code></td><td>Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
-<tr><td><code>dll.Ext.relative_file_name_modify_time<code></td><td>Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td></tr>
-<tr><td><code>dll.Ext.size<code></td><td>Size of DLL</td></tr>
-<tr><td><code>dll.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>dll.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>dll.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>dll.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>dll.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>dll.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>dll.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>dll.name<code></td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td><code>dll.path<code></td><td>Full file path of the library.</td></tr>
-<tr><td><code>dll.pe.file_version<code></td><td>Internal version of the file, provided at compile-time.</td></tr>
-<tr><td><code>dll.pe.imphash<code></td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
-<tr><td><code>dll.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>dll.Ext.defense_evasions</code></td>
+<td>List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.Ext.load_index</code></td>
+<td>A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.  The first load index is 1.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.Ext.relative_file_creation_time</code></td>
+<td>Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.Ext.relative_file_name_modify_time</code></td>
+<td>Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.Ext.size</code></td>
+<td>Size of DLL</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>dll.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>dll.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>dll.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>dll.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dll.name</code></td>
+<td>Name of the library.  This generally maps to the name of the file on disk.</td>
+<td><code>kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>dll.path</code></td>
+<td>Full file path of the library.</td>
+<td><code>C:\Windows\System32\kernel32.dll</code></td>
+</tr>
+<tr>
+<td><code>dll.pe.file_version</code></td>
+<td>Internal version of the file, provided at compile-time.</td>
+<td><code>6.3.9600.17415</code></td>
+</tr>
+<tr>
+<td><code>dll.pe.imphash</code></td>
+<td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td>
+<td><code>0c6803c4e922103c4dca5963aad36ddf</code></td>
+</tr>
+<tr>
+<td><code>dll.pe.original_file_name</code></td>
+<td>Internal name of the file, provided at compile-time.</td>
+<td><code>MSPAINT.EXE</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/metadata/metadata.md b/custom_documentation/doc/sample_output/metadata/metadata.md
index 4559efebc..9ae2f77ba 100644
--- a/custom_documentation/doc/sample_output/metadata/metadata.md
+++ b/custom_documentation/doc/sample_output/metadata/metadata.md
@@ -25,48 +25,225 @@ This is a relatively small state management document that includes details about
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.capabilities<code></td><td>Enabled capabilities</td></tr>
-<tr><td><code>Endpoint.configuration.isolation<code></td><td>Configuration setting for Host Isolation from the network</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.status<code></td><td>the status of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.state.isolation<code></td><td>Current network isolation state of the host</td></tr>
-<tr><td><code>Endpoint.state.tamper_protection<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.status<code></td><td>The current status of the endpoint e.g. enrolled, unenrolled.</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.capabilities</code></td>
+<td>Enabled capabilities</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.configuration.isolation</code></td>
+<td>Configuration setting for Host Isolation from the network</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.status</code></td>
+<td>the status of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.state.isolation</code></td>
+<td>Current network isolation state of the host</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.state.tamper_protection</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.status</code></td>
+<td>The current status of the endpoint e.g. enrolled, unenrolled.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/metrics/metrics.md b/custom_documentation/doc/sample_output/metrics/metrics.md
index d8eeaf981..6647a919c 100644
--- a/custom_documentation/doc/sample_output/metrics/metrics.md
+++ b/custom_documentation/doc/sample_output/metrics/metrics.md
@@ -25,188 +25,925 @@ This is an internal state management document that includes metrics on Endpoint'
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.behavior.rtt<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.behavior.timeout_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.malware_score.rtt<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.malware_score.timeout_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.rtt<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.timeout_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.ransomware.rtt<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.ransomware.timeout_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.rtt<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.timeout_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.shell_code.rtt<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cloud_services.reputation_lookups.shell_code.timeout_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cpu.endpoint.histogram.counts<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cpu.endpoint.histogram.values<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.cpu.endpoint.latest<code></td><td>Average CPU over the last sample interval</td></tr>
-<tr><td><code>Endpoint.metrics.cpu.endpoint.mean<code></td><td>Average CPU load used by the endpoint</td></tr>
-<tr><td><code>Endpoint.metrics.disks.device<code></td><td>Device name</td></tr>
-<tr><td><code>Endpoint.metrics.disks.endpoint_drive<code></td><td>This field will be present and set to true only for the drive that holds the installed endpoint</td></tr>
-<tr><td><code>Endpoint.metrics.disks.free<code></td><td>The number of bytes marked as free on the disk</td></tr>
-<tr><td><code>Endpoint.metrics.disks.fstype<code></td><td>The file system type for the drive</td></tr>
-<tr><td><code>Endpoint.metrics.disks.mount<code></td><td>The disks mount location</td></tr>
-<tr><td><code>Endpoint.metrics.disks.total<code></td><td>The size of the disk in bytes</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.alerts.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.alerts.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.alerts.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.alerts.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.api_events.sent_bytes<code></td><td>Total size of API Event sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.api_events.sent_count<code></td><td>Number of sent API Event documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.sent_bytes<code></td><td>Total size of API Event sent documents from source</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.sent_count<code></td><td>Number of sent API Event documents from source</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.source<code></td><td>API Event document source name</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes<code></td><td>Total size of suppressed API Event documents from source</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.api_events.sources.suppressed_count<code></td><td>Number of suppressed API Event documents from source</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.api_events.suppressed_bytes<code></td><td>Total size of suppressed API Event documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.api_events.suppressed_count<code></td><td>Number of suppressed API Event documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.device_events.sent_bytes<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.device_events.sent_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.device_events.suppressed_bytes<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.device_events.suppressed_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.dns_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.dns_events.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.dns_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.dns_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.file_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.file_events.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.file_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.file_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.library_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.library_events.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.library_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.library_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.network_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.network_events.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.network_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.network_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.overall.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.overall.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.overall.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.overall.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.process_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.process_events.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.process_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.process_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.registry_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.registry_events.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.registry_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.registry_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.security_events.sent_bytes<code></td><td>Total size of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.security_events.sent_count<code></td><td>Number of sent documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.security_events.suppressed_bytes<code></td><td>Total size of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.security_events.suppressed_count<code></td><td>Number of suppressed documents</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.volume_device_events.sent_bytes<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.volume_device_events.sent_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.volume_device_events.suppressed_bytes<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.documents_volume.volume_device_events.suppressed_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.event_filter.active_global_count<code></td><td>The number of active global event filters</td></tr>
-<tr><td><code>Endpoint.metrics.event_filter.active_user_count<code></td><td>The number of active user event filters</td></tr>
-<tr><td><code>Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent<code></td><td>Perfect of Endpoint's update spent running the rule</td></tr>
-<tr><td><code>Endpoint.metrics.malicious_behavior_rules.id<code></td><td>The rule id</td></tr>
-<tr><td><code>Endpoint.metrics.memory.endpoint.private.latest<code></td><td>The memory usage by the endpoint for the last sample interval</td></tr>
-<tr><td><code>Endpoint.metrics.memory.endpoint.private.mean<code></td><td>Average memory usage by the endpoint since its start</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.amsi_events.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.amsi_events.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.attack_surface_events.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.attack_surface_events.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.authentication_events.week_idle_ms<code></td><td>The total milliseconds spent queueing authentication events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.authentication_events.week_ms<code></td><td>The total milliseconds spent on authentication events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.behavior_protection.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.behavior_protection.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.cred_access_events.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.cred_access_events.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.dns_events.week_idle_ms<code></td><td>The total milliseconds spent queueing DNS events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.dns_events.week_ms<code></td><td>The total milliseconds spent on DNS events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.file_events.week_idle_ms<code></td><td>The total milliseconds spent queueing file events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.file_events.week_ms<code></td><td>The total milliseconds spent on file events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.kernel_api_events.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.kernel_api_events.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.library_load_events.week_idle_ms<code></td><td>The total milliseconds spent queueing library load events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.library_load_events.week_ms<code></td><td>The total milliseconds spent on library load events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.malware.week_idle_ms<code></td><td>The total milliseconds spent queueing malware scanning due to the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.malware.week_ms<code></td><td>The total milliseconds spent on malware scanning due to the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.memory_scan.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.memory_scan.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.network_events.week_idle_ms<code></td><td>The total milliseconds spent queueing network events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.network_events.week_ms<code></td><td>The total milliseconds spent on network events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.overall.week_idle_ms<code></td><td>The total milliseconds spent queueing activity for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.overall.week_ms<code></td><td>The total milliseconds spent monitoring the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.signing_id<code></td><td>'The identifier used to sign the binary.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.team_id<code></td><td>'The team identifier used to sign the binary.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process.executable<code></td><td>Path to the process executable for the impact entry</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process_events.week_idle_ms<code></td><td>The total milliseconds spent queueing process events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process_events.week_ms<code></td><td>The total milliseconds spent on process events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process_injection.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.process_injection.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.ransomware.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.ransomware.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.registry_events.week_idle_ms<code></td><td>The total milliseconds spent queueing registry events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.registry_events.week_ms<code></td><td>The total milliseconds spent on registry events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.tcpip_events.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.tcpip_events.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms<code></td><td>The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.threat_intelligence_events.week_ms<code></td><td>The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.volume_device_events.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.volume_device_events.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.win32k_events.week_idle_ms<code></td><td>The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.win32k_events.week_ms<code></td><td>The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.wmi_events.week_idle_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.system_impact.wmi_events.week_ms<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.threads.cpu.mean<code></td><td>The thread's average CPU use</td></tr>
-<tr><td><code>Endpoint.metrics.threads.name<code></td><td>The thread name</td></tr>
-<tr><td><code>Endpoint.metrics.top_process_trees.values.event_count<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.top_process_trees.values.last_seen<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.top_process_trees.values.sample.command_line<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.top_process_trees.values.sample.entity_id<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.top_process_trees.values.sample.executable<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.top_process_trees.values.sample.parent_command_line<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.top_process_trees.window_end<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.top_process_trees.window_start<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.metrics.uptime.endpoint<code></td><td>Number of seconds since the endpoint was started</td></tr>
-<tr><td><code>Endpoint.metrics.uptime.system<code></td><td>Number of seconds since the system was started</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.behavior.rtt</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.behavior.timeout_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.malware_score.rtt</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.malware_score.timeout_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.rtt</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.timeout_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.ransomware.rtt</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.ransomware.timeout_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.rtt</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.timeout_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.shell_code.rtt</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cloud_services.reputation_lookups.shell_code.timeout_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cpu.endpoint.histogram.counts</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cpu.endpoint.histogram.values</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cpu.endpoint.latest</code></td>
+<td>Average CPU over the last sample interval</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.cpu.endpoint.mean</code></td>
+<td>Average CPU load used by the endpoint</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.disks.device</code></td>
+<td>Device name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.disks.endpoint_drive</code></td>
+<td>This field will be present and set to true only for the drive that holds the installed endpoint</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.disks.free</code></td>
+<td>The number of bytes marked as free on the disk</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.disks.fstype</code></td>
+<td>The file system type for the drive</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.disks.mount</code></td>
+<td>The disks mount location</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.disks.total</code></td>
+<td>The size of the disk in bytes</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.alerts.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.alerts.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.alerts.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.alerts.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.api_events.sent_bytes</code></td>
+<td>Total size of API Event sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.api_events.sent_count</code></td>
+<td>Number of sent API Event documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.api_events.sources.sent_bytes</code></td>
+<td>Total size of API Event sent documents from source</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.api_events.sources.sent_count</code></td>
+<td>Number of sent API Event documents from source</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.api_events.sources.source</code></td>
+<td>API Event document source name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes</code></td>
+<td>Total size of suppressed API Event documents from source</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.api_events.sources.suppressed_count</code></td>
+<td>Number of suppressed API Event documents from source</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.api_events.suppressed_bytes</code></td>
+<td>Total size of suppressed API Event documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.api_events.suppressed_count</code></td>
+<td>Number of suppressed API Event documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.device_events.sent_bytes</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.device_events.sent_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.device_events.suppressed_bytes</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.device_events.suppressed_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.dns_events.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.dns_events.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.dns_events.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.dns_events.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.file_events.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.file_events.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.file_events.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.file_events.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.library_events.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.library_events.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.library_events.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.library_events.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.network_events.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.network_events.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.network_events.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.network_events.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.overall.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.overall.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.overall.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.overall.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.process_events.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.process_events.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.process_events.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.process_events.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.registry_events.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.registry_events.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.registry_events.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.registry_events.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.security_events.sent_bytes</code></td>
+<td>Total size of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.security_events.sent_count</code></td>
+<td>Number of sent documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.security_events.suppressed_bytes</code></td>
+<td>Total size of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.security_events.suppressed_count</code></td>
+<td>Number of suppressed documents</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.volume_device_events.sent_bytes</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.volume_device_events.sent_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.volume_device_events.suppressed_bytes</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.documents_volume.volume_device_events.suppressed_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.event_filter.active_global_count</code></td>
+<td>The number of active global event filters</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.event_filter.active_user_count</code></td>
+<td>The number of active user event filters</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent</code></td>
+<td>Perfect of Endpoint's update spent running the rule</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.malicious_behavior_rules.id</code></td>
+<td>The rule id</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.memory.endpoint.private.latest</code></td>
+<td>The memory usage by the endpoint for the last sample interval</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.memory.endpoint.private.mean</code></td>
+<td>Average memory usage by the endpoint since its start</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.amsi_events.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.amsi_events.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.attack_surface_events.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.attack_surface_events.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.authentication_events.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing authentication events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.authentication_events.week_ms</code></td>
+<td>The total milliseconds spent on authentication events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.behavior_protection.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.behavior_protection.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.cred_access_events.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.cred_access_events.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.dns_events.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing DNS events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.dns_events.week_ms</code></td>
+<td>The total milliseconds spent on DNS events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.file_events.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing file events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.file_events.week_ms</code></td>
+<td>The total milliseconds spent on file events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.kernel_api_events.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.kernel_api_events.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.library_load_events.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing library load events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.library_load_events.week_ms</code></td>
+<td>The total milliseconds spent on library load events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.malware.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing malware scanning due to the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.malware.week_ms</code></td>
+<td>The total milliseconds spent on malware scanning due to the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.memory_scan.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.memory_scan.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.network_events.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing network events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.network_events.week_ms</code></td>
+<td>The total milliseconds spent on network events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.overall.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing activity for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.overall.week_ms</code></td>
+<td>The total milliseconds spent monitoring the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process.code_signature.signing_id</code></td>
+<td>'The identifier used to sign the binary.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process.code_signature.team_id</code></td>
+<td>'The team identifier used to sign the binary.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process.executable</code></td>
+<td>Path to the process executable for the impact entry</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process_events.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing process events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process_events.week_ms</code></td>
+<td>The total milliseconds spent on process events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process_injection.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.process_injection.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.ransomware.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.ransomware.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.registry_events.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing registry events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.registry_events.week_ms</code></td>
+<td>The total milliseconds spent on registry events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.tcpip_events.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.tcpip_events.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.threat_intelligence_events.week_ms</code></td>
+<td>The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.volume_device_events.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.volume_device_events.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.win32k_events.week_idle_ms</code></td>
+<td>The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.win32k_events.week_ms</code></td>
+<td>The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.wmi_events.week_idle_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.system_impact.wmi_events.week_ms</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.threads.cpu.mean</code></td>
+<td>The thread's average CPU use</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.threads.name</code></td>
+<td>The thread name</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.top_process_trees.values.event_count</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.top_process_trees.values.last_seen</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.top_process_trees.values.sample.command_line</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.top_process_trees.values.sample.entity_id</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.top_process_trees.values.sample.executable</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.top_process_trees.values.sample.parent_command_line</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.top_process_trees.window_end</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.top_process_trees.window_start</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.uptime.endpoint</code></td>
+<td>Number of seconds since the endpoint was started</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.metrics.uptime.system</code></td>
+<td>Number of seconds since the system was started</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
index a4f85bf3d..c4cb6a7e9 100644
--- a/custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
+++ b/custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
@@ -25,72 +25,345 @@ This event is generated when a network session is accepted, attempted or termina
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>destination.bytes<code></td><td>Bytes sent from the destination to the source.</td></tr>
-<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>network.direction<code></td><td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td></tr>
-<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>source.bytes<code></td><td>Bytes sent from the source to the destination.</td></tr>
-<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>destination.address</code></td>
+<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.bytes</code></td>
+<td>Bytes sent from the destination to the source.</td>
+<td><code>184</code></td>
+</tr>
+<tr>
+<td><code>destination.ip</code></td>
+<td>IP address of the destination (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.port</code></td>
+<td>Port of the destination.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>network.direction</code></td>
+<td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td>
+<td><code>inbound</code></td>
+</tr>
+<tr>
+<td><code>network.transport</code></td>
+<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
+<td><code>tcp</code></td>
+</tr>
+<tr>
+<td><code>network.type</code></td>
+<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
+<td><code>ipv4</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.effective</code></td>
+<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.permitted</code></td>
+<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>source.address</code></td>
+<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.bytes</code></td>
+<td>Bytes sent from the source to the destination.</td>
+<td><code>184</code></td>
+</tr>
+<tr>
+<td><code>source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.port</code></td>
+<td>Port of the source.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md b/custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md
index 055b1e734..e99db8d1b 100644
--- a/custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md
+++ b/custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md
@@ -24,55 +24,260 @@ This event is generated when results are returned for a DNS lookup request.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
-<tr><td><code>dns.question.name<code></td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
-<tr><td><code>dns.question.type<code></td><td>The type of record being queried.</td></tr>
-<tr><td><code>dns.resolved_ip<code></td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>network.protocol<code></td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>destination.address</code></td>
+<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.ip</code></td>
+<td>IP address of the destination (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.port</code></td>
+<td>Port of the destination.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.question.name</code></td>
+<td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td>
+<td><code>www.example.com</code></td>
+</tr>
+<tr>
+<td><code>dns.question.type</code></td>
+<td>The type of record being queried.</td>
+<td><code>AAAA</code></td>
+</tr>
+<tr>
+<td><code>dns.resolved_ip</code></td>
+<td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td>
+<td><code>["10.10.10.10", "10.10.10.11"]</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>network.protocol</code></td>
+<td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td>
+<td><code>http</code></td>
+</tr>
+<tr>
+<td><code>network.transport</code></td>
+<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
+<td><code>tcp</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.effective</code></td>
+<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.permitted</code></td>
+<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>source.address</code></td>
+<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.port</code></td>
+<td>Port of the source.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md b/custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
index c6d2a49ee..5cc6e31dd 100644
--- a/custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
+++ b/custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
@@ -25,70 +25,335 @@ This event is generated when a connection is attempted or a request to terminate
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>destination.bytes<code></td><td>Bytes sent from the destination to the source.</td></tr>
-<tr><td><code>destination.domain<code></td><td>The domain name of the destination system.  This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.</td></tr>
-<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>source.bytes<code></td><td>Bytes sent from the source to the destination.</td></tr>
-<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>destination.address</code></td>
+<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.bytes</code></td>
+<td>Bytes sent from the destination to the source.</td>
+<td><code>184</code></td>
+</tr>
+<tr>
+<td><code>destination.domain</code></td>
+<td>The domain name of the destination system.  This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.</td>
+<td><code>foo.example.com</code></td>
+</tr>
+<tr>
+<td><code>destination.ip</code></td>
+<td>IP address of the destination (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.port</code></td>
+<td>Port of the destination.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>network.transport</code></td>
+<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
+<td><code>tcp</code></td>
+</tr>
+<tr>
+<td><code>network.type</code></td>
+<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
+<td><code>ipv4</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>source.address</code></td>
+<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.bytes</code></td>
+<td>Bytes sent from the source to the destination.</td>
+<td><code>184</code></td>
+</tr>
+<tr>
+<td><code>source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.port</code></td>
+<td>Port of the source.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md b/custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md
index 4d2ffb2c2..a50b436c6 100644
--- a/custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md
+++ b/custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md
@@ -25,73 +25,350 @@ This event is generated when results are returned for a DNS lookup request.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
-<tr><td><code>dns.Ext.options<code></td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
-<tr><td><code>dns.Ext.status<code></td><td>DNS status field, uint32</td></tr>
-<tr><td><code>dns.question.name<code></td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
-<tr><td><code>dns.question.type<code></td><td>The type of record being queried.</td></tr>
-<tr><td><code>dns.resolved_ip<code></td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>network.protocol<code></td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>destination.address</code></td>
+<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.ip</code></td>
+<td>IP address of the destination (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.port</code></td>
+<td>Port of the destination.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.Ext.options</code></td>
+<td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.Ext.status</code></td>
+<td>DNS status field, uint32</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.question.name</code></td>
+<td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td>
+<td><code>www.example.com</code></td>
+</tr>
+<tr>
+<td><code>dns.question.type</code></td>
+<td>The type of record being queried.</td>
+<td><code>AAAA</code></td>
+</tr>
+<tr>
+<td><code>dns.resolved_ip</code></td>
+<td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td>
+<td><code>["10.10.10.10", "10.10.10.11"]</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>network.protocol</code></td>
+<td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td>
+<td><code>http</code></td>
+</tr>
+<tr>
+<td><code>network.transport</code></td>
+<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
+<td><code>tcp</code></td>
+</tr>
+<tr>
+<td><code>network.type</code></td>
+<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
+<td><code>ipv4</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>source.address</code></td>
+<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.port</code></td>
+<td>Port of the source.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
index 07dbf37dc..ca04f971c 100644
--- a/custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
+++ b/custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
@@ -25,66 +25,315 @@ This event is generated when a connection is attempted, a connection is accepted
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>destination.address<code></td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>destination.bytes<code></td><td>Bytes sent from the destination to the source.</td></tr>
-<tr><td><code>destination.ip<code></td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>network.direction<code></td><td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td></tr>
-<tr><td><code>network.transport<code></td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>network.type<code></td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.uptime<code></td><td>Seconds the process has been up.</td></tr>
-<tr><td><code>source.address<code></td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-<tr><td><code>source.bytes<code></td><td>Bytes sent from the source to the destination.</td></tr>
-<tr><td><code>source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>source.port<code></td><td>Port of the source.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>destination.address</code></td>
+<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.bytes</code></td>
+<td>Bytes sent from the destination to the source.</td>
+<td><code>184</code></td>
+</tr>
+<tr>
+<td><code>destination.ip</code></td>
+<td>IP address of the destination (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>destination.port</code></td>
+<td>Port of the destination.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>network.direction</code></td>
+<td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td>
+<td><code>inbound</code></td>
+</tr>
+<tr>
+<td><code>network.transport</code></td>
+<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
+<td><code>tcp</code></td>
+</tr>
+<tr>
+<td><code>network.type</code></td>
+<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
+<td><code>ipv4</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.uptime</code></td>
+<td>Seconds the process has been up.</td>
+<td><code>1325</code></td>
+</tr>
+<tr>
+<td><code>source.address</code></td>
+<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.bytes</code></td>
+<td>Bytes sent from the source to the destination.</td>
+<td><code>184</code></td>
+</tr>
+<tr>
+<td><code>source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>source.port</code></td>
+<td>Port of the source.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md b/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md
index 78261f412..9c0f41528 100644
--- a/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md
+++ b/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md
@@ -25,60 +25,285 @@ This event is generated when a DNS lookup request is initiated.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
-<tr><td><code>dns.Ext.options<code></td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
-<tr><td><code>dns.Ext.status<code></td><td>DNS status field, uint32</td></tr>
-<tr><td><code>dns.question.name<code></td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>network.destination.port<code></td><td>No description found</td></tr>
-<tr><td><code>network.protocol<code></td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>destination.port</code></td>
+<td>Port of the destination.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.Ext.options</code></td>
+<td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.Ext.status</code></td>
+<td>DNS status field, uint32</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.question.name</code></td>
+<td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td>
+<td><code>www.example.com</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>network.destination.port</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>network.protocol</code></td>
+<td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td>
+<td><code>http</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md b/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md
index 24db62975..f21e46641 100644
--- a/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md
+++ b/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md
@@ -25,61 +25,290 @@ This event is generated when results are returned for a DNS lookup request.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>destination.port<code></td><td>Port of the destination.</td></tr>
-<tr><td><code>dns.Ext.options<code></td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
-<tr><td><code>dns.Ext.status<code></td><td>DNS status field, uint32</td></tr>
-<tr><td><code>dns.question.name<code></td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
-<tr><td><code>dns.resolved_ip<code></td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>network.destination.port<code></td><td>No description found</td></tr>
-<tr><td><code>network.protocol<code></td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>destination.port</code></td>
+<td>Port of the destination.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.Ext.options</code></td>
+<td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.Ext.status</code></td>
+<td>DNS status field, uint32</td>
+<td></td>
+</tr>
+<tr>
+<td><code>dns.question.name</code></td>
+<td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td>
+<td><code>www.example.com</code></td>
+</tr>
+<tr>
+<td><code>dns.resolved_ip</code></td>
+<td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td>
+<td><code>["10.10.10.10", "10.10.10.11"]</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>network.destination.port</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>network.protocol</code></td>
+<td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td>
+<td><code>http</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/policy/policy_response.md b/custom_documentation/doc/sample_output/policy/policy_response.md
index e357c54a8..02a8001a0 100644
--- a/custom_documentation/doc/sample_output/policy/policy_response.md
+++ b/custom_documentation/doc/sample_output/policy/policy_response.md
@@ -25,89 +25,430 @@ This is a state management document that is generated every time Endpoint refres
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Endpoint.configuration.isolation<code></td><td>Configuration setting for Host Isolation from the network</td></tr>
-<tr><td><code>Endpoint.policy.applied.actions.message<code></td><td>message about the application of the action to further qualify the status of the action</td></tr>
-<tr><td><code>Endpoint.policy.applied.actions.name<code></td><td>name of the action that was applied</td></tr>
-<tr><td><code>Endpoint.policy.applied.actions.status<code></td><td>the status of the action</td></tr>
-<tr><td><code>Endpoint.policy.applied.actions.status<code></td><td>the status of the action</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.channel<code></td><td>global artifacts rollout channel</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.name<code></td><td>the name of global artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256<code></td><td>the sha256 of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.snapshot<code></td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.update_age<code></td><td>number of days since global artifacts were made up-to-date</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.global.version<code></td><td>the version of global artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.name<code></td><td>the name of user artifact applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256<code></td><td>the sha256 of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.artifacts.user.version<code></td><td>the version of user artifacts applied.</td></tr>
-<tr><td><code>Endpoint.policy.applied.endpoint_policy_version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.id<code></td><td>the id of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.name<code></td><td>the name of this applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions<code></td><td>all actions that were taken for antivirus registration</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.antivirus_registration.status<code></td><td>the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions<code></td><td>all actions that were taken for attack surface reduction</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.attack_surface_reduction.status<code></td><td>the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions<code></td><td>all actions that were taken for behavior_protection</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.behavior_protection.status<code></td><td>the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.events.concerned_actions<code></td><td>all actions that were taken for event collection</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.events.status<code></td><td>the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions<code></td><td>all actions that were taken for host isolation</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.host_isolation.status<code></td><td>the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.logging.concerned_actions<code></td><td>all actions that were taken for logging</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.logging.status<code></td><td>the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.malware.concerned_actions<code></td><td>all actions that were taken for malware</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.malware.status<code></td><td>the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions<code></td><td>all actions that were taken for memory_protection</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.memory_protection.status<code></td><td>the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.ransomware.concerned_actions<code></td><td>all actions that were taken for ransomware</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.ransomware.status<code></td><td>the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.response_actions.concerned_actions<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.response_actions.status<code></td><td>No description found</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.streaming.concerned_actions<code></td><td>all actions that were taken for data streaming</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.configurations.streaming.status<code></td><td>the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions<code></td><td>all actions that were taken for the diagnostic configuration of behavior protection</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.diagnostic.behavior_protection.status<code></td><td>the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.diagnostic.malware.concerned_actions<code></td><td>all actions that were taken for the diagnostic configuration of malware</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.diagnostic.malware.status<code></td><td>the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions<code></td><td>all actions that were taken for the diagnostic configuration of memory protection</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.diagnostic.memory_protection.status<code></td><td>the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions<code></td><td>all actions that were taken for the diagnostic configuration of ransomware</td></tr>
-<tr><td><code>Endpoint.policy.applied.response.diagnostic.ransomware.status<code></td><td>the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
-<tr><td><code>Endpoint.policy.applied.status<code></td><td>the status of the applied policy</td></tr>
-<tr><td><code>Endpoint.policy.applied.version<code></td><td>the version of this applied policy</td></tr>
-<tr><td><code>Endpoint.state.isolation<code></td><td>Current network isolation state of the host</td></tr>
-<tr><td><code>Endpoint.state.tamper_protection<code></td><td>No description found</td></tr>
-<tr><td><code>agent.build.original<code></td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.configuration.isolation</code></td>
+<td>Configuration setting for Host Isolation from the network</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.actions.message</code></td>
+<td>message about the application of the action to further qualify the status of the action</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.actions.name</code></td>
+<td>name of the action that was applied</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.actions.status</code></td>
+<td>the status of the action</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.actions.status</code></td>
+<td>the status of the action</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
+<td>The channel of the linux artifact.</td>
+<td><code>stable</code></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
+<td>the name of global artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
+<td>the sha256 of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
+<td>the snapshot date of applied global artifacts or 'latest'</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
+<td>number of days since global artifacts were made up-to-date</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
+<td>the version of global artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
+<td>the name of user artifact applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
+<td>the sha256 of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
+<td>the version of user artifacts applied.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.id</code></td>
+<td>the id of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.name</code></td>
+<td>the name of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions</code></td>
+<td>all actions that were taken for antivirus registration</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.antivirus_registration.status</code></td>
+<td>the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions</code></td>
+<td>all actions that were taken for attack surface reduction</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.attack_surface_reduction.status</code></td>
+<td>the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions</code></td>
+<td>all actions that were taken for behavior_protection</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.behavior_protection.status</code></td>
+<td>the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.events.concerned_actions</code></td>
+<td>all actions that were taken for event collection</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.events.status</code></td>
+<td>the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions</code></td>
+<td>all actions that were taken for host isolation</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.host_isolation.status</code></td>
+<td>the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.logging.concerned_actions</code></td>
+<td>all actions that were taken for logging</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.logging.status</code></td>
+<td>the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.malware.concerned_actions</code></td>
+<td>all actions that were taken for malware</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.malware.status</code></td>
+<td>the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions</code></td>
+<td>all actions that were taken for memory_protection</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.memory_protection.status</code></td>
+<td>the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.ransomware.concerned_actions</code></td>
+<td>all actions that were taken for ransomware</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.ransomware.status</code></td>
+<td>the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.response_actions.concerned_actions</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.response_actions.status</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.streaming.concerned_actions</code></td>
+<td>all actions that were taken for data streaming</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.configurations.streaming.status</code></td>
+<td>the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions</code></td>
+<td>all actions that were taken for the diagnostic configuration of behavior protection</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.diagnostic.behavior_protection.status</code></td>
+<td>the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.diagnostic.malware.concerned_actions</code></td>
+<td>all actions that were taken for the diagnostic configuration of malware</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.diagnostic.malware.status</code></td>
+<td>the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions</code></td>
+<td>all actions that were taken for the diagnostic configuration of memory protection</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.diagnostic.memory_protection.status</code></td>
+<td>the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions</code></td>
+<td>all actions that were taken for the diagnostic configuration of ransomware</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.response.diagnostic.ransomware.status</code></td>
+<td>the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.status</code></td>
+<td>the status of the applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.policy.applied.version</code></td>
+<td>the version of this applied policy</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.state.isolation</code></td>
+<td>Current network isolation state of the host</td>
+<td></td>
+</tr>
+<tr>
+<td><code>Endpoint.state.tamper_protection</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.build.original</code></td>
+<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
+<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md b/custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md
index 41f8e3748..e34bd995e 100644
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md
+++ b/custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md
@@ -25,190 +25,935 @@ This event is generated for a process that was already running before Endpoint's
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.account.id</code></td>
+<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
+<td><code>666777888999</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted</code></td>
+<td>Whether or not the process is a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.effective</code></td>
+<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.permitted</code></td>
+<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md b/custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md
index d02188e0b..40a77fbc8 100644
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md
+++ b/custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md
@@ -25,194 +25,955 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
-<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.account.id</code></td>
+<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
+<td><code>666777888999</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted</code></td>
+<td>Whether or not the process is a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted_descendant</code></td>
+<td>Whether or not the process is a descendent of a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.end</code></td>
+<td>The time the process ended.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.env_vars</code></td>
+<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
+<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.exit_code</code></td>
+<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
+<td><code>137</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.effective</code></td>
+<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.permitted</code></td>
+<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md b/custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md
index a887352b8..d7a61a701 100644
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md
+++ b/custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md
@@ -25,192 +25,945 @@ This event is generated when the group id changes for a process.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.account.id</code></td>
+<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
+<td><code>666777888999</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted_descendant</code></td>
+<td>Whether or not the process is a descendent of a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.end</code></td>
+<td>The time the process ended.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.exit_code</code></td>
+<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
+<td><code>137</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.effective</code></td>
+<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.permitted</code></td>
+<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md b/custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md
index 97e3adf5b..7ed2a2174 100644
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md
+++ b/custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md
@@ -24,196 +24,965 @@ This event is generated when when a memfd anonymous file is created.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
-<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-<tr><td><code>process.Ext.memfd.flag_hugetlb<code></td><td>The anonymous file will be created in the hugetlbfs filesystem using huge pages.</td></tr>
-<tr><td><code>process.Ext.memfd.flag_allow_seal<code></td><td>Allow sealing operations on this file.</td></tr>
-<tr><td><code>process.Ext.memfd.flags<code></td><td>Flags passed to the memfd operation.</td></tr>
-<tr><td><code>process.Ext.memfd.name<code></td><td>Filename for the created file. Appears in /proc/self/fd.</td></tr>
-<tr><td><code>process.Ext.memfd.flag_exec<code></td><td>Exec flag is set for file.</td></tr>
-<tr><td><code>process.Ext.memfd.flag_cloexec<code></td><td>Sets the the close-on-exec flag on the new file descriptor.</td></tr>
-<tr><td><code>process.Ext.memfd.flag_noexec_seal<code></td><td>Sets both NOEXEC and MFD_ALLOW_SEALING.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.account.id</code></td>
+<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
+<td><code>666777888999</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted</code></td>
+<td>Whether or not the process is a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted_descendant</code></td>
+<td>Whether or not the process is a descendent of a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.memfd.flag_hugetlb</code></td>
+<td>The anonymous file will be created in the hugetlbfs filesystem using huge pages.</td>
+<td><code>false</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memfd.flag_allow_seal</code></td>
+<td>Allow sealing operations on this file.</td>
+<td><code>false</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memfd.flags</code></td>
+<td>Flags passed to the memfd operation.</td>
+<td><code>2</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memfd.name</code></td>
+<td>Filename for the created file. Appears in /proc/self/fd.</td>
+<td><code>anon.txt</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memfd.flag_exec</code></td>
+<td>Exec flag is set for file.</td>
+<td><code>false</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memfd.flag_cloexec</code></td>
+<td>Sets the the close-on-exec flag on the new file descriptor.</td>
+<td><code>false</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.memfd.flag_noexec_seal</code></td>
+<td>Sets both NOEXEC and MFD_ALLOW_SEALING.</td>
+<td><code>false</code></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.end</code></td>
+<td>The time the process ended.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.exit_code</code></td>
+<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
+<td><code>137</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md b/custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md
index d8b7fe278..fb06b62b1 100644
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md
+++ b/custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md
@@ -24,192 +24,945 @@ This event is generated when when a process calls ptrace_attach on another proce
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
-<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-<tr><td><code>process.Ext.ptrace.child_pid<code></td><td>PID of the ptrace target.</td></tr>
-<tr><td><code>process.Ext.ptrace.request<code></td><td>ptrace request.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.account.id</code></td>
+<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
+<td><code>666777888999</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted</code></td>
+<td>Whether or not the process is a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted_descendant</code></td>
+<td>Whether or not the process is a descendent of a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.ptrace.child_pid</code></td>
+<td>PID of the ptrace target.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.ptrace.request</code></td>
+<td>ptrace request.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.end</code></td>
+<td>The time the process ended.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.env_vars</code></td>
+<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
+<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.exit_code</code></td>
+<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
+<td><code>137</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md b/custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md
index d4aecea04..6b19319f3 100644
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md
+++ b/custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md
@@ -25,188 +25,925 @@ This event is generated when a process's session id changes.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.account.id</code></td>
+<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
+<td><code>666777888999</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.effective</code></td>
+<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.permitted</code></td>
+<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md b/custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md
index 4bd6c31f3..0387d1535 100644
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md
+++ b/custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md
@@ -24,192 +24,945 @@ This event is generated when when a process calls shmget().
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
-<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-<tr><td><code>process.Ext.shmget.size<code></td><td>Requested size.</td></tr>
-<tr><td><code>process.Ext.shmget.flags<code></td><td>flags passed to shmget.</td></tr>
-<tr><td><code>process.Ext.shmget.key<code></td><td>Key passed to the shmget request.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.account.id</code></td>
+<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
+<td><code>666777888999</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted</code></td>
+<td>Whether or not the process is a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted_descendant</code></td>
+<td>Whether or not the process is a descendent of a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.shmget.size</code></td>
+<td>Requested size.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.shmget.flags</code></td>
+<td>flags passed to shmget.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.shmget.key</code></td>
+<td>Key passed to the shmget request.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.end</code></td>
+<td>The time the process ended.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.env_vars</code></td>
+<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
+<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.exit_code</code></td>
+<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
+<td><code>137</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md b/custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md
index 7177dd69f..afab55eb4 100644
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md
+++ b/custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md
@@ -25,194 +25,955 @@ This event is generated when a process generates text output.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.io.bytes_skipped.length<code></td><td>No description found</td></tr>
-<tr><td><code>process.io.bytes_skipped.offset<code></td><td>No description found</td></tr>
-<tr><td><code>process.io.max_bytes_per_process_exceeded<code></td><td>If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.</td></tr>
-<tr><td><code>process.io.text<code></td><td>A chunk of output or input sanitized to UTF-8.  Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.</td></tr>
-<tr><td><code>process.io.total_bytes_captured<code></td><td>The total number of bytes captured in this event.</td></tr>
-<tr><td><code>process.io.total_bytes_skipped<code></td><td>The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero</td></tr>
-<tr><td><code>process.io.type<code></td><td>No description found</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.tty.columns<code></td><td>The number of character columns per line. e.g terminal width  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td></tr>
-<tr><td><code>process.tty.rows<code></td><td>The number of character rows in the terminal. e.g terminal height  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.io.bytes_skipped.length</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.io.bytes_skipped.offset</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.io.max_bytes_per_process_exceeded</code></td>
+<td>If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.io.text</code></td>
+<td>A chunk of output or input sanitized to UTF-8.  Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.io.total_bytes_captured</code></td>
+<td>The total number of bytes captured in this event.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.io.total_bytes_skipped</code></td>
+<td>The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.io.type</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.effective</code></td>
+<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.permitted</code></td>
+<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.tty.columns</code></td>
+<td>The number of character columns per line. e.g terminal width  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td>
+<td><code>80</code></td>
+</tr>
+<tr>
+<td><code>process.tty.rows</code></td>
+<td>The number of character rows in the terminal. e.g terminal height  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td>
+<td><code>24</code></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md b/custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md
index d922b3840..5aa978abe 100644
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md
+++ b/custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md
@@ -24,193 +24,950 @@ This event is generated when the user id changes for a process.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>cloud.account.id<code></td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td><code>cloud.instance.name<code></td><td>Instance name of the host machine.</td></tr>
-<tr><td><code>cloud.project.id<code></td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td><code>cloud.provider<code></td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td><code>cloud.region<code></td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td><code>container.id<code></td><td>Unique container id.</td></tr>
-<tr><td><code>container.image.hash.all<code></td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td><code>container.image.name<code></td><td>Name of the image the container was built on.</td></tr>
-<tr><td><code>container.image.tag<code></td><td>Container image tags.</td></tr>
-<tr><td><code>container.name<code></td><td>Container name.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>orchestrator.cluster.id<code></td><td>Unique ID of the cluster.</td></tr>
-<tr><td><code>orchestrator.cluster.name<code></td><td>Name of the cluster.</td></tr>
-<tr><td><code>orchestrator.namespace<code></td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td><code>orchestrator.resource.ip<code></td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-<tr><td><code>orchestrator.resource.name<code></td><td>Name of the resource being acted upon.</td></tr>
-<tr><td><code>orchestrator.resource.parent.type<code></td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td><code>orchestrator.resource.type<code></td><td>Type of resource being acted upon.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
-<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.end<code></td><td>The time the process ended.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.entry_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.entry_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.source.ip<code></td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-<tr><td><code>process.entry_leader.entry_meta.type<code></td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-<tr><td><code>process.entry_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.entry_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.entry_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.entry_leader.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.entry_leader.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.entry_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.entry_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.entry_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.entry_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.entry_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.entry_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.entry_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td><code>process.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.group_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.group_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.group_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.group_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.group_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.group_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.group_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.group_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.group_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.group_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.group_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.group_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.group_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.parent.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.parent.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.parent.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.parent.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.parent.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.parent.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.previous.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.previous.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.previous.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.session_leader.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.session_leader.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.session_leader.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.session_leader.group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.interactive<code></td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td><code>process.session_leader.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.session_leader.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.session_leader.real_group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.real_group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.real_user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.real_user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.same_as_process<code></td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td><code>process.session_leader.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.session_leader.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.session_leader.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.session_leader.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.session_leader.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.session_leader.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>process.start<code></td><td>The time the process started.</td></tr>
-<tr><td><code>process.supplemental_groups.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>process.supplemental_groups.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>process.thread.capabilities.effective<code></td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td><code>process.thread.capabilities.permitted<code></td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td><code>process.tty.char_device.major<code></td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td><code>process.tty.char_device.minor<code></td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td><code>process.user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>process.user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>cloud.account.id</code></td>
+<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
+<td><code>666777888999</code></td>
+</tr>
+<tr>
+<td><code>cloud.instance.name</code></td>
+<td>Instance name of the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>cloud.project.id</code></td>
+<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
+<td><code>my-project</code></td>
+</tr>
+<tr>
+<td><code>cloud.provider</code></td>
+<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
+<td><code>aws</code></td>
+</tr>
+<tr>
+<td><code>cloud.region</code></td>
+<td>Region in which this host, resource, or service is located.</td>
+<td><code>us-east-1</code></td>
+</tr>
+<tr>
+<td><code>container.id</code></td>
+<td>Unique container id.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.hash.all</code></td>
+<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
+<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
+</tr>
+<tr>
+<td><code>container.image.name</code></td>
+<td>Name of the image the container was built on.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.image.tag</code></td>
+<td>Container image tags.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>container.name</code></td>
+<td>Container name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.id</code></td>
+<td>Unique ID of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.cluster.name</code></td>
+<td>Name of the cluster.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.namespace</code></td>
+<td>Namespace in which the action is taking place.</td>
+<td><code>kube-system</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.ip</code></td>
+<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.name</code></td>
+<td>Name of the resource being acted upon.</td>
+<td><code>test-pod-cdcws</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.parent.type</code></td>
+<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
+<td><code>DaemonSet</code></td>
+</tr>
+<tr>
+<td><code>orchestrator.resource.type</code></td>
+<td>Type of resource being acted upon.</td>
+<td><code>service</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted</code></td>
+<td>Whether or not the process is a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted_descendant</code></td>
+<td>Whether or not the process is a descendent of a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.end</code></td>
+<td>The time the process ended.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.source.ip</code></td>
+<td>IP address of the source (IPv4 or IPv6).</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.entry_meta.type</code></td>
+<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.entry_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.exit_code</code></td>
+<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
+<td><code>137</code></td>
+</tr>
+<tr>
+<td><code>process.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.group_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.parent.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.parent.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.previous.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.previous.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.interactive</code></td>
+<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.real_user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.same_as_process</code></td>
+<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.session_leader.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>process.start</code></td>
+<td>The time the process started.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.supplemental_groups.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.effective</code></td>
+<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.thread.capabilities.permitted</code></td>
+<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
+<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.major</code></td>
+<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.tty.char_device.minor</code></td>
+<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
+<td><code>1</code></td>
+</tr>
+<tr>
+<td><code>process.user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>process.user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md b/custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md
index a179eb957..a77f02ad3 100644
--- a/custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md
+++ b/custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md
@@ -25,69 +25,330 @@ This event is generated for a process that was already running before Endpoint's
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.effective_parent.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.env_vars</code></td>
+<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
+<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md b/custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md
index 54eadfa71..530ed10b0 100644
--- a/custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md
+++ b/custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md
@@ -25,87 +25,420 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>Target.process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.effective_parent.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>process.Ext.effective_parent.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>process.Ext.effective_parent.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>process.Ext.effective_parent.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
-<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>Target.process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted</code></td>
+<td>Whether or not the process is a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted_descendant</code></td>
+<td>Whether or not the process is a descendent of a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.env_vars</code></td>
+<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
+<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.exit_code</code></td>
+<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
+<td><code>137</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md b/custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md
index 044aa13a6..acc4fd99b 100644
--- a/custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md
+++ b/custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md
@@ -25,82 +25,395 @@ This event is generated when a remote thread is created.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>Target.process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>Target.process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>Target.process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>Target.process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>group.Ext.real.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.Ext.real.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>group.id<code></td><td>Unique identifier for the group on the system/platform.</td></tr>
-<tr><td><code>group.name<code></td><td>Name of the group.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.effective_parent.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.env_vars<code></td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.Ext.real.id<code></td><td>One or multiple unique identifiers of the user.</td></tr>
-<tr><td><code>user.Ext.real.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>Target.process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Target.process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>Target.process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.Ext.real.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.id</code></td>
+<td>Unique identifier for the group on the system/platform.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>group.name</code></td>
+<td>Name of the group.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted</code></td>
+<td>Whether or not the process is a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.env_vars</code></td>
+<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
+<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.id</code></td>
+<td>One or multiple unique identifiers of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.Ext.real.name</code></td>
+<td>Short name or login of the user.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md b/custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md
index bbbe6b9eb..93e30431c 100644
--- a/custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md
+++ b/custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md
@@ -25,94 +25,455 @@ This event is generated for a process that was already running before Endpoint's
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.mitigation_policies<code></td><td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.relative_file_creation_time<code></td><td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
-<tr><td><code>process.Ext.session_info.authentication_package<code></td><td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td></tr>
-<tr><td><code>process.Ext.session_info.client_address<code></td><td>Client's IPv4 or IPv6 address as a string, if available.</td></tr>
-<tr><td><code>process.Ext.session_info.id<code></td><td>Session ID</td></tr>
-<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-<tr><td><code>process.Ext.session_info.relative_logon_time<code></td><td>Process creation time, relative to logon time, in seconds.</td></tr>
-<tr><td><code>process.Ext.session_info.relative_password_age<code></td><td>Process creation time, relative to the last time the password was changed, in seconds.</td></tr>
-<tr><td><code>process.Ext.session_info.user_flags<code></td><td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td></tr>
-<tr><td><code>process.Ext.token.elevation_level<code></td><td>What level of elevation the token has</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.Ext.token.security_attributes<code></td><td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.pe.imphash<code></td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
-<tr><td><code>process.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.mitigation_policies</code></td>
+<td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.relative_file_creation_time</code></td>
+<td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.authentication_package</code></td>
+<td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.client_address</code></td>
+<td>Client's IPv4 or IPv6 address as a string, if available.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.id</code></td>
+<td>Session ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.logon_type</code></td>
+<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.relative_logon_time</code></td>
+<td>Process creation time, relative to logon time, in seconds.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.relative_password_age</code></td>
+<td>Process creation time, relative to the last time the password was changed, in seconds.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.user_flags</code></td>
+<td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation_level</code></td>
+<td>What level of elevation the token has</td>
+<td><code>one of "default", "full", "limited"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.security_attributes</code></td>
+<td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td>
+<td><code>TSA://ProcUnique, LUA://DecHdAutoAp</code></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.pe.imphash</code></td>
+<td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td>
+<td><code>0c6803c4e922103c4dca5963aad36ddf</code></td>
+</tr>
+<tr>
+<td><code>process.pe.original_file_name</code></td>
+<td>Internal name of the file, provided at compile-time.</td>
+<td><code>MSPAINT.EXE</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md b/custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md
index a54aef63b..57344ea11 100644
--- a/custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md
+++ b/custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md
@@ -25,119 +25,580 @@ This event is generated when a process is created or exits.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.created_suspended<code></td><td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td></tr>
-<tr><td><code>process.Ext.defense_evasions<code></td><td>List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping.</td></tr>
-<tr><td><code>process.Ext.device.bus_type<code></td><td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td></tr>
-<tr><td><code>process.Ext.device.dos_name<code></td><td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td></tr>
-<tr><td><code>process.Ext.device.file_system_type<code></td><td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td></tr>
-<tr><td><code>process.Ext.device.nt_name<code></td><td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td></tr>
-<tr><td><code>process.Ext.device.product_id<code></td><td>ProductID of the device. It is provided by the vendor of the device if any.</td></tr>
-<tr><td><code>process.Ext.device.vendor_id<code></td><td>VendorID of the device. It is provided by the vendor of the device.</td></tr>
-<tr><td><code>process.Ext.device.volume_device_type<code></td><td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td></tr>
-<tr><td><code>process.Ext.effective_parent.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>process.Ext.effective_parent.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>process.Ext.effective_parent.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>process.Ext.effective_parent.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>process.Ext.mitigation_policies<code></td><td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td></tr>
-<tr><td><code>process.Ext.protection<code></td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-<tr><td><code>process.Ext.relative_file_creation_time<code></td><td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
-<tr><td><code>process.Ext.relative_file_name_modify_time<code></td><td>Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td></tr>
-<tr><td><code>process.Ext.session_info.authentication_package<code></td><td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td></tr>
-<tr><td><code>process.Ext.session_info.client_address<code></td><td>Client's IPv4 or IPv6 address as a string, if available.</td></tr>
-<tr><td><code>process.Ext.session_info.id<code></td><td>Session ID</td></tr>
-<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-<tr><td><code>process.Ext.session_info.relative_logon_time<code></td><td>Process creation time, relative to logon time, in seconds.</td></tr>
-<tr><td><code>process.Ext.session_info.relative_password_age<code></td><td>Process creation time, relative to the last time the password was changed, in seconds.</td></tr>
-<tr><td><code>process.Ext.session_info.user_flags<code></td><td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td></tr>
-<tr><td><code>process.Ext.token.elevation_level<code></td><td>What level of elevation the token has</td></tr>
-<tr><td><code>process.Ext.token.integrity_level_name<code></td><td>Human readable integrity level.</td></tr>
-<tr><td><code>process.Ext.token.security_attributes<code></td><td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td></tr>
-<tr><td><code>process.Ext.trusted<code></td><td>Whether or not the process is a trusted application</td></tr>
-<tr><td><code>process.Ext.trusted_descendant<code></td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-<tr><td><code>process.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.exit_code<code></td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td><code>process.hash.md5<code></td><td>MD5 hash.</td></tr>
-<tr><td><code>process.hash.sha1<code></td><td>SHA1 hash.</td></tr>
-<tr><td><code>process.hash.sha256<code></td><td>SHA256 hash.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.Ext.real.entity_id<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.Ext.real.pid<code></td><td>For process.parent this will be the ppid of the process that actually spawned the current process.</td></tr>
-<tr><td><code>process.parent.args<code></td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.args_count<code></td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td><code>process.parent.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.parent.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.parent.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.parent.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.parent.command_line<code></td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td><code>process.parent.Ext.command_line_truncated<code></td><td>No description found</td></tr>
-<tr><td><code>process.parent.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.parent.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.parent.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.parent.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.parent.thread.Ext.call_stack.callsite_leading_bytes<code></td><td>Hex opcode bytes preceding the callsite</td></tr>
-<tr><td><code>process.parent.thread.Ext.call_stack.callsite_trailing_bytes<code></td><td>Hex opcode bytes after the callsite (where control will return to)</td></tr>
-<tr><td><code>process.parent.thread.Ext.call_stack.protection<code></td><td>Protection of the page containing this instruction.  This is `R-X' by default if omitted.</td></tr>
-<tr><td><code>process.parent.thread.Ext.call_stack.symbol_info<code></td><td>The nearest symbol for `instruction_pointer`.</td></tr>
-<tr><td><code>process.parent.thread.Ext.call_stack_contains_unbacked<code></td><td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td></tr>
-<tr><td><code>process.parent.thread.Ext.call_stack_summary<code></td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
-<tr><td><code>process.pe.imphash<code></td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
-<tr><td><code>process.pe.original_file_name<code></td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>process.working_directory<code></td><td>The working directory of the process.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.created_suspended</code></td>
+<td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.defense_evasions</code></td>
+<td>List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.device.bus_type</code></td>
+<td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.device.dos_name</code></td>
+<td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.device.file_system_type</code></td>
+<td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.device.nt_name</code></td>
+<td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.device.product_id</code></td>
+<td>ProductID of the device. It is provided by the vendor of the device if any.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.device.vendor_id</code></td>
+<td>VendorID of the device. It is provided by the vendor of the device.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.device.volume_device_type</code></td>
+<td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.effective_parent.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.mitigation_policies</code></td>
+<td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.protection</code></td>
+<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.relative_file_creation_time</code></td>
+<td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.relative_file_name_modify_time</code></td>
+<td>Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.authentication_package</code></td>
+<td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.client_address</code></td>
+<td>Client's IPv4 or IPv6 address as a string, if available.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.id</code></td>
+<td>Session ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.logon_type</code></td>
+<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.relative_logon_time</code></td>
+<td>Process creation time, relative to logon time, in seconds.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.relative_password_age</code></td>
+<td>Process creation time, relative to the last time the password was changed, in seconds.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.user_flags</code></td>
+<td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.elevation_level</code></td>
+<td>What level of elevation the token has</td>
+<td><code>one of "default", "full", "limited"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.integrity_level_name</code></td>
+<td>Human readable integrity level.</td>
+<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.token.security_attributes</code></td>
+<td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td>
+<td><code>TSA://ProcUnique, LUA://DecHdAutoAp</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted</code></td>
+<td>Whether or not the process is a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.trusted_descendant</code></td>
+<td>Whether or not the process is a descendent of a trusted application</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.exit_code</code></td>
+<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
+<td><code>137</code></td>
+</tr>
+<tr>
+<td><code>process.hash.md5</code></td>
+<td>MD5 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha1</code></td>
+<td>SHA1 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.hash.sha256</code></td>
+<td>SHA256 hash.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.real.entity_id</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.real.pid</code></td>
+<td>For process.parent this will be the ppid of the process that actually spawned the current process.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.args</code></td>
+<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
+<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
+</tr>
+<tr>
+<td><code>process.parent.args_count</code></td>
+<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
+<td><code>4</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.parent.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.parent.command_line</code></td>
+<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
+<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
+</tr>
+<tr>
+<td><code>process.parent.Ext.command_line_truncated</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.parent.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.parent.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.parent.thread.Ext.call_stack.callsite_leading_bytes</code></td>
+<td>Hex opcode bytes preceding the callsite</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.thread.Ext.call_stack.callsite_trailing_bytes</code></td>
+<td>Hex opcode bytes after the callsite (where control will return to)</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.thread.Ext.call_stack.protection</code></td>
+<td>Protection of the page containing this instruction.  This is `R-X' by default if omitted.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.thread.Ext.call_stack.symbol_info</code></td>
+<td>The nearest symbol for `instruction_pointer`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.thread.Ext.call_stack_contains_unbacked</code></td>
+<td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.parent.thread.Ext.call_stack_summary</code></td>
+<td>Concatentation of the non-repeated modules in the call stack.</td>
+<td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td>
+</tr>
+<tr>
+<td><code>process.pe.imphash</code></td>
+<td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td>
+<td><code>0c6803c4e922103c4dca5963aad36ddf</code></td>
+</tr>
+<tr>
+<td><code>process.pe.original_file_name</code></td>
+<td>Internal name of the file, provided at compile-time.</td>
+<td><code>MSPAINT.EXE</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>process.working_directory</code></td>
+<td>The working directory of the process.</td>
+<td><code>/home/alice</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md b/custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md
index 0b08810e8..a71bdef26 100644
--- a/custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md
+++ b/custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md
@@ -25,65 +25,310 @@ This event is generated when the registry is modified.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>registry.data.bytes<code></td><td>Original bytes written with base64 encoding.  For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.</td></tr>
-<tr><td><code>registry.data.strings<code></td><td>Content when writing string types.  Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).</td></tr>
-<tr><td><code>registry.data.type<code></td><td>Standard registry type for encoding contents</td></tr>
-<tr><td><code>registry.hive<code></td><td>Abbreviated name for the hive.</td></tr>
-<tr><td><code>registry.key<code></td><td>Hive-relative path of keys.</td></tr>
-<tr><td><code>registry.path<code></td><td>Full path, including hive, key and value</td></tr>
-<tr><td><code>registry.value<code></td><td>Name of the value written.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>registry.data.bytes</code></td>
+<td>Original bytes written with base64 encoding.  For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.</td>
+<td><code>ZQBuAC0AVQBTAAAAZQBuAAAAAAA=</code></td>
+</tr>
+<tr>
+<td><code>registry.data.strings</code></td>
+<td>Content when writing string types.  Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).</td>
+<td><code>["C:\rta\red_ttp\bin\myapp.exe"]</code></td>
+</tr>
+<tr>
+<td><code>registry.data.type</code></td>
+<td>Standard registry type for encoding contents</td>
+<td><code>REG_SZ</code></td>
+</tr>
+<tr>
+<td><code>registry.hive</code></td>
+<td>Abbreviated name for the hive.</td>
+<td><code>HKLM</code></td>
+</tr>
+<tr>
+<td><code>registry.key</code></td>
+<td>Hive-relative path of keys.</td>
+<td><code>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe</code></td>
+</tr>
+<tr>
+<td><code>registry.path</code></td>
+<td>Full path, including hive, key and value</td>
+<td><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger</code></td>
+</tr>
+<tr>
+<td><code>registry.value</code></td>
+<td>Name of the value written.</td>
+<td><code>Debugger</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md b/custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md
index c0dce2bb0..410e3a10c 100644
--- a/custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md
+++ b/custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md
@@ -25,63 +25,300 @@ This event is generated when the Windows registry is queried.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Effective_process.entity_id<code></td><td>Unique identifier for the effective process.</td></tr>
-<tr><td><code>Effective_process.executable<code></td><td>Executable name for the effective process.</td></tr>
-<tr><td><code>Effective_process.name<code></td><td>Process name for the effective process.</td></tr>
-<tr><td><code>Effective_process.pid<code></td><td>Process ID.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>registry.data.type<code></td><td>Standard registry type for encoding contents</td></tr>
-<tr><td><code>registry.hive<code></td><td>Abbreviated name for the hive.</td></tr>
-<tr><td><code>registry.key<code></td><td>Hive-relative path of keys.</td></tr>
-<tr><td><code>registry.path<code></td><td>Full path, including hive, key and value</td></tr>
-<tr><td><code>registry.value<code></td><td>Name of the value written.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.entity_id</code></td>
+<td>Unique identifier for the effective process.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.executable</code></td>
+<td>Executable name for the effective process.</td>
+<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.name</code></td>
+<td>Process name for the effective process.</td>
+<td><code>WMIC.exe</code></td>
+</tr>
+<tr>
+<td><code>Effective_process.pid</code></td>
+<td>Process ID.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>registry.data.type</code></td>
+<td>Standard registry type for encoding contents</td>
+<td><code>REG_SZ</code></td>
+</tr>
+<tr>
+<td><code>registry.hive</code></td>
+<td>Abbreviated name for the hive.</td>
+<td><code>HKLM</code></td>
+</tr>
+<tr>
+<td><code>registry.key</code></td>
+<td>Hive-relative path of keys.</td>
+<td><code>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe</code></td>
+</tr>
+<tr>
+<td><code>registry.path</code></td>
+<td>Full path, including hive, key and value</td>
+<td><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger</code></td>
+</tr>
+<tr>
+<td><code>registry.value</code></td>
+<td>Name of the value written.</td>
+<td><code>Debugger</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md b/custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md
index 0c198f700..4f9162621 100644
--- a/custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md
+++ b/custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md
@@ -25,69 +25,330 @@ This event is generated when a user grants a gatekeeper exception
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>file.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>file.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>file.path<code></td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
-<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
-<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>file.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>file.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>file.path</code></td>
+<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
+<td><code>/home/alice/example.png</code></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.logon_type</code></td>
+<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.email</code></td>
+<td>User email address.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.full_name</code></td>
+<td>User's full name, if available.</td>
+<td><code>Albert Einstein</code></td>
+</tr>
+<tr>
+<td><code>user.effective.hash</code></td>
+<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.effective.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md b/custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md
index 5ddf4bdb7..e9b4d5da3 100644
--- a/custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md
+++ b/custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md
@@ -25,66 +25,315 @@ This event is generated when a user logs on to the computer.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
-<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
-<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.logon_type</code></td>
+<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.email</code></td>
+<td>User email address.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.full_name</code></td>
+<td>User's full name, if available.</td>
+<td><code>Albert Einstein</code></td>
+</tr>
+<tr>
+<td><code>user.effective.hash</code></td>
+<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.effective.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md b/custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md
index 418dd949c..8942bf80b 100644
--- a/custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md
+++ b/custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md
@@ -25,66 +25,315 @@ This event is generated when a user logs on to the computer with screensharing.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
-<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
-<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.logon_type</code></td>
+<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.email</code></td>
+<td>User email address.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.full_name</code></td>
+<td>User's full name, if available.</td>
+<td><code>Albert Einstein</code></td>
+</tr>
+<tr>
+<td><code>user.effective.hash</code></td>
+<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.effective.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md b/custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md
index 9e04138a0..461046cd8 100644
--- a/custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md
+++ b/custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md
@@ -25,66 +25,315 @@ This event is generated when a user logs on to the computer with SSH.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.signing_id<code></td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.team_id<code></td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
-<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
-<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.logon_type</code></td>
+<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.signing_id</code></td>
+<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
+<td><code>com.apple.xpc.proxy</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.team_id</code></td>
+<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
+<td><code>EQHXZ8M8AV</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.email</code></td>
+<td>User email address.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.full_name</code></td>
+<td>User's full name, if available.</td>
+<td><code>Albert Einstein</code></td>
+</tr>
+<tr>
+<td><code>user.effective.hash</code></td>
+<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.effective.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md b/custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md
index 67597fab7..8ed13bf01 100644
--- a/custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md
+++ b/custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md
@@ -25,61 +25,290 @@ This event is generated when a user logs off of the computer.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
-<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
-<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.logon_type</code></td>
+<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.email</code></td>
+<td>User email address.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.full_name</code></td>
+<td>User's full name, if available.</td>
+<td><code>Albert Einstein</code></td>
+</tr>
+<tr>
+<td><code>user.effective.hash</code></td>
+<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.effective.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md b/custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md
index bed4f54f9..92684a31e 100644
--- a/custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md
+++ b/custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md
@@ -25,64 +25,305 @@ This event is generated when a user logs on to the computer.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>Target.process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.code<code></td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.authentication_id<code></td><td>Process authentication ID</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.Ext.session_info.logon_type<code></td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.effective.email<code></td><td>User email address.</td></tr>
-<tr><td><code>user.effective.full_name<code></td><td>User's full name, if available.</td></tr>
-<tr><td><code>user.effective.hash<code></td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-<tr><td><code>user.effective.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.effective.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>winlog.event_data.PrivilegeList<code></td><td>An array of sensitive privileges, assigned to the new logon.</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>Target.process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.code</code></td>
+<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
+<td><code>4648</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.authentication_id</code></td>
+<td>Process authentication ID</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.session_info.logon_type</code></td>
+<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.email</code></td>
+<td>User email address.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.full_name</code></td>
+<td>User's full name, if available.</td>
+<td><code>Albert Einstein</code></td>
+</tr>
+<tr>
+<td><code>user.effective.hash</code></td>
+<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.effective.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.effective.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>winlog.event_data.PrivilegeList</code></td>
+<td>An array of sensitive privileges, assigned to the new logon.</td>
+<td><code>SeTcbPrivilege, SeSecurityPrivilege</code></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md b/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md
index 90b49fec9..e20c1c3dc 100644
--- a/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md
+++ b/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md
@@ -25,62 +25,295 @@ This event is generated when a device is mounted.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.Ext.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.Ext.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.Ext.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.Ext.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.code_signature.exists<code></td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td><code>process.code_signature.status<code></td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td><code>process.code_signature.subject_name<code></td><td>Subject name of the code signer</td></tr>
-<tr><td><code>process.code_signature.trusted<code></td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.executable<code></td><td>Absolute path to the process executable.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>volume.bus_type<code></td><td>No description found</td></tr>
-<tr><td><code>volume.device_type<code></td><td>No description found</td></tr>
-<tr><td><code>volume.dos_name<code></td><td>No description found</td></tr>
-<tr><td><code>volume.file_system_type<code></td><td>No description found</td></tr>
-<tr><td><code>volume.nt_name<code></td><td>No description found</td></tr>
-<tr><td><code>volume.product_name<code></td><td>No description found</td></tr>
-<tr><td><code>volume.serial_number<code></td><td>No description found</td></tr>
-<tr><td><code>volume.vendor_name<code></td><td>No description found</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.exists</code></td>
+<td>Boolean to capture if a signature is present.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.status</code></td>
+<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
+<td><code>ERROR_UNTRUSTED_ROOT</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.subject_name</code></td>
+<td>Subject name of the code signer</td>
+<td><code>Microsoft Corporation</code></td>
+</tr>
+<tr>
+<td><code>process.code_signature.trusted</code></td>
+<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
+<td><code>true</code></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.executable</code></td>
+<td>Absolute path to the process executable.</td>
+<td><code>/usr/bin/ssh</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>volume.bus_type</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.device_type</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.dos_name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.file_system_type</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.nt_name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.product_name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.serial_number</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.vendor_name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
 </table>
diff --git a/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md b/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md
index a1e5a1f42..a03fbbd85 100644
--- a/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md
+++ b/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md
@@ -25,53 +25,250 @@ This event is generated when a device is unmounted.
 ## Fields
 
 <table>
-<tr><td><code>@timestamp<code></td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td><code>agent.id<code></td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td><code>agent.type<code></td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td><code>agent.version<code></td><td>Version of the agent.</td></tr>
-<tr><td><code>data_stream.dataset<code></td><td>Data stream dataset name.</td></tr>
-<tr><td><code>data_stream.namespace<code></td><td>Data stream namespace.</td></tr>
-<tr><td><code>data_stream.type<code></td><td>Data stream type.</td></tr>
-<tr><td><code>ecs.version<code></td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td><code>elastic.agent.id<code></td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td><code>event.action<code></td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td><code>event.category<code></td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td><code>event.created<code></td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td><code>event.dataset<code></td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td><code>event.id<code></td><td>Unique ID to describe the event.</td></tr>
-<tr><td><code>event.kind<code></td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td><code>event.module<code></td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td><code>event.outcome<code></td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td><code>event.sequence<code></td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-<tr><td><code>event.type<code></td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-<tr><td><code>host.architecture<code></td><td>Operating system architecture.</td></tr>
-<tr><td><code>host.hostname<code></td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-<tr><td><code>host.id<code></td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-<tr><td><code>host.ip<code></td><td>Host ip addresses.</td></tr>
-<tr><td><code>host.mac<code></td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td><code>host.name<code></td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-<tr><td><code>host.os.Ext.variant<code></td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td><code>host.os.family<code></td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td><code>host.os.full<code></td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td><code>host.os.kernel<code></td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td><code>host.os.name<code></td><td>Operating system name, without the version.</td></tr>
-<tr><td><code>host.os.platform<code></td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td><code>host.os.type<code></td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td><code>host.os.version<code></td><td>Operating system version as a raw string.</td></tr>
-<tr><td><code>message<code></td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td><code>process.Ext.ancestry<code></td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-<tr><td><code>process.entity_id<code></td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td><code>process.name<code></td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td><code>process.pid<code></td><td>Process id.</td></tr>
-<tr><td><code>user.domain<code></td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-<tr><td><code>user.id<code></td><td>Unique identifier of the user.</td></tr>
-<tr><td><code>user.name<code></td><td>Short name or login of the user.</td></tr>
-<tr><td><code>volume.bus_type<code></td><td>No description found</td></tr>
-<tr><td><code>volume.device_type<code></td><td>No description found</td></tr>
-<tr><td><code>volume.dos_name<code></td><td>No description found</td></tr>
-<tr><td><code>volume.file_system_type<code></td><td>No description found</td></tr>
-<tr><td><code>volume.nt_name<code></td><td>No description found</td></tr>
-<tr><td><code>volume.product_name<code></td><td>No description found</td></tr>
-<tr><td><code>volume.serial_number<code></td><td>No description found</td></tr>
-<tr><td><code>volume.vendor_name<code></td><td>No description found</td></tr>
+<tr><th>Name</th><th>Description</th><th>Example</th></tr>
+<tr>
+<td><code>@timestamp</code></td>
+<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
+<td><code>2016-05-23T08:05:34.853Z</code></td>
+</tr>
+<tr>
+<td><code>agent.id</code></td>
+<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>agent.type</code></td>
+<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
+<td><code>filebeat</code></td>
+</tr>
+<tr>
+<td><code>agent.version</code></td>
+<td>Version of the agent.</td>
+<td><code>6.0.0-rc2</code></td>
+</tr>
+<tr>
+<td><code>data_stream.dataset</code></td>
+<td>Data stream dataset name.</td>
+<td><code>nginx.access</code></td>
+</tr>
+<tr>
+<td><code>data_stream.namespace</code></td>
+<td>Data stream namespace.</td>
+<td><code>production</code></td>
+</tr>
+<tr>
+<td><code>data_stream.type</code></td>
+<td>Data stream type.</td>
+<td><code>logs</code></td>
+</tr>
+<tr>
+<td><code>ecs.version</code></td>
+<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
+<td><code>1.0.0</code></td>
+</tr>
+<tr>
+<td><code>elastic.agent.id</code></td>
+<td>Unique identifier of this elastic agent (if one exists).</td>
+<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
+</tr>
+<tr>
+<td><code>event.action</code></td>
+<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
+<td><code>user-password-change</code></td>
+</tr>
+<tr>
+<td><code>event.category</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
+<td><code>authentication</code></td>
+</tr>
+<tr>
+<td><code>event.created</code></td>
+<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
+<td><code>2016-05-23T08:05:34.857Z</code></td>
+</tr>
+<tr>
+<td><code>event.dataset</code></td>
+<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
+<td><code>apache.access</code></td>
+</tr>
+<tr>
+<td><code>event.id</code></td>
+<td>Unique ID to describe the event.</td>
+<td><code>8a4f500d</code></td>
+</tr>
+<tr>
+<td><code>event.kind</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
+<td><code>alert</code></td>
+</tr>
+<tr>
+<td><code>event.module</code></td>
+<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
+<td><code>apache</code></td>
+</tr>
+<tr>
+<td><code>event.outcome</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
+<td><code>success</code></td>
+</tr>
+<tr>
+<td><code>event.sequence</code></td>
+<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>event.type</code></td>
+<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.architecture</code></td>
+<td>Operating system architecture.</td>
+<td><code>x86_64</code></td>
+</tr>
+<tr>
+<td><code>host.hostname</code></td>
+<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.id</code></td>
+<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.ip</code></td>
+<td>Host ip addresses.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.mac</code></td>
+<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
+<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
+</tr>
+<tr>
+<td><code>host.name</code></td>
+<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>host.os.Ext.variant</code></td>
+<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
+<td><code>Ubuntu</code></td>
+</tr>
+<tr>
+<td><code>host.os.family</code></td>
+<td>OS family (such as redhat, debian, freebsd, windows).</td>
+<td><code>debian</code></td>
+</tr>
+<tr>
+<td><code>host.os.full</code></td>
+<td>Operating system name, including the version or code name.</td>
+<td><code>Mac OS Mojave</code></td>
+</tr>
+<tr>
+<td><code>host.os.kernel</code></td>
+<td>Operating system kernel version as a raw string.</td>
+<td><code>4.4.0-112-generic</code></td>
+</tr>
+<tr>
+<td><code>host.os.name</code></td>
+<td>Operating system name, without the version.</td>
+<td><code>Mac OS X</code></td>
+</tr>
+<tr>
+<td><code>host.os.platform</code></td>
+<td>Operating system platform (such centos, ubuntu, windows).</td>
+<td><code>darwin</code></td>
+</tr>
+<tr>
+<td><code>host.os.type</code></td>
+<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
+<td><code>macos</code></td>
+</tr>
+<tr>
+<td><code>host.os.version</code></td>
+<td>Operating system version as a raw string.</td>
+<td><code>10.14.1</code></td>
+</tr>
+<tr>
+<td><code>message</code></td>
+<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
+<td><code>Hello World</code></td>
+</tr>
+<tr>
+<td><code>process.Ext.ancestry</code></td>
+<td>An array of entity_ids indicating the ancestors for this event</td>
+<td></td>
+</tr>
+<tr>
+<td><code>process.entity_id</code></td>
+<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
+<td><code>c2c455d9f99375d</code></td>
+</tr>
+<tr>
+<td><code>process.name</code></td>
+<td>Process name.  Sometimes called program name or similar.</td>
+<td><code>ssh</code></td>
+</tr>
+<tr>
+<td><code>process.pid</code></td>
+<td>Process id.</td>
+<td><code>4242</code></td>
+</tr>
+<tr>
+<td><code>user.domain</code></td>
+<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
+<td></td>
+</tr>
+<tr>
+<td><code>user.id</code></td>
+<td>Unique identifier of the user.</td>
+<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
+</tr>
+<tr>
+<td><code>user.name</code></td>
+<td>Short name or login of the user.</td>
+<td><code>a.einstein</code></td>
+</tr>
+<tr>
+<td><code>volume.bus_type</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.device_type</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.dos_name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.file_system_type</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.nt_name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.product_name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.serial_number</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
+<tr>
+<td><code>volume.vendor_name</code></td>
+<td>No Description Found</td>
+<td></td>
+</tr>
 </table>
diff --git a/scripts/generate-docs/pydocgen/__main__.py b/scripts/generate-docs/pydocgen/__main__.py
index d37ed890a..4351064a1 100644
--- a/scripts/generate-docs/pydocgen/__main__.py
+++ b/scripts/generate-docs/pydocgen/__main__.py
@@ -8,6 +8,8 @@
 
 from .markdown import generate_custom_documentation_markdown
 
+from .models.custom_documentation import DocumentationOverrideMap
+
 from typing import Literal
 
 
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index 7daeaddf7..84d2affcc 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -1,106 +1,36 @@
 import logging
 import pathlib
-from .models import Package, PackageList, CustomDocumentationList, Filter
-from .database import getDatabase, PackageField
+from .models import CustomDocumentationList, Filter
+from .database import getDatabase, PackageField, OverrideRelationship
 
-from sqlmodel import SQLModel, Field, create_engine, Session, select, Relationship
-from sqlalchemy import Engine, Column, JSON
+from sqlmodel import (
+    Session,
+    select,
+    or_,
+    and_,
+    case,
+)
 
 from typing import List
 
-# def ensure_valid_output_directory(output_directory: pathlib.Path):
-#     """
-#     Ensure that the output directory is valid
-#     """
-#     if not output_directory.exists():
-#         output_directory.mkdir(parents=True)
-#     if not output_directory.is_dir():
-#         raise FileExistsError(f"output_directory {output_directory} is not a directory")
-
-# def generate_package_markdown(package: Package):
-#     """
-#     Generate markdown for a package
-
-#     Args:
-#         package: the package to generate markdown for
-
-#     Returns:
-#         markdown string
-#     """
-#     markdown = f"[Back to index](README.md)\n\n"
-#     for field in package.fields:
-#         markdown += f"## `{field.name}`\n\n"
-#         markdown += f"### Description\n"
-#         markdown += f"{field.description}\n"
-#         if field.fields:
-#             markdown += f"### Sub-fields\n"
-#             markdown += "| Field | Description | Example |\n"
-#             markdown += "| --- | --- | --- |\n"
-#             for sub_field in field.fields:
-#                 markdown += f"| `{sub_field.name}` | {sub_field.description} | {sub_field.example} |\n"
-#         markdown += f"### Example\n\n"
-#         markdown += f"```json\n"
-#         if not field.example:
-#             markdown += "Needs example\n"
-#         else:
-#             markdown += json.dumps(field.example, indent=4)
-#         markdown += "\n```\n<hr>\n\n"
-#     return markdown
-
-# def generate_readme_markdown(package_list: PackageList, output_directory: pathlib.Path):
-#     """
-#     Generates the top level readme markdown file
-#     """
-#     ensure_valid_output_directory(output_directory)
-#     readme_path = output_directory / "README.md"
-
-#     #
-#     # This file will list each package, its top level fields, and a link to the package's markdown file
-#     # if the package has a sample event, it will be included in a details tag
-#     #
-#     with readme_path.open("w") as f:
-#         for package in package_list.packages:
-#             f.write(f"# {package.name}\n")
-#             if package.sample_event:
-#                 f.write("### Sample Event\n")
-#                 f.write("<details>\n")
-#                 f.write("<summary>\nClick to expand\n</summary>\n\n")
-#                 f.write("```json\n")
-#                 f.write(json.dumps(package.sample_event, indent=4))
-#                 f.write("\n```\n")
-#                 f.write("</details>\n\n")
-#             f.write(f"### [Fields]({package.name}.md)\n")
-#             for field in package.fields:
-#                 f.write(f"- [{field.name}]({package.name}.md#{field.name})\n")
-
-# def generate_package_list_markdown(package_list: PackageList, output_directory: pathlib.Path) -> None:
-#     """
-#     Generate markdown files for a list of packages
-#     """
-#     ensure_valid_output_directory(output_directory)
-
-#     #
-#     # Create a top level Readme.md file
-#     #
-#     generate_readme_markdown(package_list, output_directory)
-
-#     #
-#     # Walk the list of packages and create a markdown file for each
-#     #
-#     for package in package_list.packages:
-#         path = output_directory / f"{package.name}.md"
-#         with path.open("w") as f:
-#             f.write(generate_package_markdown(package))
-
-#     return f"Generated {len(package_list.packages)} packages to {output_directory}"
-
-
-def generate_custom_documentation_markdown(db_path: pathlib.Path, output_dir: pathlib.Path):
+
+def generate_custom_documentation_markdown(
+    db_path: pathlib.Path, output_dir: pathlib.Path
+):
     """
     Generate markdown files for custom documentation
     """
 
-    def get_output_filename(src_path: pathlib.Path) -> pathlib.Path:
+    def get_output_filepath(src_path: pathlib.Path) -> pathlib.Path:
+        """
+        get_output_filepath determines the output filename for a given source path
+
+        Args:
+            src_path: yaml file path
+
+        Returns:
+            output filepath
+        """
         parts = src_path.parts
         index = parts.index("data_stream")
         output_filename = output_dir
@@ -109,6 +39,16 @@ def get_output_filename(src_path: pathlib.Path) -> pathlib.Path:
         return output_filename / parts[-1].replace(".yaml", ".md")
 
     def get_formatted_os_name(os: str) -> str:
+        """
+        get_formatted_os_name os names in the defintions are always lowercase, this function will
+        return the correct case for the os name
+
+        Args:
+            os: os name
+
+        Returns:
+            _description_
+        """
         if os == "windows":
             return "Windows"
         if os == "linux":
@@ -118,9 +58,28 @@ def get_formatted_os_name(os: str) -> str:
         return os
 
     def get_formatted_os_string(os_list: List[str]) -> str:
+        """
+        get_formatted_os_string some documents have multiple os's, this function will format them
+        correctly for the markdown output
+
+        Args:
+            os_list: list of os names
+
+        Returns:
+            formatted os string
+        """
         return ", ".join(get_formatted_os_name(os) for os in os_list)
 
     def get_kql_query_string(filter: Filter) -> str:
+        """
+        get_kql_query_string generates a KQL query string from a Filter object
+
+        Args:
+            filter: Filter object from the custom documentation
+
+        Returns:
+            KQL query string
+        """
         queries = []
         for field, metadata in Filter.model_fields.items():
             field_name = metadata.alias if metadata.alias else field
@@ -133,15 +92,27 @@ def get_kql_query_string(filter: Filter) -> str:
                         field_value = f"{field_value[0]}"
                     else:
                         field_value = '" or "'.join(field_value)
-                queries.append(f"{field_name} : \"{field_value}\"")
+                queries.append(f'{field_name} : "{field_value}"')
         return " and ".join(queries)
 
+    #
+    # Function Begin
+    #
+
+    # Create or get the populated database
     engine = getDatabase(db_path)
+
+    # Get the custom documentation
     custom_docs = CustomDocumentationList.from_files()
+
+    # Generate markdown for each custom document
     with Session(engine) as session:
         for custom_doc in custom_docs:
-            output_filename = get_output_filename(custom_doc.filepath)
+            # Get the output filename and create the parent directories
+            output_filename = get_output_filepath(custom_doc.filepath)
             output_filename.parent.mkdir(parents=True, exist_ok=True)
+
+            # Write the markdown file
             with output_filename.open("w") as f:
                 f.write(f"# {custom_doc.overview.name}\n\n")
 
@@ -152,7 +123,9 @@ def get_kql_query_string(filter: Filter) -> str:
                 f.write("<table>\n")
                 f.write("<tr>\n")
                 f.write("<td><strong>OS</strong></td>\n")
-                f.write(f"<td>{get_formatted_os_string(custom_doc.identification.os)}</td>\n")
+                f.write(
+                    f"<td>{get_formatted_os_string(custom_doc.identification.os)}</td>\n"
+                )
                 f.write("</tr>\n")
                 f.write("<tr>\n")
                 f.write(f"<td><strong>Data Stream</strong></td>\n")
@@ -160,20 +133,93 @@ def get_kql_query_string(filter: Filter) -> str:
                 f.write("</tr>\n")
                 f.write("<tr>\n")
                 f.write(f"<td><strong>KQL Query</strong></td>\n")
-                f.write(f"<td><code>{get_kql_query_string(custom_doc.identification.filter)}</code></td>\n")
+                f.write(
+                    f"<td><code>{get_kql_query_string(custom_doc.identification.filter)}</code></td>\n"
+                )
                 f.write("</tr>\n")
                 f.write("</table>\n\n")
 
                 f.write(f"## Fields\n\n")
                 f.write("<table>\n")
-                #f.write("<tr><th>Field</th><th>Description</th></tr>\n")
+                f.write("<tr><th>Name</th><th>Description</th><th>Example</th></tr>\n")
                 for field in custom_doc.fields.endpoint:
-                    package_field = session.exec(select(PackageField).where(PackageField.name == field)).first()
+                    description = "No Description Found"
+                    example = ""
+                    event_name = custom_doc.filepath.stem
+
+                    #
+                    # This query will look for an override for the field in the following order:
+                    # 1. Event name
+                    # 2. OS
+                    # 3. Default
+                    #
+                    # If no override is found, the package field description will be used
+                    #
+                    override = session.exec(
+                        select(OverrideRelationship)
+                        .where(
+                            and_(
+                                # field must match
+                                OverrideRelationship.name == field,
+                                # one of the following must match
+                                or_(
+                                    (OverrideRelationship.event == event_name),
+                                    (
+                                        OverrideRelationship.os
+                                        == custom_doc.identification.os[0]
+                                    ),
+                                    (OverrideRelationship.default == True),
+                                ),
+                            )
+                        )
+                        .order_by(
+                            # The order of precedence is event, os, default, so we order by that
+                            case(
+                                (OverrideRelationship.event == event_name, 1),
+                                (
+                                    OverrideRelationship.os
+                                    == custom_doc.identification.os[0],
+                                    2,
+                                ),
+                                (OverrideRelationship.default == True, 3),
+                                else_=4,
+                            )
+                        )
+                    ).first()
+
+                    if override:
+                        description = override.override.description
+                        if override.override.example:
+                            example = override.override.example
+                        logging.debug(
+                            f"Found override for field {field} in {event_name}"
+                        )
+                    else:
+                        #
+                        # If no override is found, use the package field description
+                        #
+                        package_field = session.exec(
+                            select(PackageField).where(PackageField.name == field)
+                        ).first()
+                        if package_field:
+                            #
+                            # The package field description may contain newlines, so we replace them with spaces
+                            #
+                            description = package_field.description.replace(
+                                "\n", "  "
+                            ).replace("\r", "  ")
+                            if package_field.example:
+                                example = package_field.example
+
+                    f.write("<tr>\n")
+                    f.write(f"<td><code>{field}</code></td>\n")
+                    f.write(f"<td>{description}</td>\n")
+                    if example:
+                        f.write(f"<td><code>{example}</code></td>\n")
+                    else:
+                        f.write("<td></td>\n")
+                    f.write("</tr>\n")
 
-                    description = None
-                    if package_field:
-                        description = package_field.description.replace("\n", "  ").replace("\r", "  ")
-                    f.write(f"<tr><td><code>{field}<code></td><td>{description if description else 'No description found'}</td></tr>\n")
                 f.write("</table>\n")
 
             logging.debug(f"wrote markdown to {output_filename}")

From 4acb79ba8f008276e651831ed5218e1af22e28f5 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Thu, 27 Mar 2025 15:23:58 +0000
Subject: [PATCH 13/25] override file

---
 .../src/documentation_overrides.yaml           | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 custom_documentation/src/documentation_overrides.yaml

diff --git a/custom_documentation/src/documentation_overrides.yaml b/custom_documentation/src/documentation_overrides.yaml
new file mode 100644
index 000000000..eaf83e009
--- /dev/null
+++ b/custom_documentation/src/documentation_overrides.yaml
@@ -0,0 +1,18 @@
+- name: Endpoint.policy.applied.artifacts.global.channel
+  overrides:
+    default:
+      description: The channel of the artifact.
+      example: default example
+      type: keyword
+    os:
+      linux:
+        description: The channel of the linux artifact.
+        example: stable
+      windows:
+        description: The channel of the windows artifact.
+      macos:
+        description: The channel of the macos artifact.
+    event:
+      linux_malicious_behavior_alert:
+        description: The channel of the artifact for linux malicious behavior alert.
+        example: stable

From a4a294e000d9282defaaf1dad3fb3f60de5efdae Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Thu, 27 Mar 2025 15:24:23 +0000
Subject: [PATCH 14/25] generation scripts

---
 scripts/generate-docs/pydocgen/database.py    | 205 ++++++++++++++++++
 .../generate-docs/pydocgen/models/__init__.py |   2 +
 .../pydocgen/models/custom_documentation.py   | 179 +++++++++++++++
 .../generate-docs/pydocgen/models/packages.py | 148 +++++++++++++
 scripts/generate-docs/pydocgen/paths.py       |  15 ++
 5 files changed, 549 insertions(+)
 create mode 100644 scripts/generate-docs/pydocgen/database.py
 create mode 100644 scripts/generate-docs/pydocgen/models/__init__.py
 create mode 100644 scripts/generate-docs/pydocgen/models/custom_documentation.py
 create mode 100644 scripts/generate-docs/pydocgen/models/packages.py
 create mode 100644 scripts/generate-docs/pydocgen/paths.py

diff --git a/scripts/generate-docs/pydocgen/database.py b/scripts/generate-docs/pydocgen/database.py
new file mode 100644
index 000000000..f837a0872
--- /dev/null
+++ b/scripts/generate-docs/pydocgen/database.py
@@ -0,0 +1,205 @@
+import pathlib
+import logging
+
+from sqlmodel import SQLModel, Field, create_engine, Session, select, Relationship
+from sqlalchemy import Engine, Column, JSON
+
+from .models.custom_documentation import DocumentationOverrideMap
+from .models.packages import Package, PackageList
+
+from typing import Optional
+
+#
+# These models represent the database tables for mapped fields
+#
+class PackageReference(SQLModel, table=True):
+    __tablename__ = "package_references"
+    id: Optional[int] = Field(default=None, primary_key=True)
+    package_data: Optional[str] = Field(default=None, sa_column=Column(JSON))
+
+
+class PackageField(SQLModel, table=True):
+    """
+    PackageField represents a specific field as defined in package/endpoint/datastream/{type}/fields/fields.yml
+    each in fields.yml has a name and description, this class holds the name, description, and reference to the parent package.
+    These fields will be used to provide descriptions for the fields in the custom documentation.
+
+    Note: this is the database table definition for the Package class defined in models/packages.py
+
+    Args:
+        SQLModel: this is a SQLModel class (database table)
+        table: Defaults to True.
+
+    Raises:
+        ValueError: _description_
+
+    Returns:
+        _description_
+    """
+    __tablename__ = "package_fields"
+    id: Optional[int] = Field(default=None, primary_key=True)
+    name: str
+    description: str
+    example: Optional[str] = None
+    package_reference_id: Optional[int] = Field(foreign_key="package_references.id")
+    package_reference: Optional[PackageReference] = Relationship()
+
+    @property
+    def package(self) -> Package:
+        if not self.package_reference:
+            raise ValueError(f"PackageReference is not set for PackageField {self}")
+        return Package.model_validate_json(self.package_reference.package_data)
+
+
+#
+# These models reprensent the database tables for overrides
+#
+class OverrideField(SQLModel, table=True):
+    __tablename__ = "overrides"
+    id: Optional[int] = Field(default=None, primary_key=True)
+    description: str
+    example: Optional[str] = None
+    type: Optional[str] = None
+
+
+class OverrideRelationship(SQLModel, table=True):
+    __tablename__ = "override_relationships"
+    id: Optional[int] = Field(default=None, primary_key=True)
+    name: str
+    event: Optional[str] = None
+    os: Optional[str] = None
+    default: bool = False
+    override_id: int = Field(foreign_key="overrides.id")
+    override: OverrideField = Relationship(sa_relationship_kwargs={"lazy": "joined"})
+
+
+def populate_overrides(session: Session):
+    dom = DocumentationOverrideMap.from_yaml()
+    for name, mapping in dom.items():
+        if mapping.os:
+            for os, override in mapping.os.items():
+                record = OverrideField(
+                    description=override.description,
+                    example=override.example,
+                    type=override.type,
+                )
+                session.add(record)
+                session.flush()
+
+                related_record = OverrideRelationship(
+                    name=name,
+                    os=os,
+                    override_id=record.id
+                )
+                session.add(related_record)
+
+        if mapping.event:
+            for event, override in mapping.event.items():
+
+                record = OverrideField(
+                    description=override.description,
+                    example=override.example,
+                    type=override.type,
+                )
+                session.add(record)
+                session.flush()
+
+                related_record = OverrideRelationship(
+                    name=name,
+                    event=event,
+                    override_id=record.id
+                )
+                session.add(related_record)
+
+        if mapping.default:
+            record = OverrideField(
+                description=mapping.default.description,
+                example=mapping.default.example,
+                type=mapping.default.type,
+            )
+            session.add(record)
+            session.flush()
+
+            related_record = OverrideRelationship(
+                name=name,
+                default=True,
+                override_id=record.id
+            )
+            session.add(related_record)
+
+    session.commit()
+
+def populate_packages_fields(session: Session):
+    """
+    populate_packages_fields populates the package fields in the database
+
+    Args:
+        session: database session
+    """
+    def add_to_db(field: PackageField, session: Session):
+        existing_field = session.exec(
+            select(PackageField).where(PackageField.name == field.name)
+        ).first()
+        if existing_field:
+            if existing_field.description != field.description:
+                raise ValueError(
+                    f"Field {field.name} already exists with different description"
+                )
+        else:
+            logging.debug(f"  Adding field {field.name}")
+            session.add(field)
+
+    package_list = PackageList.from_files()
+    for package in package_list:
+        logging.debug(f"Adding package fields for {package.filepath}")
+        package_ref = PackageReference(package_data=package.model_dump_json())
+        session.add(package_ref)
+        session.flush()
+        for field in package.fields:
+            if field.fields:
+                for sub_field in field.fields:
+                    name = f"{field.name}.{sub_field.name}"
+                    add_to_db(
+                        PackageField(
+                            name=name,
+                            description=sub_field.description,
+                            package_reference_id=package_ref.id,
+                            example=sub_field.example,
+                        ),
+                        session,
+                    )
+            else:
+                add_to_db(
+                    PackageField(
+                        name=field.name,
+                        description=field.description,
+                        package_reference_id=package_ref.id,
+                        example=field.example,
+                    ),
+                    session,
+                )
+    session.commit()
+
+
+def getDatabase(db_path: pathlib.Path) -> Engine:
+    """
+    getDatabase creates a database if it does not exist, otherwise it uses the existing database
+
+    Args:
+        db_path: path to the database
+
+    Returns:
+        database Engine
+    """
+    if db_path.exists():
+        logging.info(f"Using existing database at {db_path}")
+        return create_engine(f"sqlite:///{db_path}")
+
+    logging.info(f"Creating database at {db_path}")
+    engine = create_engine(f"sqlite:///{db_path}")
+    SQLModel.metadata.create_all(engine)
+    with Session(engine) as session:
+        populate_packages_fields(session)
+        populate_overrides(session)
+        session.commit()
+    return engine
diff --git a/scripts/generate-docs/pydocgen/models/__init__.py b/scripts/generate-docs/pydocgen/models/__init__.py
new file mode 100644
index 000000000..3212ffaa2
--- /dev/null
+++ b/scripts/generate-docs/pydocgen/models/__init__.py
@@ -0,0 +1,2 @@
+from .packages import *
+from .custom_documentation import *
diff --git a/scripts/generate-docs/pydocgen/models/custom_documentation.py b/scripts/generate-docs/pydocgen/models/custom_documentation.py
new file mode 100644
index 000000000..8dbd2f02a
--- /dev/null
+++ b/scripts/generate-docs/pydocgen/models/custom_documentation.py
@@ -0,0 +1,179 @@
+import logging
+import pathlib
+import yaml
+from pydantic import BaseModel, Field, field_validator
+from typing import List, Optional, Iterator, Dict
+
+from ..paths import CUSTOM_DOCUMENTATION_DIR, DOCUMENTATION_OVERRIDE_PATH
+
+class Overview(BaseModel):
+    """
+    Overview of the package
+    """
+    name: str
+    description: str
+
+class Filter(BaseModel):
+    """
+    Filter for the package
+    """
+    event_dataset: str = Field(..., alias="event.dataset")
+    event_module: str = Field(..., alias="event.module")
+    event_provider: Optional[str] = Field(None, alias="event.provider")
+    host_os_type: Optional[str] = Field(None, alias="host.os.type")
+    event_code: Optional[str] = Field(None, alias="event.code")
+    event_action: Optional[List[str]] = Field(None, alias="event.action")
+
+    @field_validator("event_action", mode="before")
+    @classmethod
+    def validate_tags(cls, value):
+        if isinstance(value, str):
+            # If input is a string, convert to a list with one item
+            return [value]
+        return value
+
+    class Config:
+        populate_by_name = True
+
+
+class Identification(BaseModel):
+    """
+    Identification of the package
+    """
+    filter: Filter
+    os: List[str]
+    data_stream: str
+
+
+class Fields(BaseModel):
+    """
+    Fields for the package
+    """
+    endpoint: List[str]
+
+
+class CustomDocumentation(BaseModel):
+    """
+    Custom documentation for a package
+    """
+    overview: Overview
+    identification: Identification
+    fields: Fields
+    filepath: pathlib.Path
+
+    @classmethod
+    def from_yaml(cls, yaml_path: pathlib.Path) -> "CustomDocumentation":
+        logging.debug(f"Reading custom documentation from {yaml_path}")
+        with yaml_path.open("r") as f:
+            data = yaml.safe_load(f)
+            return cls(**data, filepath=yaml_path)
+
+
+class CustomDocumentationMap(BaseModel):
+    """
+    Map of custom documentation for a package
+    """
+    root: dict = {}
+
+    def __getitem__(self, key) -> CustomDocumentation:
+        return self.root[key]
+
+    def __iter__(self) -> Iterator[CustomDocumentation]:
+        return iter(self.root.values())
+
+    def __len__(self) -> int:
+        return len(self.root)
+
+    def append(self, package: CustomDocumentation) -> None:
+        self.root[package.overview.name] = package
+
+    @classmethod
+    def from_yaml(cls, yaml_dir: pathlib.Path) -> "CustomDocumentationMap":
+        custom_docs = cls()
+        for yaml_path in yaml_dir.rglob("*.yaml"):
+            custom_doc = CustomDocumentation.from_yaml(yaml_path)
+            custom_docs.append(custom_doc)
+
+        return custom_docs
+
+
+class CustomDocumentationList(BaseModel):
+    """
+    List of custom documentation for a package
+    """
+    root: List[CustomDocumentation] = []
+
+    def __iter__(self) -> Iterator[CustomDocumentation]:
+        return iter(self.root)
+
+    def __getitem__(self, index) -> List[CustomDocumentation]:
+        return self.root[index]
+
+    def __len__(self) -> int:
+        return len(self.root)
+
+    def append(self, package: CustomDocumentation) -> None:
+        self.root.append(package)
+
+    @classmethod
+    def from_files(
+        cls, yaml_dir: pathlib.Path = CUSTOM_DOCUMENTATION_DIR
+    ) -> "CustomDocumentationList":
+        custom_docs = []
+        for yaml_path in yaml_dir.rglob("*.yaml"):
+            custom_docs.append(CustomDocumentation.from_yaml(yaml_path))
+
+        return cls(root=custom_docs)
+
+
+#
+# These models reprensent the data from custom_documentation/src/documentation_overrides.yaml
+#
+class OverrideBase(BaseModel):
+    """
+    Override for a field
+    """
+    description: Optional[str] = None
+    example: Optional[str] = None
+    type: Optional[str] = None
+
+class OverrideMapping(BaseModel):
+    """
+    Map of overrides for a field
+    """
+    default: Optional[OverrideBase] = None
+    os: Optional[Dict[str, OverrideBase]] = None
+    event: Optional[Dict[str, OverrideBase]] = None
+
+class DocumentationOverrideMap(BaseModel):
+    """
+    Map of documentation overrides for a field
+    """
+    root: dict = {}
+
+    def __getitem__(self, key) -> OverrideMapping:
+        return self.root[key]
+
+    def __iter__(self) -> Iterator[OverrideMapping]:
+        return iter(self.root.values())
+
+    def __len__(self) -> int:
+        return len(self.root)
+
+    def items(self):
+        return self.root.items()
+
+    def append(self, name: str, om: OverrideMapping) -> None:
+        self.root[name] = om
+
+    @classmethod
+    def from_yaml(
+        cls, yaml_path: pathlib.Path = DOCUMENTATION_OVERRIDE_PATH
+    ) -> "DocumentationOverrideMap":
+        logging.debug(f"Reading documentation overrides from {yaml_path}")
+        doc_overrides = cls()
+        with yaml_path.open("r") as f:
+            data = yaml.safe_load(f)
+            for item in data:
+                doc_overrides.append(item["name"], OverrideMapping(**item["overrides"]))
+        return doc_overrides
diff --git a/scripts/generate-docs/pydocgen/models/packages.py b/scripts/generate-docs/pydocgen/models/packages.py
new file mode 100644
index 000000000..679446b2f
--- /dev/null
+++ b/scripts/generate-docs/pydocgen/models/packages.py
@@ -0,0 +1,148 @@
+import logging
+import json
+import pathlib
+import yaml
+from pydantic import BaseModel, RootModel
+from typing import List, Optional, Any, Dict, Iterator
+
+from ..paths import PACKAGES_DIR
+
+
+class MultiField(BaseModel):
+    """
+    fields can have a number of multi_fields
+    """
+
+    name: str
+    type: str
+    norms: Optional[bool] = None
+    normalizer: Optional[str] = None
+    ignore_above: Optional[int] = None
+    default_field: Optional[bool] = None
+
+    class Config:
+        """
+        this config setting ensures that the model will raise an error if any extra fields are present
+        """
+
+        extra = "forbid"
+
+
+class Field(BaseModel):
+    """
+    Field field as defined in fields.yml
+    """
+
+    name: str
+    title: Optional[str] = None
+    default_field: Optional[bool] = None
+    level: Optional[str] = None
+    type: Optional[str] = None
+    ignore_above: Optional[int] = None
+    description: Optional[str] = None
+    fields: Optional[List["Field"]] = None
+    required: Optional[bool] = None
+    group: Optional[int] = None
+    multi_fields: Optional[List[MultiField]] = None
+    example: Optional[Any] = None
+    format: Optional[str] = None
+    enabled: Optional[bool] = None
+    doc_values: Optional[bool] = None
+    index: Optional[bool] = None
+    footnote: Optional[str] = None
+    pattern: Optional[str] = None
+    path: Optional[str] = None
+
+    class Config:
+        """
+        this config setting ensures that the model will raise an error if any extra fields are present
+        """
+
+        extra = "forbid"
+
+
+class Package(BaseModel):
+    """
+    A package consists of a name, a list of fields and an optional sample event
+    """
+
+    name: str
+    fields: List[Field]
+    sample_event: Optional[Dict[Any, Any]] = None
+    filepath: Optional[pathlib.Path] = None
+
+    @classmethod
+    def from_package_dir(cls, package_dir: pathlib.Path):
+        """
+        takes a directory and returns a Package object
+        - name is the name of the directory (package)
+        - fields are read from fields/fields.yml
+        - sample_event is read from sample_event.json if it exists
+
+        Args:
+            package_dir: directory holding the package data
+        """
+        logging.debug(f"Reading package from {package_dir}")
+        if not package_dir.exists():
+            raise ValueError(f"package directory {package_dir} does not exist")
+        if not package_dir.is_dir():
+            raise ValueError(f"package directory {package_dir} is not a directory")
+
+        #
+        # read fields from fields.yml and create Field objects
+        #
+        fields_path = package_dir / "fields" / "fields.yml"
+        fields_data = yaml.safe_load(fields_path.read_text())
+        fields = [Field(**field) for field in fields_data]
+
+        #
+        # read sample event if it exists
+        #
+        sample_event = None
+        sample_event_path = package_dir / "sample_event.json"
+        if sample_event_path.exists():
+            sample_event = json.loads(sample_event_path.read_text())
+
+        #
+        # return the Package object
+        #
+        return cls(
+            name=package_dir.name,
+            fields=fields,
+            sample_event=sample_event,
+            filepath=fields_path,
+        )
+
+
+class PackageList(RootModel):
+    """
+    PackageList is a list of packages
+    """
+
+    root: List[Package] = []
+
+    def __iter__(self) -> Iterator[Package]:
+        return iter(self.root)
+
+    def __getitem__(self, index) -> List[Package]:
+        return self.root[index]
+
+    def __len__(self) -> int:
+        return len(self.root)
+
+    def append(self, package: Package) -> None:
+        self.root.append(package)
+
+    @classmethod
+    def from_files(cls, packages_dir: pathlib.Path = PACKAGES_DIR):
+        """
+        from_packages_dir creates a PackageList from a directory of packages
+
+        Args:
+            packages_dir: top level directory holding the packages
+        """
+        package_paths = list(packages_dir.glob("*"))
+        packages = [
+            Package.from_package_dir(package_path) for package_path in package_paths
+        ]
+        return cls(root=packages)
diff --git a/scripts/generate-docs/pydocgen/paths.py b/scripts/generate-docs/pydocgen/paths.py
new file mode 100644
index 000000000..e3340e75e
--- /dev/null
+++ b/scripts/generate-docs/pydocgen/paths.py
@@ -0,0 +1,15 @@
+import pathlib
+
+ENDPOINT_PACKAGE_DIR = pathlib.Path(__file__).resolve().parents[3]
+
+CUSTOM_DOCUMENTATION_DIR = (
+    ENDPOINT_PACKAGE_DIR / "custom_documentation" / "src" / "endpoint" / "data_stream"
+)
+PACKAGES_DIR = ENDPOINT_PACKAGE_DIR / "package" / "endpoint" / "data_stream"
+
+DOCUMENTATION_OVERRIDE_PATH = (
+    ENDPOINT_PACKAGE_DIR
+    / "custom_documentation"
+    / "src"
+    / "documentation_overrides.yaml"
+)

From 0e54605ce5f364fef73328db4a4df58c52c97368 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Thu, 27 Mar 2025 17:23:25 +0000
Subject: [PATCH 15/25] documentation variant 1

---
 .../linux/linux_malicious_behavior_alert.md   | 1447 +++++++
 .../alerts/linux/linux_malware_alert.md       | 2963 +++++++++++++++
 .../alerts/linux/linux_memory_threat_alert.md | 2624 +++++++++++++
 .../macos/macos_malicious_behavior_alert.md   | 1272 +++++++
 .../alerts/macos/macos_malware_alert.md       | 1846 +++++++++
 .../alerts/macos/macos_memory_threat_alert.md | 1585 ++++++++
 .../windows_malicious_behavior_alert.md       | 1390 +++++++
 .../alerts/windows/windows_malware_alert.md   | 2585 +++++++++++++
 .../windows/windows_memory_threat_alert.md    | 1804 +++++++++
 .../windows/windows_ransomware_alert.md       | 2182 +++++++++++
 .../windows/windows_shellcode_thread.md       | 3378 +++++++++++++++++
 .../api/windows/windows_api_amsi.md           |  885 +++++
 .../api/windows/windows_api_asm.md            |  926 +++++
 .../windows/windows_api_credential_access.md  |  879 +++++
 .../api/windows/windows_api_kernel_audit.md   |  815 ++++
 .../api/windows/windows_api_tcpip.md          |  869 +++++
 .../windows_api_threat_intelligence.md        | 1428 +++++++
 .../api/windows/windows_api_win32k.md         | 1177 ++++++
 .../api/windows/windows_api_wmi.md            | 1021 +++++
 .../file/linux/linux_file_create.md           |  810 ++++
 .../file/linux/linux_file_delete.md           |  797 ++++
 .../linux/linux_file_endpoint_unquarantine.md |  575 +++
 .../file/linux/linux_file_rename.md           |  849 +++++
 .../file/macos/macos_file_access.md           |  702 ++++
 .../file/macos/macos_file_delete.md           |  909 +++++
 .../macos/macos_file_endpoint_unquarantine.md |  575 +++
 .../macos_file_extended_attributes_delete.md  |  908 +++++
 .../file/macos/macos_file_launch_daemon.md    |  876 +++++
 .../file/macos/macos_file_modification.md     |  935 +++++
 .../file/macos/macos_file_mount.md            |  866 +++++
 .../file/macos/macos_file_rename.md           |  948 +++++
 .../file/windows/windows_file_create.md       |  963 +++++
 .../file/windows/windows_file_delete.md       |  898 +++++
 .../windows_file_endpoint_unquarantine.md     |  575 +++
 .../file/windows/windows_file_modification.md |  910 +++++
 .../file/windows/windows_file_open.md         |  924 +++++
 .../file/windows/windows_file_overwrite.md    |  910 +++++
 .../file/windows/windows_file_rename.md       |  963 +++++
 .../library/macos/macos_library_load.md       |  947 +++++
 .../library/windows/windows_library_load.md   | 1031 +++++
 .../doc/sample_variant_1/metadata/metadata.md |  626 +++
 .../doc/sample_variant_1/metrics/metrics.md   | 2452 ++++++++++++
 ...twork_attempted_accepted_and_disconnect.md |  958 +++++
 .../linux/linux_network_dns_lookup_result.md  |  722 ++++
 ...ork_connection_attempted_and_disconnect.md |  931 +++++
 .../macos/macos_network_dns_lookup_result.md  |  971 +++++
 ...twork_attempted_accepted_and_disconnect.md |  880 +++++
 .../windows_network_dns_lookup_requested.md   |  798 ++++
 .../windows_network_dns_lookup_result.md      |  812 ++++
 .../policy/policy_response.md                 | 1160 ++++++
 .../linux/linux_process_already_running.md    | 2571 +++++++++++++
 .../linux/linux_process_fork_exec_exit.md     | 2626 +++++++++++++
 .../process/linux/linux_process_gid_change.md | 2599 +++++++++++++
 .../linux/linux_process_memfd_create.md       | 2653 +++++++++++++
 .../process/linux/linux_process_ptrace.md     | 2595 +++++++++++++
 .../linux/linux_process_session_id_change.md  | 2545 +++++++++++++
 .../process/linux/linux_process_shmget.md     | 2595 +++++++++++++
 .../linux/linux_process_text_output.md        | 2622 +++++++++++++
 .../process/linux/linux_process_uid_change.md | 2611 +++++++++++++
 .../macos/macos_process_already_running.md    |  919 +++++
 .../macos/macos_process_fork_exec_exit.md     | 1169 ++++++
 .../macos/macos_process_remote_thread.md      | 1100 ++++++
 .../windows_process_already_running.md        | 1262 ++++++
 .../windows_process_create_and_exit.md        | 1594 ++++++++
 .../windows/windows_registry_modification.md  |  872 +++++
 .../windows/windows_registry_query.md         |  844 ++++
 .../macos_security_gatekeeper_override.md     |  922 +++++
 .../security/macos/macos_security_log_on.md   |  880 +++++
 .../macos/macos_security_rdp_log_on.md        |  880 +++++
 .../macos/macos_security_ssh_log_on.md        |  880 +++++
 .../windows/windows_security_log_off.md       |  811 ++++
 .../windows/windows_security_log_on.md        |  852 +++++
 .../windows/windows_volume_device_mount.md    |  822 ++++
 .../windows/windows_volume_device_unmount.md  |  696 ++++
 scripts/generate-docs/pydocgen/markdown.py    |   30 +-
 75 files changed, 97196 insertions(+), 11 deletions(-)
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md
 create mode 100644 custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md
 create mode 100644 custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md
 create mode 100644 custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md
 create mode 100644 custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md
 create mode 100644 custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md
 create mode 100644 custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md
 create mode 100644 custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md
 create mode 100644 custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md
 create mode 100644 custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md
 create mode 100644 custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md
 create mode 100644 custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md
 create mode 100644 custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md
 create mode 100644 custom_documentation/doc/sample_variant_1/metadata/metadata.md
 create mode 100644 custom_documentation/doc/sample_variant_1/metrics/metrics.md
 create mode 100644 custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md
 create mode 100644 custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md
 create mode 100644 custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md
 create mode 100644 custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md
 create mode 100644 custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md
 create mode 100644 custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md
 create mode 100644 custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md
 create mode 100644 custom_documentation/doc/sample_variant_1/policy/policy_response.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md
 create mode 100644 custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md
 create mode 100644 custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md
 create mode 100644 custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md
 create mode 100644 custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md
 create mode 100644 custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md
 create mode 100644 custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md
 create mode 100644 custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md
 create mode 100644 custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md
 create mode 100644 custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md
 create mode 100644 custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md
 create mode 100644 custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md

diff --git a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md
new file mode 100644
index 000000000..65f1cca57
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md
@@ -0,0 +1,1447 @@
+# Linux Malicious Behavior Alert
+
+## Description
+
+This alert is generated when a Malicious Behavior alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "behavior"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the artifact for linux malicious behavior alert.</td></tr>
+<tr><td>Example</td><td><code>stable</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Events.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Events._label`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Events._state`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.field`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Field in the triggering event to use as input for action</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.state`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Index of event in events array to use for field lookup</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.tree`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Result message</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entity id of actionable process</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of actionable process</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>pid of actionable process</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.result`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action result code</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.account.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td>Example</td><td><code>666777888999</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.description`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The description of the rule generating the event.</td></tr>
+<tr><td>Example</td><td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td>Example</td><td><code>101</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
+<tr><td>Example</td><td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The version / revision of the rule being used for analysis.</td></tr>
+<tr><td>Example</td><td><code>1.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.framework`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
+<tr><td>Example</td><td><code>MITRE ATT&CK</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.tactic.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td>Example</td><td><code>TA0002</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.tactic.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
+<tr><td>Example</td><td><code>Execution</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.tactic.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td>Example</td><td><code>https://attack.mitre.org/tactics/TA0002/</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td>Example</td><td><code>T1059</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td>Example</td><td><code>Command and Scripting Interpreter</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td>Example</td><td><code>https://attack.mitre.org/techniques/T1059/</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.subtechnique`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md
new file mode 100644
index 000000000..58b52952b
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md
@@ -0,0 +1,2963 @@
+# Linux Malware Alert
+
+## Description
+
+This alert is generated when a Malware alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "malicious_file"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the linux artifact.</td></tr>
+<tr><td>Example</td><td><code>stable</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The model's unique identifier.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The score produced by the classification model.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.threshold`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The version of the model used.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.all_names`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The concatenated names of all yara signatures</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Malware artifact identifier.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.matches`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of bytes representing yara signature matches</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.signature.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature sha256.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.signature.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.signature.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.matches`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.signature.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.signature.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.signature.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature version.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.quarantine_message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Message describing quarantine results.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.quarantine_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Path on endpoint the quarantined file was originally.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.quarantine_result`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.temp_file_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.accessed`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.inode`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td>Example</td><td><code>256383</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.mtime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Last time the file content was modified.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.owner`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File owner's username.</td></tr>
+<tr><td>Example</td><td><code>alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pgid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pgid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td>Example</td><td><code>101</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md
new file mode 100644
index 000000000..8c05e26de
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md
@@ -0,0 +1,2624 @@
+# Linux Memory Threat Alert
+
+## Description
+
+This alert is generated when a Memory Threat alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "memory_signature"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the linux artifact.</td></tr>
+<tr><td>Example</td><td><code>stable</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_base`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory allocation containing the memory region.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original memory size requested when the memory was allocated.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
+<tr><td>Example</td><td><code>PRIVATE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The address where bytes_compressed begins.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_allocation_offset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_compressed`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
+<tr><td>Example</td><td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_compressed_present`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether bytes_compressed is present in this event.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.all_names`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A sequence of signature names matched.</td></tr>
+<tr><td>Example</td><td><code>Windows.EICAR.Not-a-virus</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>malware signature identifier</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.matches`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The first matching details.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>sha256 hash of file matching signature.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.signature.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The id of the first yara rule matched.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.signature.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the first yara rule matched.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>malware signature version</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_base`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory region.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
+<tr><td>Example</td><td><code>RWX</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Size of the memory region.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pgid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pgid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td>Example</td><td><code>101</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md
new file mode 100644
index 000000000..f62a8f70a
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md
@@ -0,0 +1,1272 @@
+# macOS Malicious Behavior Alert
+
+## Description
+
+This alert is generated when a Malicious Behavior alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "behavior"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the macos artifact.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Events.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Events._label`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Events._state`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.field`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Field in the triggering event to use as input for action</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.state`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Index of event in events array to use for field lookup</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.tree`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Result message</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entity id of actionable process</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of actionable process</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>pid of actionable process</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.result`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action result code</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.description`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The description of the rule generating the event.</td></tr>
+<tr><td>Example</td><td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td>Example</td><td><code>101</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
+<tr><td>Example</td><td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The version / revision of the rule being used for analysis.</td></tr>
+<tr><td>Example</td><td><code>1.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.framework`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
+<tr><td>Example</td><td><code>MITRE ATT&CK</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.tactic.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td>Example</td><td><code>TA0002</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.tactic.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
+<tr><td>Example</td><td><code>Execution</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.tactic.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td>Example</td><td><code>https://attack.mitre.org/tactics/TA0002/</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td>Example</td><td><code>T1059</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td>Example</td><td><code>Command and Scripting Interpreter</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td>Example</td><td><code>https://attack.mitre.org/techniques/T1059/</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.subtechnique`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md
new file mode 100644
index 000000000..0bc18a86e
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md
@@ -0,0 +1,1846 @@
+# macOS Malware Alert
+
+## Description
+
+This alert is generated when a macOS Malware alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "malicious_file"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the macos artifact.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The model's unique identifier.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The score produced by the classification model.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.threshold`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The version of the model used.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.all_names`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The concatenated names of all yara signatures</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Malware artifact identifier.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.matches`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of bytes representing yara signature matches</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.signature.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature sha256.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.signature.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.signature.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.matches`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.signature.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.signature.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.signature.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature version.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.quarantine_message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Message describing quarantine results.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.quarantine_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Path on endpoint the quarantined file was originally.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.quarantine_result`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.temp_file_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.accessed`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.mtime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Last time the file content was modified.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.owner`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File owner's username.</td></tr>
+<tr><td>Example</td><td><code>alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pgid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pgid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td>Example</td><td><code>101</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md
new file mode 100644
index 000000000..2c67fa3d7
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md
@@ -0,0 +1,1585 @@
+# macOS Memory Threat Alert
+
+## Description
+
+This alert is generated when a macOS Memory Thread alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "memory_signature"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the macos artifact.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_base`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory allocation containing the memory region.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original memory size requested when the memory was allocated.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
+<tr><td>Example</td><td><code>PRIVATE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The address where bytes_compressed begins.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_allocation_offset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_compressed`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
+<tr><td>Example</td><td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_compressed_present`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether bytes_compressed is present in this event.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.all_names`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A sequence of signature names matched.</td></tr>
+<tr><td>Example</td><td><code>Windows.EICAR.Not-a-virus</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>malware signature identifier</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.matches`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The first matching details.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>sha256 hash of file matching signature.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.signature.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The id of the first yara rule matched.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.signature.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the first yara rule matched.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>malware signature version</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_base`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory region.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
+<tr><td>Example</td><td><code>RWX</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Size of the memory region.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pgid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pgid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td>Example</td><td><code>101</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md
new file mode 100644
index 000000000..f9a106bc0
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md
@@ -0,0 +1,1390 @@
+# Windows Malicious Behavior Alert
+
+## Description
+
+This alert occurs when a Malicious Behavior alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "behavior"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Events.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Events._label`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Events._state`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.field`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Field in the triggering event to use as input for action</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Destination file attributes</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Destination file path</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.reason`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Combined USN file modification reason</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Actions taken by Registry Rollback for key</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>NT path of registry key recovered by Rollback</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.values.actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Actions taken by Registry Rollback for value</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.values.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Value name recovered by Rollback</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.source.attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source file attributes</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.source.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source file path</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.state`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Index of event in events array to use for field lookup</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.tree`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Result message</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entity id of actionable process</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of actionable process</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>pid of actionable process</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.result`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action result code</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the destination.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.transport`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>tcp</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>ipv4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.*`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.description`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The description of the rule generating the event.</td></tr>
+<tr><td>Example</td><td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td>Example</td><td><code>101</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
+<tr><td>Example</td><td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The version / revision of the rule being used for analysis.</td></tr>
+<tr><td>Example</td><td><code>1.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.framework`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
+<tr><td>Example</td><td><code>MITRE ATT&CK</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.tactic.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td>Example</td><td><code>TA0002</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.tactic.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
+<tr><td>Example</td><td><code>Execution</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.tactic.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
+<tr><td>Example</td><td><code>https://attack.mitre.org/tactics/TA0002/</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td>Example</td><td><code>T1059</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td>Example</td><td><code>Command and Scripting Interpreter</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
+<tr><td>Example</td><td><code>https://attack.mitre.org/techniques/T1059/</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.subtechnique.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
+<tr><td>Example</td><td><code>T1059.001</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.subtechnique.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
+<tr><td>Example</td><td><code>PowerShell</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `threat.technique.subtechnique.reference`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
+<tr><td>Example</td><td><code>https://attack.mitre.org/techniques/T1059/001/</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md
new file mode 100644
index 000000000..acbd53eae
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md
@@ -0,0 +1,2585 @@
+# Windows Malware Alert
+
+## Description
+
+This alert is generated when a Malware alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "malicious_file"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Destination file attributes</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Destination file path</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.reason`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Combined USN file modification reason</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Actions taken by Registry Rollback for key</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>NT path of registry key recovered by Rollback</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.values.actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Actions taken by Registry Rollback for value</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.values.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Value name recovered by Rollback</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.process.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Path of process killed by Process Rollback</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.source.attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source file attributes</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.source.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source file path</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Result message</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.result`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action result code</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.device.bus_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.device.dos_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.device.file_system_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.device.nt_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.device.product_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ProductID of the device. It is provided by the vendor of the device if any.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.device.vendor_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>VendorID of the device. It is provided by the vendor of the device.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.device.volume_device_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The model's unique identifier.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The score produced by the classification model.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.threshold`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_classification.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The version of the model used.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.all_names`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The concatenated names of all yara signatures</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Malware artifact identifier.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.matches`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of bytes representing yara signature matches</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.signature.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature sha256.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.signature.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.primary.signature.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.matches`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.signature.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.signature.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.secondary.signature.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.malware_signature.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Primary malware signature version.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.quarantine_message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Message describing quarantine results.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.quarantine_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Path on endpoint the quarantined file was originally.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.quarantine_result`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.temp_file_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.accessed`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.drive_letter`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Drive letter where the file is located. This field is only relevant on Windows.  The value should be uppercase, and not include the colon.</td></tr>
+<tr><td>Example</td><td><code>C</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.mtime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Last time the file content was modified.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.owner`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File owner's username.</td></tr>
+<tr><td>Example</td><td><code>alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.Ext.dotnet`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether this file is a .NET PE</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.Ext.sections.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.Ext.sections.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.Ext.sections.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The section's name</td></tr>
+<tr><td>Example</td><td><code>.reloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.Ext.streams.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.Ext.streams.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.Ext.streams.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The stream's name</td></tr>
+<tr><td>Example</td><td><code>.reloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.company`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal company name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.description`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal description of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>Paint</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.file_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal version of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>6.3.9600.17415</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.original_file_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.pe.product`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal product name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>Microsoft® Windows® Operating System</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.services`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Services running in this process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Domain of token user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>What level of elevation the token has</td></tr>
+<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.sid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Username of token owner.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.company`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal company name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.description`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal description of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>Paint</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.file_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal version of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>6.3.9600.17415</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.original_file_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.product`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal product name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>Microsoft® Windows® Operating System</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td>Example</td><td><code>101</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md
new file mode 100644
index 000000000..b89844a3f
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md
@@ -0,0 +1,1804 @@
+# Windows Memory Threat Alert
+
+## Description
+
+This alert is generated when a Memory Threat alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "memory_signature"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_base`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory allocation containing the memory region.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td></tr>
+<tr><td>Example</td><td><code>RWX</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original memory size requested when the memory was allocated.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.allocation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
+<tr><td>Example</td><td><code>PRIVATE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The address where bytes_compressed begins.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_allocation_offset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_compressed`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
+<tr><td>Example</td><td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.bytes_compressed_present`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether bytes_compressed is present in this event.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.all_names`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A sequence of signature names matched.</td></tr>
+<tr><td>Example</td><td><code>Windows.EICAR.Not-a-virus</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>malware signature identifier</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.matches`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The first matching details.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>sha256 hash of file matching signature.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.signature.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The id of the first yara rule matched.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.primary.signature.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the first yara rule matched.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.malware_signature.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>malware signature version</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_base`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory region.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
+<tr><td>Example</td><td><code>RWX</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Size of the memory region.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_start_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>First 64 bytes at the region base address.</td></tr>
+<tr><td>Example</td><td><code>4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memory_region.region_state`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td></tr>
+<tr><td>Example</td><td><code>COMMIT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Domain of token user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>What level of elevation the token has</td></tr>
+<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.sid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Username of token owner.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
+<tr><td>Example</td><td><code>101</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
+<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md
new file mode 100644
index 000000000..879c90f48
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md
@@ -0,0 +1,2182 @@
+# Windows Ransomware Alert
+
+## Description
+
+This alert is generated when a Ransomware alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "ransomware"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.files.data`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File header or MBR bytes.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.files.entropy`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entropy of file contents.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.files.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.files.metrics`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Suspicious ransomware behaviours associated with the file event.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.files.operation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operation applied to file.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.files.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.files.score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Ransomware score for this particular file event.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.child_processes.score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total ransomware score for aggregated file events.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.feature`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Ransomware feature which triggered the alert.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.files.data`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File header or MBR bytes.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.files.entropy`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entropy of file contents.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.files.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.files.metrics`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Suspicious ransomware behaviours associated with the file event.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.files.operation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operation applied to file.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.files.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.files.score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Ransomware score for this particular file event.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total ransomware score for aggregated file events.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Ransomware.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Ransomware artifact version.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Destination file attributes</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Destination file path</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.reason`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Combined USN file modification reason</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Actions taken by Registry Rollback for key</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>NT path of registry key recovered by Rollback</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.source.attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source file attributes</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.source.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source file path</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Result message</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.result`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action result code</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.mapped_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The base address where this module is loaded.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.mapped_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The size of this module's memory mapping, in bytes.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full file path of the library.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Domain of token user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>What level of elevation the token has</td></tr>
+<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.sid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Username of token owner.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.company`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal company name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.description`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal description of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>Paint</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.file_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal version of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>6.3.9600.17415</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.original_file_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.product`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal product name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>Microsoft® Windows® Operating System</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md
new file mode 100644
index 000000000..052779be2
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md
@@ -0,0 +1,3378 @@
+# Windows Shellcode Thread Alert
+
+## Description
+
+This alert is generated when a Shellcode Threat alert occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.alerts-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "shellcode_thread"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Memory_protection.cross_session`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Is this process injecting across operating system sessions?</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Memory_protection.feature`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory Protection feature which triggered the alert.</td></tr>
+<tr><td>Example</td><td><code>shellcode_thread</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Memory_protection.parent_to_child`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Is this process injecting into its child?</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Memory_protection.self_injection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Is this alert about a process injecting into itself?</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Memory_protection.unique_key_v1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A unique key created by hashing several characteristics of this alert.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Memory_protection.unique_key_v2`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A unique key created by hashing several characteristics of this alert.</td></tr>
+<tr><td>Example</td><td><code>00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Destination file attributes</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Destination file path</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.file.reason`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Combined USN file modification reason</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Actions taken by Registry Rollback for key</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>NT path of registry key recovered by Rollback</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.values.actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Actions taken by Registry Rollback for value</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.key.values.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Value name recovered by Rollback</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.source.attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source file attributes</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.action.source.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source file path</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Result message</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Responses.result`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Response action result code</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.Ext.mapped_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The base address where this module is loaded.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.Ext.mapped_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The size of this module's memory mapping, in bytes.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.dll.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full file path of the library.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.allocation_base`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory allocation containing the memory region.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.allocation_protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td></tr>
+<tr><td>Example</td><td><code>RWX</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.allocation_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original memory size requested when the memory was allocated.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.allocation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
+<tr><td>Example</td><td><code>PRIVATE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.bytes_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The address where bytes_compressed begins.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.bytes_allocation_offset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.mapped_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>If the memory corresponds to a file mapping, this is the file's path.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\mshtml.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.memory_pe_detected`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether an executable file was found in memory.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.region_base`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory region.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.region_protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
+<tr><td>Example</td><td><code>RWX</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.region_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Size of the memory region.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.region_state`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td></tr>
+<tr><td>Example</td><td><code>COMMIT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.memory_region.strings`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of strings found within the memory region.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.token.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Domain of token user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.token.elevation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.token.elevation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>What level of elevation the token has</td></tr>
+<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.token.sid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.token.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Username of token owner.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.parent.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.call_stack.instruction_pointer`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The return address of this stack frame.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.call_stack.memory_section.memory_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.call_stack.memory_section.memory_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.call_stack.memory_section.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.call_stack.module_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the DLL/module containing `instruction_pointer`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.call_stack.module_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.call_stack.symbol_info`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The nearest symbol for `instruction_pointer`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.call_stack_summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
+<tr><td>Example</td><td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.original_start_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>When a trampoline was detected, this indicates the original content for the thread start address in memory.</td></tr>
+<tr><td>Example</td><td><code>4194304</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.original_start_address_allocation_offset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.original_start_address_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.</td></tr>
+<tr><td>Example</td><td><code>48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.original_start_address_bytes_disasm`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>When a trampoline was detected, this holds the disassembled code at the original thread start address.</td></tr>
+<tr><td>Example</td><td><code>mov rax, 0x4141414141414141\njmp rax</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.original_start_address_bytes_disasm_hash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td></tr>
+<tr><td>Example</td><td><code>aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.original_start_address_module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.</td></tr>
+<tr><td>Example</td><td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.start_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory address where the thread began execution.</td></tr>
+<tr><td>Example</td><td><code>4194304</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.start_address_allocation_offset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.start_address_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.</td></tr>
+<tr><td>Example</td><td><code>c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.start_address_bytes_disasm`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The bytes at the thread start address, disassembled into human-readable assembly code.</td></tr>
+<tr><td>Example</td><td><code>ret\nint3</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.start_address_bytes_disasm_hash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td></tr>
+<tr><td>Example</td><td><code>aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.Ext.start_address_module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The dll/module where the thread began execution.</td></tr>
+<tr><td>Example</td><td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.risk_score`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.severity`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
+<tr><td>Example</td><td><code>7</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.mapped_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The base address where this module is loaded.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.Ext.mapped_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The size of this module's memory mapping, in bytes.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.dll.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full file path of the library.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Domain of token user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>What level of elevation the token has</td></tr>
+<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.sid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Username of token owner.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.user`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User associated with the running process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.ppid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Parent process' pid.</td></tr>
+<tr><td>Example</td><td><code>4241</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack.instruction_pointer`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The return address of this stack frame.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack.memory_section.memory_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack.memory_section.memory_size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack.memory_section.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack.module_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the DLL/module containing `instruction_pointer`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack.module_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack.symbol_info`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The nearest symbol for `instruction_pointer`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack_final_user_module.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The file name of the call_stack_final_user_module.</td></tr>
+<tr><td>Example</td><td><code>example.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack_summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
+<tr><td>Example</td><td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.start_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory address where the thread began execution.</td></tr>
+<tr><td>Example</td><td><code>4194304</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.start_address_module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The dll/module where the thread began execution.</td></tr>
+<tr><td>Example</td><td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `rule.ruleset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
+<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md
new file mode 100644
index 000000000..6d86c5c98
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md
@@ -0,0 +1,885 @@
+# Windows AMSI API
+
+## Description
+
+This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Antimalware-Scan-Interface" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td>Example</td><td><code>kernel</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.behaviors`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.return_value`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Return value of RegisterRawInputDevices API call.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.app_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The application name requesting the AMSI scan.</td></tr>
+<tr><td>Example</td><td><code>PowerShell</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.buffer`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The content associated with an AMSI scan.</td></tr>
+<tr><td>Example</td><td><code>[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport("kernel32.dll")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20);</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.content_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The content name, typically a filename, associated with an AMSI scan.</td></tr>
+<tr><td>Example</td><td><code>C:\script.ps1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The size.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md
new file mode 100644
index 000000000..0688bdcee
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md
@@ -0,0 +1,926 @@
+# Windows API
+
+## Description
+
+This event is generated when ETW AttackSurfaceMonitor events are generated.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "AttackSurfaceMonitor" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full file path of the library.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td>Example</td><td><code>kernel</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.behaviors`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.device`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the device object.</td></tr>
+<tr><td>Example</td><td><code>\Device\NPCAP</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.io_control_code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The I/O control code for the requested device operation.</td></tr>
+<tr><td>Example</td><td><code>27365</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md
new file mode 100644
index 000000000..6d6c7f2ad
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md
@@ -0,0 +1,879 @@
+# Windows API
+
+## Description
+
+This event is generated when a process attempts to access priviledged credentials. 
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "ObjectCallback" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td>Example</td><td><code>kernel</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.desired_access`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.desired_access_numeric`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.handle_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This parameter indicates whether the detected access was attempt against a process or a thread.</td></tr>
+<tr><td>Example</td><td><code>process</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack.instruction_pointer`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The return address of this stack frame.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack.module_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack_contains_unbacked`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.Ext.call_stack_final_user_module.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The file path of the call_stack_final_user_module.</td></tr>
+<tr><td>Example</td><td><code>C:\Program Files\Example\example.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md
new file mode 100644
index 000000000..79d9a9904
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md
@@ -0,0 +1,815 @@
+# Windows API
+
+## Description
+
+This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events are generated.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Kernel-Audit-API-Calls" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td>Example</td><td><code>kernel</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.behaviors`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md
new file mode 100644
index 000000000..8ce239ac0
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md
@@ -0,0 +1,869 @@
+# Windows API
+
+## Description
+
+This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-TCPIP" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the destination.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td>Example</td><td><code>kernel</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.transport`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>tcp</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>ipv4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.behaviors`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md
new file mode 100644
index 000000000..dd43f606e
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md
@@ -0,0 +1,1428 @@
+# Windows API
+
+## Description
+
+This event is generated when ETW Threat-Intelligence events are generated.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Threat-Intelligence" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.created_suspended`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td>Example</td><td><code>kernel</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.behaviors`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.target_address_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the memory region targeted by the API call.</td></tr>
+<tr><td>Example</td><td><code>Unbacked</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.target_address_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The path of the memory region targeted by the API call.</td></tr>
+<tr><td>Example</td><td><code>C:\programdata\example.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The target memory address.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.allocation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td></tr>
+<tr><td>Example</td><td><code>COMMIT|RESERVE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.argument1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The first argument to the procedure.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.argument2`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The second argument to the procedure.</td></tr>
+<tr><td>Example</td><td><code>2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.argument3`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The third argument to the procedure.</td></tr>
+<tr><td>Example</td><td><code>3</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.context_flags`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`</td></tr>
+<tr><td>Example</td><td><code>1048607</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.desired_access`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.desired_access_numeric`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.device`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the device object.</td></tr>
+<tr><td>Example</td><td><code>\Device\NPCAP</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.driver`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the driver object.</td></tr>
+<tr><td>Example</td><td><code>\Driver\npcap</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.eax`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.ebp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x86 EBP frame pointer register.</td></tr>
+<tr><td>Example</td><td><code>15006644</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.ebx`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x86 EBX general purpose register.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.ecx`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x86 ECX general purpose register. First argument in __fastcall and __thiscall.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.edi`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x86 EDI general purpose register.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.edx`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x86 EDX general purpose register. Second argument in a __fastcall.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.eip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x86 EIP instruction pointer register.</td></tr>
+<tr><td>Example</td><td><code>1472790528</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.esi`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x86 ESI general purpose register.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.esp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x86 ESP stack pointer register.</td></tr>
+<tr><td>Example</td><td><code>15007744</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.handle_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This parameter indicates whether the detected access was attempt against a process or a thread.</td></tr>
+<tr><td>Example</td><td><code>process</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.procedure`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The memory address of the procedure or function.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td>Example</td><td><code>RWX|GUARD</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.protection_old`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td>Example</td><td><code>RCX</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.r8`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 R8 general purpose register. Third argument in a __fastcall.</td></tr>
+<tr><td>Example</td><td><code>3</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.r9`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 R9 general purpose register. Fourth argument in a __fastcall.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.rax`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 RAX general purpose register. Return value in a __fastcall.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.rbp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 RBP general purpose register.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.rbx`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 RBX general purpose register.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.rcx`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 RCX general purpose register. First argument in a __fastcall.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.rdi`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 RDI general purpose register.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.rdx`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 RDX general purpose register. Second argument in a __fastcall.</td></tr>
+<tr><td>Example</td><td><code>2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.rip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 RIP instruction pointer register.</td></tr>
+<tr><td>Example</td><td><code>140706153693184</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.rsi`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 RSI general purpose register.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.rsp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The x64 RSP stack pointer register.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The size.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md
new file mode 100644
index 000000000..ecbbdcf78
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md
@@ -0,0 +1,1177 @@
+# Windows Win32k API
+
+## Description
+
+This event is generated when keylogging-related Win32k APIs are called.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Win32k" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td>Example</td><td><code>kernel</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.behaviors`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.background_callcount`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.</td></tr>
+<tr><td>Example</td><td><code>6021</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.ms_since_last_keyevent`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.</td></tr>
+<tr><td>Example</td><td><code>94</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.procedure_symbol`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Summary of the hook procedure.</td></tr>
+<tr><td>Example</td><td><code>taskbar.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.return_value`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Return value of RegisterRawInputDevices API call.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.start_address_allocation_protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Memory protection attributes associated with the starting address of a thread.</td></tr>
+<tr><td>Example</td><td><code>RCX</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.start_address_module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module associated with the starting address of a thread.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\DellTPad\ApMsgFwd.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.target_address_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the memory region targeted by the API call.</td></tr>
+<tr><td>Example</td><td><code>Unbacked</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.target_address_path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The path of the memory region targeted by the API call.</td></tr>
+<tr><td>Example</td><td><code>C:\programdata\example.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.thread_info_flags`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread info flags.</td></tr>
+<tr><td>Example</td><td><code>16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.visible_windows_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of visible windows owned by the caller thread.</td></tr>
+<tr><td>Example</td><td><code>0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.windows_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of windows owned by the caller thread.</td></tr>
+<tr><td>Example</td><td><code>2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The target memory address.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.allocation_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td></tr>
+<tr><td>Example</td><td><code>COMMIT|RESERVE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.flags`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.</td></tr>
+<tr><td>Example</td><td><code>INPUTSINK</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.hook_module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>DLL containing the hook procedure.</td></tr>
+<tr><td>Example</td><td><code>c:\windows\system32\taskbar.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.hook_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of hook procedure to be installed.</td></tr>
+<tr><td>Example</td><td><code>WH_KEYBOARD_LL</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.procedure`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The memory address of the procedure or function.</td></tr>
+<tr><td>Example</td><td><code>2431737462784</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td>Example</td><td><code>RWX|GUARD</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.protection_old`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
+<tr><td>Example</td><td><code>RCX</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The size.</td></tr>
+<tr><td>Example</td><td><code>4096</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.usage`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.</td></tr>
+<tr><td>Example</td><td><code>KEYBOARD</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.usage_page`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.</td></tr>
+<tr><td>Example</td><td><code>GENERIC</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md
new file mode 100644
index 000000000..2dcdc9479
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md
@@ -0,0 +1,1021 @@
+# Windows API
+
+## Description
+
+This event is generated when WMI Activity-related APIs are called.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.api-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-WMI-Activity" and host.os.type : "windows"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
+<tr><td>Example</td><td><code>kernel</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.behaviors`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
+<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.client_is_local`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.client_machine`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Client process's machine name (provided by the client and potentially untrustworthy).</td></tr>
+<tr><td>Example</td><td><code>DESKTOP-EXAMPLE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.client_machine_fqdn`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Client process's machine name FQDN (provided by the client and potentially untrustworthy).</td></tr>
+<tr><td>Example</td><td><code>DESKTOP-EXAMPLE.elastic.co</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.metadata.client_process_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Client process id</td></tr>
+<tr><td>Example</td><td><code>3600</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
+<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.consumer_details`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.consumer_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.</td></tr>
+<tr><td>Example</td><td><code>ExampleConsumer</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.consumer_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An example list of consumer type.    "ActiveScriptEventConsumer" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.    "CommandLineEventConsumer" - Launches an arbitrary process in the local system context when an event is delivered to it.    "LogFileEventConsumer" - Writes customized strings to a text log file when events are delivered to it.    "NTEventLogEventConsumer" - Logs a specific message to the Windows event log when an event is delivered to it.    "SMTPEventConsumer" - Sends an email message using SMTP each time an event is delivered to it.</td></tr>
+<tr><td>Example</td><td><code>CommandLineEventConsumer</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.event_filter_details`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Provide an overview of the query that define when an event should be triggered.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.event_filter_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.</td></tr>
+<tr><td>Example</td><td><code>ExampleFilter</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>WMI namespace to which the connection is made.</td></tr>
+<tr><td>Example</td><td><code>root\Microsoft\Windows\DeviceGuard</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.parameters.operation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Specifies the connection or request to WMI</td></tr>
+<tr><td>Example</td><td><code>Win32_Process::Create</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.api.summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
+<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md
new file mode 100644
index 000000000..8f8211172
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md
@@ -0,0 +1,810 @@
+# Linux File Create
+
+## Description
+
+This event is generated when a file is created.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "creation"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md
new file mode 100644
index 000000000..875c487ae
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md
@@ -0,0 +1,797 @@
+# Linux File Delete
+
+## Description
+
+This event is generated when a file is deleted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "deletion"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md
new file mode 100644
index 000000000..4ce505f63
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md
@@ -0,0 +1,575 @@
+# Linux Malware Unquarantine
+
+## Description
+
+This event is generated when Endpoint restores a file from the malware quarantine.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "endpoint_unquarantine"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.Ext.correlation.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md
new file mode 100644
index 000000000..5f136f3b6
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md
@@ -0,0 +1,849 @@
+# Linux File Rename
+
+## Description
+
+This event is generated when a file is renamed.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "rename"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file extension prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file name prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md
new file mode 100644
index 000000000..5190ff80a
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md
@@ -0,0 +1,702 @@
+# macOS File Rename
+
+## Description
+
+This event is generated when a file is accessed.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "open"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.inode`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td>Example</td><td><code>256383</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md
new file mode 100644
index 000000000..af99fdd1c
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md
@@ -0,0 +1,909 @@
+# macOS File Delete
+
+## Description
+
+This event is generated when a file is deleted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "deletion"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.inode`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td>Example</td><td><code>256383</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md
new file mode 100644
index 000000000..ee073f6b2
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md
@@ -0,0 +1,575 @@
+# macOS Malware Unquarantine
+
+## Description
+
+This event is generated when Endpoint restores a file from the malware quarantine.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "endpoint_unquarantine"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.Ext.correlation.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md
new file mode 100644
index 000000000..10eaf4113
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md
@@ -0,0 +1,908 @@
+# macOS File Extended Attributes Delete
+
+## Description
+
+This event is generated when extended file attributes are deleted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "extended_attributes_delete"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of file attributes.  Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.</td></tr>
+<tr><td>Example</td><td><code>["readonly", "system"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.inode`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td>Example</td><td><code>256383</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md
new file mode 100644
index 000000000..0159557e8
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md
@@ -0,0 +1,876 @@
+# macOS Launch Daemon
+
+## Description
+
+This event includes information about a macOS Launch Daemon.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "launch_daemon"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Persistence.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Arguments used to execute the persistence item</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Persistence.keepalive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Keep alive option boolean</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Persistence.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The persistence item's name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Persistence.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The file's path</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Persistence.runatload`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Run at load option boolean</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md
new file mode 100644
index 000000000..a588c714d
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md
@@ -0,0 +1,935 @@
+# macOS File Modification
+
+## Description
+
+This event is generated when a file is modified.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "modification"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.header_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.inode`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td>Example</td><td><code>256383</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md
new file mode 100644
index 000000000..fbd8e8ce3
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md
@@ -0,0 +1,866 @@
+# macOS Mount
+
+## Description
+
+This event is generated when a file system is mounted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "mount"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.inode`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td>Example</td><td><code>256383</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md
new file mode 100644
index 000000000..99be5c83c
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md
@@ -0,0 +1,948 @@
+# macOS File Rename
+
+## Description
+
+This event is generated when a file is renamed.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "rename"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file extension prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.inode`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
+<tr><td>Example</td><td><code>256383</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md
new file mode 100644
index 000000000..440d7016f
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md
@@ -0,0 +1,963 @@
+# Windows File Create
+
+## Description
+
+This event is generated when a file is created.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "creation"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.entropy`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.header_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.monotonic_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File event monotonic ID.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.windows.zone_identifier`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Windows zone identifier for a file</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.origin_referrer_url`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The url of the webpage that linked to the file.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.origin_url`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The url where the file is hosted.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md
new file mode 100644
index 000000000..cb6e2d73d
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md
@@ -0,0 +1,898 @@
+# Windows File Delete
+
+## Description
+
+This event is generated when a file is deleted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "deletion"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.entropy`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.monotonic_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File event monotonic ID.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md
new file mode 100644
index 000000000..1b8c699bb
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md
@@ -0,0 +1,575 @@
+# Windows Malware Unquarantine
+
+## Description
+
+This event is generated when Endpoint restores a file from the malware quarantine.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "endpoint_unquarantine"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.Ext.correlation.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md
new file mode 100644
index 000000000..297632216
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md
@@ -0,0 +1,910 @@
+# Windows File Modification
+
+## Description
+
+This event is generated when a file is modified.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "modification"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.entropy`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.header_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.monotonic_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File event monotonic ID.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md
new file mode 100644
index 000000000..9da4be12f
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md
@@ -0,0 +1,924 @@
+# Windows File Open
+
+## Description
+
+This event is generated when a file is opened.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "open"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.entropy`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.header_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.monotonic_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File event monotonic ID.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md
new file mode 100644
index 000000000..64257aa30
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md
@@ -0,0 +1,910 @@
+# Windows File Overwrite
+
+## Description
+
+This event is generated when a file is overwritten
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "overwrite"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.entropy`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.header_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.monotonic_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File event monotonic ID.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md
new file mode 100644
index 000000000..319c8e3ec
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md
@@ -0,0 +1,963 @@
+# Windows File Rename
+
+## Description
+
+This event is generated when a file is renamed.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.file-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "rename"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.entropy`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.header_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.monotonic_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File event monotonic ID.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file extension prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file name prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.Ext.original.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.extension`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
+<tr><td>Example</td><td><code>png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
+<tr><td>Example</td><td><code>example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
+<tr><td>Example</td><td><code>16384</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Thread ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md b/custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md
new file mode 100644
index 000000000..40c250a4c
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md
@@ -0,0 +1,947 @@
+# Windows Library Load
+
+## Description
+
+This event is generated when a dynlib is loaded.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.library-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.library" and event.module : "endpoint" and host.os.type : "macos" and event.action : "load"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Size of DLL</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full file path of the library.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md b/custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md
new file mode 100644
index 000000000..efa2a1be2
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md
@@ -0,0 +1,1031 @@
+# Windows Library Load
+
+## Description
+
+This event is generated when a DLL or driver is loaded.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.library-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.library" and event.module : "endpoint" and host.os.type : "windows" and event.action : "load"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.defense_evasions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.load_index`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.  The first load index is 1.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.relative_file_creation_time`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.relative_file_name_modify_time`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.Ext.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Size of DLL</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
+<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full file path of the library.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.pe.file_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal version of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>6.3.9600.17415</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.pe.imphash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
+<tr><td>Example</td><td><code>0c6803c4e922103c4dca5963aad36ddf</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dll.pe.original_file_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/metadata/metadata.md b/custom_documentation/doc/sample_variant_1/metadata/metadata.md
new file mode 100644
index 000000000..6d4f2637e
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/metadata/metadata.md
@@ -0,0 +1,626 @@
+# Endpoint Metadata
+
+## Description
+
+This is a relatively small state management document that includes details about an installed Endpoint.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux, macOS, Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>metrics-endpoint.metadata-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.metadata" and event.module : "endpoint" and event.action : "endpoint_metadata"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.capabilities`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Enabled capabilities</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.configuration.isolation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Configuration setting for Host Isolation from the network</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the status of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.state.isolation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Current network isolation state of the host</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.state.tamper_protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The current status of the endpoint e.g. enrolled, unenrolled.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/metrics/metrics.md b/custom_documentation/doc/sample_variant_1/metrics/metrics.md
new file mode 100644
index 000000000..ce3ffff09
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/metrics/metrics.md
@@ -0,0 +1,2452 @@
+# Endpoint Metrics
+
+## Description
+
+This is an internal state management document that includes metrics on Endpoint's performance.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux, macOS, Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>metrics-endpoint.metrics-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.metrics" and event.module : "endpoint" and event.action : "endpoint_metrics"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.behavior.rtt`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.behavior.timeout_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.malware_score.rtt`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.malware_score.timeout_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.rtt`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.timeout_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.ransomware.rtt`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.ransomware.timeout_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.rtt`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.timeout_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.shell_code.rtt`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cloud_services.reputation_lookups.shell_code.timeout_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cpu.endpoint.histogram.counts`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cpu.endpoint.histogram.values`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cpu.endpoint.latest`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Average CPU over the last sample interval</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.cpu.endpoint.mean`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Average CPU load used by the endpoint</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.disks.device`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Device name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.disks.endpoint_drive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This field will be present and set to true only for the drive that holds the installed endpoint</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.disks.free`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The number of bytes marked as free on the disk</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.disks.fstype`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The file system type for the drive</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.disks.mount`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The disks mount location</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.disks.total`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The size of the disk in bytes</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.alerts.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.alerts.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.alerts.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.alerts.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.api_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of API Event sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.api_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent API Event documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.api_events.sources.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of API Event sent documents from source</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.api_events.sources.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent API Event documents from source</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.api_events.sources.source`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>API Event document source name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed API Event documents from source</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.api_events.sources.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed API Event documents from source</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.api_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed API Event documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.api_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed API Event documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.device_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.device_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.device_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.device_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.dns_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.dns_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.dns_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.dns_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.file_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.file_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.file_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.file_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.library_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.library_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.library_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.library_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.network_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.network_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.network_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.network_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.overall.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.overall.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.overall.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.overall.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.process_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.process_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.process_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.process_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.registry_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.registry_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.registry_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.registry_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.security_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.security_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of sent documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.security_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.security_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of suppressed documents</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.volume_device_events.sent_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.volume_device_events.sent_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.volume_device_events.suppressed_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.documents_volume.volume_device_events.suppressed_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.event_filter.active_global_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The number of active global event filters</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.event_filter.active_user_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The number of active user event filters</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Perfect of Endpoint's update spent running the rule</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.malicious_behavior_rules.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The rule id</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.memory.endpoint.private.latest`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The memory usage by the endpoint for the last sample interval</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.memory.endpoint.private.mean`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Average memory usage by the endpoint since its start</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.amsi_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.amsi_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.attack_surface_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.attack_surface_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.authentication_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing authentication events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.authentication_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on authentication events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.behavior_protection.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.behavior_protection.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.cred_access_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.cred_access_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.dns_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing DNS events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.dns_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on DNS events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.file_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing file events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.file_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on file events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.kernel_api_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.kernel_api_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.library_load_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing library load events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.library_load_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on library load events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.malware.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing malware scanning due to the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.malware.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on malware scanning due to the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.memory_scan.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.memory_scan.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.network_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing network events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.network_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on network events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.overall.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing activity for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.overall.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent monitoring the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>'The identifier used to sign the binary.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>'The team identifier used to sign the binary.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Path to the process executable for the impact entry</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing process events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on process events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process_injection.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.process_injection.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.ransomware.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.ransomware.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.registry_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing registry events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.registry_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on registry events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.tcpip_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.tcpip_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.threat_intelligence_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.volume_device_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.volume_device_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.win32k_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.win32k_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.wmi_events.week_idle_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.system_impact.wmi_events.week_ms`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.threads.cpu.mean`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The thread's average CPU use</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.threads.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The thread name</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.top_process_trees.values.event_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.top_process_trees.values.last_seen`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.top_process_trees.values.sample.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.top_process_trees.values.sample.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.top_process_trees.values.sample.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.top_process_trees.values.sample.parent_command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.top_process_trees.window_end`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.top_process_trees.window_start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.uptime.endpoint`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of seconds since the endpoint was started</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.metrics.uptime.system`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of seconds since the system was started</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md
new file mode 100644
index 000000000..ff068858c
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md
@@ -0,0 +1,958 @@
+# Linux Network Connection Attempted, Connection Accepted, and Disconnect
+
+## Description
+
+This event is generated when a network session is accepted, attempted or terminated.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "linux" and event.action : "connection_attempted" or "connection_accepted" or "disconnect_received"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Bytes sent from the destination to the source.</td></tr>
+<tr><td>Example</td><td><code>184</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the destination.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.direction`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td></tr>
+<tr><td>Example</td><td><code>inbound</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.transport`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>tcp</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>ipv4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.effective`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.permitted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Bytes sent from the source to the destination.</td></tr>
+<tr><td>Example</td><td><code>184</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the source.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md b/custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md
new file mode 100644
index 000000000..97a50073a
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md
@@ -0,0 +1,722 @@
+# Linux DNS Lookup Result
+
+## Description
+
+This event is generated when results are returned for a DNS lookup request.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "linux" and event.action : "lookup_result"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the destination.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.question.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
+<tr><td>Example</td><td><code>www.example.com</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.question.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The type of record being queried.</td></tr>
+<tr><td>Example</td><td><code>AAAA</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.resolved_ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
+<tr><td>Example</td><td><code>["10.10.10.10", "10.10.10.11"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.protocol`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>http</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.transport`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>tcp</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.effective`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.permitted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the source.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md b/custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md
new file mode 100644
index 000000000..134ed9c6e
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md
@@ -0,0 +1,931 @@
+# macOS Network Connection Attempted and Disconnect Received
+
+## Description
+
+This event is generated when a connection is attempted or a request to terminate a network connection occurs.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "macos" and event.action : "connection_attempted" or "disconnect_received"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Bytes sent from the destination to the source.</td></tr>
+<tr><td>Example</td><td><code>184</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The domain name of the destination system.  This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.</td></tr>
+<tr><td>Example</td><td><code>foo.example.com</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the destination.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.transport`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>tcp</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>ipv4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Bytes sent from the source to the destination.</td></tr>
+<tr><td>Example</td><td><code>184</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the source.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md b/custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md
new file mode 100644
index 000000000..fc90dc694
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md
@@ -0,0 +1,971 @@
+# macOS DNS Lookup Result
+
+## Description
+
+This event is generated when results are returned for a DNS lookup request.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "macos" and event.action : "lookup_result"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the destination.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.Ext.options`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.Ext.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>DNS status field, uint32</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.question.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
+<tr><td>Example</td><td><code>www.example.com</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.question.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The type of record being queried.</td></tr>
+<tr><td>Example</td><td><code>AAAA</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.resolved_ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
+<tr><td>Example</td><td><code>["10.10.10.10", "10.10.10.11"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.protocol`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>http</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.transport`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>tcp</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>ipv4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the source.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md
new file mode 100644
index 000000000..d2ffedc25
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md
@@ -0,0 +1,880 @@
+# Windows Network Connection Attempted, Connection Accepted and Disconnect Received
+
+## Description
+
+This event is generated when a connection is attempted, a connection is accepted, or a request to terminate a network session is received.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "connection_attempted" or "connection_accepted" or "disconnect_received"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Bytes sent from the destination to the source.</td></tr>
+<tr><td>Example</td><td><code>184</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the destination.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.direction`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td></tr>
+<tr><td>Example</td><td><code>inbound</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.transport`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>tcp</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>ipv4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.uptime`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
+<tr><td>Example</td><td><code>1325</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Bytes sent from the source to the destination.</td></tr>
+<tr><td>Example</td><td><code>184</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `source.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the source.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md
new file mode 100644
index 000000000..94098b9e8
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md
@@ -0,0 +1,798 @@
+# Windows DNS Lookup Request
+
+## Description
+
+This event is generated when a DNS lookup request is initiated.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "lookup_requested"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the destination.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.Ext.options`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.Ext.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>DNS status field, uint32</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.question.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
+<tr><td>Example</td><td><code>www.example.com</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.protocol`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>http</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md
new file mode 100644
index 000000000..a05dc7ab2
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md
@@ -0,0 +1,812 @@
+# Windows DNS Lookup Result
+
+## Description
+
+This event is generated when results are returned for a DNS lookup request.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.network-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "lookup_result"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Port of the destination.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.Ext.options`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.Ext.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>DNS status field, uint32</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.question.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
+<tr><td>Example</td><td><code>www.example.com</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `dns.resolved_ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
+<tr><td>Example</td><td><code>["10.10.10.10", "10.10.10.11"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.destination.port`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `network.protocol`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
+<tr><td>Example</td><td><code>http</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/policy/policy_response.md b/custom_documentation/doc/sample_variant_1/policy/policy_response.md
new file mode 100644
index 000000000..bc246ffed
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/policy/policy_response.md
@@ -0,0 +1,1160 @@
+# Endpoint Policy Response
+
+## Description
+
+This is a state management document that is generated every time Endpoint refreshes it's policy. It contains details of what Endpoint features are and are not in a healthy state.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux, macOS, Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>metrics-endpoint.policy-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.policy" and event.module : "endpoint" and event.action : "endpoint_policy_response"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.configuration.isolation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Configuration setting for Host Isolation from the network</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.actions.message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>message about the application of the action to further qualify the status of the action</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.actions.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>name of the action that was applied</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.actions.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the status of the action</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.actions.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the status of the action</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.channel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The channel of the linux artifact.</td></tr>
+<tr><td>Example</td><td><code>stable</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.snapshot`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.update_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.global.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.artifacts.user.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.endpoint_policy_version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the id of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the name of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for antivirus registration</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.antivirus_registration.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for attack surface reduction</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.attack_surface_reduction.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for behavior_protection</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.behavior_protection.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.events.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for event collection</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.events.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for host isolation</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.host_isolation.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.logging.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for logging</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.logging.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.malware.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for malware</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.malware.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for memory_protection</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.memory_protection.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.ransomware.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for ransomware</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.ransomware.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.response_actions.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.response_actions.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.streaming.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for data streaming</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.configurations.streaming.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for the diagnostic configuration of behavior protection</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.diagnostic.behavior_protection.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.diagnostic.malware.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for the diagnostic configuration of malware</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.diagnostic.malware.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for the diagnostic configuration of memory protection</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.diagnostic.memory_protection.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>all actions that were taken for the diagnostic configuration of ransomware</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.response.diagnostic.ransomware.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the status of the applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.policy.applied.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>the version of this applied policy</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.state.isolation`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Current network isolation state of the host</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Endpoint.state.tamper_protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.build.original`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
+<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md
new file mode 100644
index 000000000..2be70b01a
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md
@@ -0,0 +1,2571 @@
+# Linux Already Running Process
+
+## Description
+
+This event is generated for a process that was already running before Endpoint's process collection was enabled.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "already_running"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.account.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td>Example</td><td><code>666777888999</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.effective`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.permitted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md
new file mode 100644
index 000000000..2af06a408
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md
@@ -0,0 +1,2626 @@
+# Linux Process Fork, Exec, and Exit
+
+## Description
+
+This event is generated when a process calls `fork()`, `exec()`, exits, or an aggregation of the previous.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "fork" or "exec" or "end"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.account.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td>Example</td><td><code>666777888999</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted_descendant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.end`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process ended.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.env_vars`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.exit_code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td>Example</td><td><code>137</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.effective`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.permitted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md
new file mode 100644
index 000000000..cf734c6b2
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md
@@ -0,0 +1,2599 @@
+# Linux Process Group ID Change
+
+## Description
+
+This event is generated when the group id changes for a process.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "gid_change"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.account.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td>Example</td><td><code>666777888999</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted_descendant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.end`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process ended.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.exit_code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td>Example</td><td><code>137</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.effective`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.permitted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md
new file mode 100644
index 000000000..c647c4a15
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md
@@ -0,0 +1,2653 @@
+# Linux memfd Creation Events
+
+## Description
+
+This event is generated when when a memfd anonymous file is created.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "memfd_create"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.account.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td>Example</td><td><code>666777888999</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted_descendant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memfd.flag_hugetlb`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The anonymous file will be created in the hugetlbfs filesystem using huge pages.</td></tr>
+<tr><td>Example</td><td><code>false</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memfd.flag_allow_seal`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Allow sealing operations on this file.</td></tr>
+<tr><td>Example</td><td><code>false</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memfd.flags`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Flags passed to the memfd operation.</td></tr>
+<tr><td>Example</td><td><code>2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memfd.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Filename for the created file. Appears in /proc/self/fd.</td></tr>
+<tr><td>Example</td><td><code>anon.txt</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memfd.flag_exec`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Exec flag is set for file.</td></tr>
+<tr><td>Example</td><td><code>false</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memfd.flag_cloexec`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sets the the close-on-exec flag on the new file descriptor.</td></tr>
+<tr><td>Example</td><td><code>false</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.memfd.flag_noexec_seal`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sets both NOEXEC and MFD_ALLOW_SEALING.</td></tr>
+<tr><td>Example</td><td><code>false</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.end`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process ended.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.exit_code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td>Example</td><td><code>137</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md
new file mode 100644
index 000000000..8ce55b89b
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md
@@ -0,0 +1,2595 @@
+# Linux ptrace_attach Creation Events
+
+## Description
+
+This event is generated when when a process calls ptrace_attach on another process.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "ptrace"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.account.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td>Example</td><td><code>666777888999</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted_descendant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ptrace.child_pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>PID of the ptrace target.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ptrace.request`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ptrace request.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.end`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process ended.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.env_vars`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.exit_code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td>Example</td><td><code>137</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md
new file mode 100644
index 000000000..5d7f8f321
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md
@@ -0,0 +1,2545 @@
+# Linux Session ID Change
+
+## Description
+
+This event is generated when a process's session id changes.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "session_id_change"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.account.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td>Example</td><td><code>666777888999</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.effective`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.permitted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md
new file mode 100644
index 000000000..5e59cc61e
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md
@@ -0,0 +1,2595 @@
+# Linux shmget Creation Events
+
+## Description
+
+This event is generated when when a process calls shmget().
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "shmget"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.account.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td>Example</td><td><code>666777888999</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted_descendant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.shmget.size`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Requested size.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.shmget.flags`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>flags passed to shmget.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.shmget.key`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Key passed to the shmget request.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.end`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process ended.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.env_vars`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.exit_code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td>Example</td><td><code>137</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md
new file mode 100644
index 000000000..0613a0725
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md
@@ -0,0 +1,2622 @@
+# Linux Process Text Output
+
+## Description
+
+This event is generated when a process generates text output.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "text_output"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.io.bytes_skipped.length`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.io.bytes_skipped.offset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.io.max_bytes_per_process_exceeded`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.io.text`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A chunk of output or input sanitized to UTF-8.  Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.io.total_bytes_captured`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total number of bytes captured in this event.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.io.total_bytes_skipped`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.io.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.effective`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.permitted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.columns`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The number of character columns per line. e.g terminal width  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td></tr>
+<tr><td>Example</td><td><code>80</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.rows`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The number of character rows in the terminal. e.g terminal height  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td></tr>
+<tr><td>Example</td><td><code>24</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md
new file mode 100644
index 000000000..563f5c52f
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md
@@ -0,0 +1,2611 @@
+# Linux Process User ID Change
+
+## Description
+
+This event is generated when the user id changes for a process.
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Linux</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "uid_change"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.account.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
+<tr><td>Example</td><td><code>666777888999</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.instance.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.project.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
+<tr><td>Example</td><td><code>my-project</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.provider`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
+<tr><td>Example</td><td><code>aws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `cloud.region`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
+<tr><td>Example</td><td><code>us-east-1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique container id.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.hash.all`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
+<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.image.tag`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container image tags.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `container.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Container name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.cluster.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the cluster.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
+<tr><td>Example</td><td><code>kube-system</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.parent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
+<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `orchestrator.resource.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
+<tr><td>Example</td><td><code>service</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted_descendant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.end`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process ended.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.source.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.entry_meta.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entry_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.exit_code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td>Example</td><td><code>137</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.group_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.previous.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.interactive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.real_user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.same_as_process`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.session_leader.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.start`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The time the process started.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.supplemental_groups.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.effective`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.thread.capabilities.permitted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
+<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.major`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.tty.char_device.minor`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
+<tr><td>Example</td><td><code>1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md
new file mode 100644
index 000000000..3ab026d1c
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md
@@ -0,0 +1,919 @@
+# macOS Already Running Process
+
+## Description
+
+This event is generated for a process that was already running before Endpoint's process event collection was enabled.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "already_running"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.env_vars`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md
new file mode 100644
index 000000000..daa781cf5
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md
@@ -0,0 +1,1169 @@
+# macOS Process Fork, Exec, and Exit
+
+## Description
+
+This event is generated when a process calls `fork()`, `exec()`, or exits.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "fork" or "exec" or "end"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted_descendant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.env_vars`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.exit_code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td>Example</td><td><code>137</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md
new file mode 100644
index 000000000..25ab0fca4
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md
@@ -0,0 +1,1100 @@
+# macOS Remote Thread
+
+## Description
+
+This event is generated when a remote thread is created.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "remote_thread"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `group.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the group.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.env_vars`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.Ext.real.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md b/custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md
new file mode 100644
index 000000000..3e253ab32
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md
@@ -0,0 +1,1262 @@
+# Windows Already Running Process
+
+## Description
+
+This event is generated for a process that was already running before Endpoint's process collection was enabled.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "windows" and event.action : "already_running"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.mitigation_policies`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.relative_file_creation_time`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.authentication_package`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.client_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Client's IPv4 or IPv6 address as a string, if available.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.logon_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.relative_logon_time`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process creation time, relative to logon time, in seconds.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.relative_password_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process creation time, relative to the last time the password was changed, in seconds.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.user_flags`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation_level`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>What level of elevation the token has</td></tr>
+<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.security_attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td></tr>
+<tr><td>Example</td><td><code>TSA://ProcUnique, LUA://DecHdAutoAp</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.imphash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
+<tr><td>Example</td><td><code>0c6803c4e922103c4dca5963aad36ddf</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.original_file_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md b/custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md
new file mode 100644
index 000000000..3e3d7d918
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md
@@ -0,0 +1,1594 @@
+# Windows Process Create And Exit
+
+## Description
+
+This event is generated when a process is created or exits.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.process-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "windows" and event.action : "start" or "end"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.created_suspended`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.defense_evasions`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.device.bus_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.device.dos_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.device.file_system_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.device.nt_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.device.product_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ProductID of the device. It is provided by the vendor of the device if any.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.device.vendor_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>VendorID of the device. It is provided by the vendor of the device.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.device.volume_device_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.effective_parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.mitigation_policies`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.relative_file_creation_time`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.relative_file_name_modify_time`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.authentication_package`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.client_address`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Client's IPv4 or IPv6 address as a string, if available.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.logon_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.relative_logon_time`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process creation time, relative to logon time, in seconds.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.relative_password_age`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process creation time, relative to the last time the password was changed, in seconds.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.user_flags`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.elevation_level`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>What level of elevation the token has</td></tr>
+<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.integrity_level_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Human readable integrity level.</td></tr>
+<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.token.security_attributes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td></tr>
+<tr><td>Example</td><td><code>TSA://ProcUnique, LUA://DecHdAutoAp</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.trusted_descendant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.exit_code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
+<tr><td>Example</td><td><code>137</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.md5`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>MD5 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha1`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA1 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.hash.sha256`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>SHA256 hash.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.real.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.real.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For process.parent this will be the ppid of the process that actually spawned the current process.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.args_count`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
+<tr><td>Example</td><td><code>4</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.command_line`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.Ext.command_line_truncated`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.thread.Ext.call_stack.callsite_leading_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hex opcode bytes preceding the callsite</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.thread.Ext.call_stack.callsite_trailing_bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hex opcode bytes after the callsite (where control will return to)</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.thread.Ext.call_stack.protection`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Protection of the page containing this instruction.  This is `R-X' by default if omitted.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.thread.Ext.call_stack.symbol_info`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The nearest symbol for `instruction_pointer`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.thread.Ext.call_stack_contains_unbacked`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.parent.thread.Ext.call_stack_summary`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
+<tr><td>Example</td><td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.imphash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
+<tr><td>Example</td><td><code>0c6803c4e922103c4dca5963aad36ddf</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pe.original_file_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
+<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.working_directory`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The working directory of the process.</td></tr>
+<tr><td>Example</td><td><code>/home/alice</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md b/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md
new file mode 100644
index 000000000..cf88bdf4b
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md
@@ -0,0 +1,872 @@
+# Windows Registry Modification
+
+## Description
+
+This event is generated when the registry is modified.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.registry-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.registry" and event.module : "endpoint" and host.os.type : "windows" and event.action : "modification"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.data.bytes`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Original bytes written with base64 encoding.  For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.</td></tr>
+<tr><td>Example</td><td><code>ZQBuAC0AVQBTAAAAZQBuAAAAAAA=</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.data.strings`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Content when writing string types.  Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).</td></tr>
+<tr><td>Example</td><td><code>["C:\rta\red_ttp\bin\myapp.exe"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.data.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Standard registry type for encoding contents</td></tr>
+<tr><td>Example</td><td><code>REG_SZ</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.hive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Abbreviated name for the hive.</td></tr>
+<tr><td>Example</td><td><code>HKLM</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.key`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hive-relative path of keys.</td></tr>
+<tr><td>Example</td><td><code>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path, including hive, key and value</td></tr>
+<tr><td>Example</td><td><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.value`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the value written.</td></tr>
+<tr><td>Example</td><td><code>Debugger</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md b/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md
new file mode 100644
index 000000000..89901dcff
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md
@@ -0,0 +1,844 @@
+# Windows Registry Query
+
+## Description
+
+This event is generated when the Windows registry is queried.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.registry-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.registry" and event.module : "endpoint" and host.os.type : "windows" and event.action : "query"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name for the effective process.</td></tr>
+<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Effective_process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process ID.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.data.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Standard registry type for encoding contents</td></tr>
+<tr><td>Example</td><td><code>REG_SZ</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.hive`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Abbreviated name for the hive.</td></tr>
+<tr><td>Example</td><td><code>HKLM</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.key`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hive-relative path of keys.</td></tr>
+<tr><td>Example</td><td><code>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path, including hive, key and value</td></tr>
+<tr><td>Example</td><td><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `registry.value`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the value written.</td></tr>
+<tr><td>Example</td><td><code>Debugger</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md
new file mode 100644
index 000000000..03d823906
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md
@@ -0,0 +1,922 @@
+# macOS Gatekeeper Override Exception
+
+## Description
+
+This event is generated when a user grants a gatekeeper exception
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "gatekeeper_override"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `file.path`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
+<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.logon_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.email`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User email address.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.full_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User's full name, if available.</td></tr>
+<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.hash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md
new file mode 100644
index 000000000..9c9455a31
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md
@@ -0,0 +1,880 @@
+# macOS User Log On
+
+## Description
+
+This event is generated when a user logs on to the computer.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "log_on"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.logon_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.email`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User email address.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.full_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User's full name, if available.</td></tr>
+<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.hash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md
new file mode 100644
index 000000000..3cea04fdd
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md
@@ -0,0 +1,880 @@
+# macOS Screensharing Log On
+
+## Description
+
+This event is generated when a user logs on to the computer with screensharing.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "rdp_log_on"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.logon_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.email`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User email address.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.full_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User's full name, if available.</td></tr>
+<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.hash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md
new file mode 100644
index 000000000..b255aa33d
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md
@@ -0,0 +1,880 @@
+# macOS SSH Log On
+
+## Description
+
+This event is generated when a user logs on to the computer with SSH.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>macOS</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "ssh_log_on"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.logon_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.signing_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.team_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
+<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.email`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User email address.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.full_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User's full name, if available.</td></tr>
+<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.hash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md b/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md
new file mode 100644
index 000000000..897eca2b2
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md
@@ -0,0 +1,811 @@
+# Windows User Log Off
+
+## Description
+
+This event is generated when a user logs off of the computer.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "windows" and event.action : "log_off"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.logon_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.email`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User email address.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.full_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User's full name, if available.</td></tr>
+<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.hash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md b/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md
new file mode 100644
index 000000000..24059db7b
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md
@@ -0,0 +1,852 @@
+# Windows User Log On
+
+## Description
+
+This event is generated when a user logs on to the computer.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.security-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "windows" and event.action : "log_on"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `Target.process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.code`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
+<tr><td>Example</td><td><code>4648</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.authentication_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process authentication ID</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.session_info.logon_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.email`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User email address.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.full_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>User's full name, if available.</td></tr>
+<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.hash`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.effective.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `winlog.event_data.PrivilegeList`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of sensitive privileges, assigned to the new logon.</td></tr>
+<tr><td>Example</td><td><code>SeTcbPrivilege, SeSecurityPrivilege</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md b/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md
new file mode 100644
index 000000000..535781dbf
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md
@@ -0,0 +1,822 @@
+# Windows Device Mount
+
+## Description
+
+This event is generated when a device is mounted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.volume_device-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.volume_device" and event.module : "endpoint" and host.os.type : "windows" and event.action : "mount"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.exists`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.status`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
+<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.subject_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Subject name of the code signer</td></tr>
+<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.code_signature.trusted`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
+<tr><td>Example</td><td><code>true</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.executable`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
+<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.bus_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.device_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.dos_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.file_system_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.nt_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.product_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.serial_number`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.vendor_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md b/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md
new file mode 100644
index 000000000..26be5f672
--- /dev/null
+++ b/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md
@@ -0,0 +1,696 @@
+# Windows Device Unmount
+
+## Description
+
+This event is generated when a device is unmounted.
+
+
+## Overview
+
+<table>
+<tr>
+<td><strong>OS</strong></td>
+<td>Windows</td>
+</tr>
+<tr>
+<td><strong>Data Stream</strong></td>
+<td>logs-endpoint.events.volume_device-*</td>
+</tr>
+<tr>
+<td><strong>KQL Query</strong></td>
+<td><code>event.dataset : "endpoint.events.volume_device" and event.module : "endpoint" and host.os.type : "windows" and event.action : "unmount"</code></td>
+</tr>
+</table>
+
+## Fields
+
+#### `@timestamp`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
+<tr><td>Example</td><td><code>filebeat</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `agent.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Version of the agent.</td></tr>
+<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream dataset name.</td></tr>
+<tr><td>Example</td><td><code>nginx.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.namespace`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream namespace.</td></tr>
+<tr><td>Example</td><td><code>production</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `data_stream.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Data stream type.</td></tr>
+<tr><td>Example</td><td><code>logs</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `ecs.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
+<tr><td>Example</td><td><code>1.0.0</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `elastic.agent.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
+<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.action`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
+<tr><td>Example</td><td><code>user-password-change</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.category`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
+<tr><td>Example</td><td><code>authentication</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.created`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
+<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.dataset`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
+<tr><td>Example</td><td><code>apache.access</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
+<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.kind`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
+<tr><td>Example</td><td><code>alert</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.module`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
+<tr><td>Example</td><td><code>apache</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.outcome`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
+<tr><td>Example</td><td><code>success</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.sequence`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `event.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.architecture`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system architecture.</td></tr>
+<tr><td>Example</td><td><code>x86_64</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.hostname`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.ip`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host ip addresses.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.mac`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
+<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.Ext.variant`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
+<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.family`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
+<tr><td>Example</td><td><code>debian</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.full`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
+<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.kernel`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
+<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.platform`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
+<tr><td>Example</td><td><code>darwin</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
+<tr><td>Example</td><td><code>macos</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `host.os.version`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
+<tr><td>Example</td><td><code>10.14.1</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `message`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
+<tr><td>Example</td><td><code>Hello World</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.Ext.ancestry`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.entity_id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
+<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
+<tr><td>Example</td><td><code>ssh</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `process.pid`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Process id.</td></tr>
+<tr><td>Example</td><td><code>4242</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.domain`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.id`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
+<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `user.name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>Short name or login of the user.</td></tr>
+<tr><td>Example</td><td><code>a.einstein</code></td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.bus_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.device_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.dos_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.file_system_type`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.nt_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.product_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.serial_number`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
+#### `volume.vendor_name`
+
+<div style='margin-left: 20px;'>
+<table>
+<tr><td>Description</td><td>No Description Found</td></tr>
+</table>
+
+<br>
+
+</div>
+
+<hr>
+
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index 84d2affcc..c2cee1977 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -140,8 +140,8 @@ def get_kql_query_string(filter: Filter) -> str:
                 f.write("</table>\n\n")
 
                 f.write(f"## Fields\n\n")
-                f.write("<table>\n")
-                f.write("<tr><th>Name</th><th>Description</th><th>Example</th></tr>\n")
+                # f.write("<table>\n")
+                # f.write("<tr><th>Name</th><th>Description</th><th>Example</th></tr>\n")
                 for field in custom_doc.fields.endpoint:
                     description = "No Description Found"
                     example = ""
@@ -211,15 +211,23 @@ def get_kql_query_string(filter: Filter) -> str:
                             if package_field.example:
                                 example = package_field.example
 
-                    f.write("<tr>\n")
-                    f.write(f"<td><code>{field}</code></td>\n")
-                    f.write(f"<td>{description}</td>\n")
+                    f.write(f"#### `{field}`\n\n")
+                    f.write("<div style='margin-left: 20px;'>\n")
+                    f.write("<table>\n")
+                    f.write(f"<tr><td>Description</td><td>{description}</td></tr>\n")
                     if example:
-                        f.write(f"<td><code>{example}</code></td>\n")
-                    else:
-                        f.write("<td></td>\n")
-                    f.write("</tr>\n")
-
-                f.write("</table>\n")
+                        f.write(f"<tr><td>Example</td><td><code>{example}</code></td></tr>\n")
+                    f.write("</table>\n\n<br>\n\n")
+                    f.write("</div>\n\n")
+                #     f.write("<tr>\n")
+                #     f.write(f"<td><code>{field}</code></td>\n")
+                #     f.write(f"<td>{description}</td>\n")
+                #     if example:
+                #         f.write(f"<td><code>{example}</code></td>\n")
+                #     else:
+                #         f.write("<td></td>\n")
+                #     f.write("</tr>\n")
+
+                # f.write("</table>\n")
 
             logging.debug(f"wrote markdown to {output_filename}")

From 15b4ea0f66f9cc75fbb759e1b08c7300be31eb55 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Thu, 27 Mar 2025 17:28:19 +0000
Subject: [PATCH 16/25] updated variant

---
 .../linux/linux_malicious_behavior_alert.md   | 422 ++------
 .../alerts/linux/linux_malware_alert.md       | 866 ++++-----------
 .../alerts/linux/linux_memory_threat_alert.md | 762 ++++----------
 .../macos/macos_malicious_behavior_alert.md   | 370 ++-----
 .../alerts/macos/macos_malware_alert.md       | 538 +++-------
 .../alerts/macos/macos_memory_threat_alert.md | 458 +++-----
 .../windows_malicious_behavior_alert.md       | 406 ++------
 .../alerts/windows/windows_malware_alert.md   | 758 ++++----------
 .../windows/windows_memory_threat_alert.md    | 522 +++-------
 .../windows/windows_ransomware_alert.md       | 638 +++---------
 .../windows/windows_shellcode_thread.md       | 986 +++++-------------
 .../api/windows/windows_api_amsi.md           | 250 ++---
 .../api/windows/windows_api_asm.md            | 262 ++---
 .../windows/windows_api_credential_access.md  | 250 ++---
 .../api/windows/windows_api_kernel_audit.md   | 230 ++--
 .../api/windows/windows_api_tcpip.md          | 246 ++---
 .../windows_api_threat_intelligence.md        | 406 ++------
 .../api/windows/windows_api_win32k.md         | 334 ++----
 .../api/windows/windows_api_wmi.md            | 290 ++----
 .../file/linux/linux_file_create.md           | 230 ++--
 .../file/linux/linux_file_delete.md           | 226 ++--
 .../linux/linux_file_endpoint_unquarantine.md | 162 +--
 .../file/linux/linux_file_rename.md           | 242 ++---
 .../file/macos/macos_file_access.md           | 198 +---
 .../file/macos/macos_file_delete.md           | 258 ++---
 .../macos/macos_file_endpoint_unquarantine.md | 162 +--
 .../macos_file_extended_attributes_delete.md  | 258 ++---
 .../file/macos/macos_file_launch_daemon.md    | 250 ++---
 .../file/macos/macos_file_modification.md     | 266 ++---
 .../file/macos/macos_file_mount.md            | 246 ++---
 .../file/macos/macos_file_rename.md           | 270 ++---
 .../file/windows/windows_file_create.md       | 274 ++---
 .../file/windows/windows_file_delete.md       | 254 ++---
 .../windows_file_endpoint_unquarantine.md     | 162 +--
 .../file/windows/windows_file_modification.md | 258 ++---
 .../file/windows/windows_file_open.md         | 262 ++---
 .../file/windows/windows_file_overwrite.md    | 258 ++---
 .../file/windows/windows_file_rename.md       | 274 ++---
 .../library/macos/macos_library_load.md       | 270 ++---
 .../library/windows/windows_library_load.md   | 294 ++----
 .../doc/sample_variant_1/metadata/metadata.md | 178 +---
 .../doc/sample_variant_1/metrics/metrics.md   | 738 ++++---------
 ...twork_attempted_accepted_and_disconnect.md | 274 ++---
 .../linux/linux_network_dns_lookup_result.md  | 206 +---
 ...ork_connection_attempted_and_disconnect.md | 266 ++---
 .../macos/macos_network_dns_lookup_result.md  | 278 ++---
 ...twork_attempted_accepted_and_disconnect.md | 250 ++---
 .../windows_network_dns_lookup_requested.md   | 226 ++--
 .../windows_network_dns_lookup_result.md      | 230 ++--
 .../policy/policy_response.md                 | 342 ++----
 .../linux/linux_process_already_running.md    | 746 ++++---------
 .../linux/linux_process_fork_exec_exit.md     | 762 ++++----------
 .../process/linux/linux_process_gid_change.md | 754 ++++----------
 .../linux/linux_process_memfd_create.md       | 770 ++++----------
 .../process/linux/linux_process_ptrace.md     | 754 ++++----------
 .../linux/linux_process_session_id_change.md  | 738 ++++---------
 .../process/linux/linux_process_shmget.md     | 754 ++++----------
 .../linux/linux_process_text_output.md        | 762 ++++----------
 .../process/linux/linux_process_uid_change.md | 758 ++++----------
 .../macos/macos_process_already_running.md    | 262 ++---
 .../macos/macos_process_fork_exec_exit.md     | 334 ++----
 .../macos/macos_process_remote_thread.md      | 314 ++----
 .../windows_process_already_running.md        | 362 ++-----
 .../windows_process_create_and_exit.md        | 462 +++-----
 .../windows/windows_registry_modification.md  | 246 ++---
 .../windows/windows_registry_query.md         | 238 ++---
 .../macos_security_gatekeeper_override.md     | 262 ++---
 .../security/macos/macos_security_log_on.md   | 250 ++---
 .../macos/macos_security_rdp_log_on.md        | 250 ++---
 .../macos/macos_security_ssh_log_on.md        | 250 ++---
 .../windows/windows_security_log_off.md       | 230 ++--
 .../windows/windows_security_log_on.md        | 242 ++---
 .../windows/windows_volume_device_mount.md    | 234 ++---
 .../windows/windows_volume_device_unmount.md  | 198 +---
 74 files changed, 7108 insertions(+), 20880 deletions(-)

diff --git a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md
index 65f1cca57..f6cd63281 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md
@@ -24,7 +24,9 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -76,9 +72,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -89,9 +83,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -102,9 +94,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -115,9 +105,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -128,9 +116,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -141,9 +127,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -154,9 +138,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -167,9 +149,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -180,9 +160,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -193,9 +171,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -206,9 +182,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Events.*`
+### `Events.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -219,9 +193,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Events._label`
+### `Events._label`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +204,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Events._state`
+### `Events._state`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +215,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.@timestamp`
+### `Responses.@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +226,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.action`
+### `Responses.action.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +237,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.field`
+### `Responses.action.field`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -284,9 +248,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.state`
+### `Responses.action.state`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +259,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.tree`
+### `Responses.action.tree`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -310,9 +270,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.message`
+### `Responses.message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -323,9 +281,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.process.entity_id`
+### `Responses.process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -336,9 +292,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.process.name`
+### `Responses.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -349,9 +303,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.process.pid`
+### `Responses.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -362,9 +314,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.result`
+### `Responses.result`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -375,9 +325,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -389,9 +337,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -403,9 +349,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -417,9 +361,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -431,9 +373,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `cloud.account.id`
+### `cloud.account.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -445,9 +385,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -458,9 +396,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +408,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -486,9 +420,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -500,9 +432,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -513,9 +443,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -527,9 +455,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -540,9 +466,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -553,9 +477,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -566,9 +488,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -580,9 +500,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -594,9 +512,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -608,9 +524,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -622,9 +536,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -636,9 +548,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -650,9 +560,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -664,9 +572,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -678,9 +584,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,9 +596,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -706,9 +608,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -720,9 +620,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -734,9 +632,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -748,9 +644,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -762,9 +656,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -775,9 +667,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -788,9 +678,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -802,9 +690,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -815,9 +701,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.*`
+### `file.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -828,9 +712,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -841,9 +723,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -854,9 +734,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -867,9 +745,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -880,9 +756,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -894,9 +768,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -907,9 +779,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -920,9 +790,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -933,9 +801,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -947,9 +813,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -960,9 +824,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -974,9 +836,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -988,9 +848,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1002,9 +860,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1016,9 +872,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1030,9 +884,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1044,9 +896,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1058,9 +908,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1072,9 +920,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1086,9 +932,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1099,9 +943,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1112,9 +954,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1126,9 +966,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1139,9 +977,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1153,9 +989,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1167,9 +1001,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1181,9 +1013,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.*`
+### `process.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1194,9 +1024,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.description`
+### `rule.description`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1208,9 +1036,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.id`
+### `rule.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1222,9 +1048,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.name`
+### `rule.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1236,9 +1060,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.reference`
+### `rule.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1250,9 +1072,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1264,9 +1084,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.version`
+### `rule.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1278,9 +1096,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.framework`
+### `threat.framework`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1292,9 +1108,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.tactic.id`
+### `threat.tactic.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1306,9 +1120,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.tactic.name`
+### `threat.tactic.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1320,9 +1132,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.tactic.reference`
+### `threat.tactic.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1334,9 +1144,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.id`
+### `threat.technique.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1348,9 +1156,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.name`
+### `threat.technique.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1362,9 +1168,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.reference`
+### `threat.technique.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1376,9 +1180,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.subtechnique`
+### `threat.technique.subtechnique`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1389,9 +1191,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1402,9 +1202,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1415,9 +1213,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1429,9 +1225,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1443,5 +1237,3 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md
index 58b52952b..7d1905008 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md
@@ -24,7 +24,9 @@ This alert is generated when a Malware alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -76,9 +72,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -89,9 +83,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -102,9 +94,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -115,9 +105,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -128,9 +116,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -141,9 +127,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -154,9 +138,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -167,9 +149,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -180,9 +160,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -193,9 +171,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -206,9 +182,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -220,9 +194,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -234,9 +206,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -248,9 +218,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -262,9 +230,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -276,9 +242,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -290,9 +254,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -304,9 +266,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -318,9 +278,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -332,9 +290,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -346,9 +302,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -360,9 +314,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -374,9 +326,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -388,9 +338,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -402,9 +350,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -416,9 +362,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -430,9 +374,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -444,9 +386,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -458,9 +398,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -471,9 +409,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -484,9 +420,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -498,9 +432,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -511,9 +443,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.identifier`
+### `file.Ext.malware_classification.identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -524,9 +454,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.score`
+### `file.Ext.malware_classification.score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -537,9 +465,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.threshold`
+### `file.Ext.malware_classification.threshold`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -550,9 +476,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.version`
+### `file.Ext.malware_classification.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -563,9 +487,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.all_names`
+### `file.Ext.malware_signature.all_names`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -576,9 +498,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.identifier`
+### `file.Ext.malware_signature.identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -589,9 +509,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.matches`
+### `file.Ext.malware_signature.primary.matches`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -602,9 +520,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.signature.hash.sha256`
+### `file.Ext.malware_signature.primary.signature.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -615,9 +531,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.signature.id`
+### `file.Ext.malware_signature.primary.signature.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +542,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.signature.name`
+### `file.Ext.malware_signature.primary.signature.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +553,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.matches`
+### `file.Ext.malware_signature.secondary.matches`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -654,9 +564,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.signature.hash.sha256`
+### `file.Ext.malware_signature.secondary.signature.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -667,9 +575,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.signature.id`
+### `file.Ext.malware_signature.secondary.signature.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -680,9 +586,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.signature.name`
+### `file.Ext.malware_signature.secondary.signature.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -693,9 +597,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.version`
+### `file.Ext.malware_signature.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -706,9 +608,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.quarantine_message`
+### `file.Ext.quarantine_message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -719,9 +619,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.quarantine_path`
+### `file.Ext.quarantine_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -732,9 +630,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.quarantine_result`
+### `file.Ext.quarantine_result`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -745,9 +641,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.temp_file_path`
+### `file.Ext.temp_file_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -758,9 +652,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.accessed`
+### `file.accessed`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -771,9 +663,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.created`
+### `file.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -784,9 +674,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.directory`
+### `file.directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -798,9 +686,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -812,9 +698,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.hash.md5`
+### `file.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -825,9 +709,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha1`
+### `file.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -838,9 +720,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -851,9 +731,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.inode`
+### `file.inode`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -865,9 +743,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.mtime`
+### `file.mtime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -878,9 +754,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -892,9 +766,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.owner`
+### `file.owner`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -906,9 +778,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -920,9 +790,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -934,9 +802,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -948,9 +814,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -961,9 +825,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -974,9 +836,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -987,9 +847,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1001,9 +859,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1014,9 +870,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1028,9 +882,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1042,9 +894,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1056,9 +906,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1070,9 +918,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1084,9 +930,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1098,9 +942,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1112,9 +954,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1126,9 +966,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1140,9 +978,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1153,9 +989,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.user`
+### `process.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1166,9 +1000,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1180,9 +1012,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1194,9 +1024,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1208,9 +1036,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1222,9 +1048,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1236,9 +1060,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1250,9 +1072,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1264,9 +1084,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1277,9 +1095,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1290,9 +1106,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1304,9 +1118,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1317,9 +1129,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1330,9 +1140,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1344,9 +1152,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1358,9 +1164,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1372,9 +1176,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1386,9 +1188,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1400,9 +1200,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1414,9 +1212,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1427,9 +1223,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1440,9 +1234,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1454,9 +1246,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1468,9 +1258,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1482,9 +1270,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1496,9 +1282,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1509,9 +1293,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1522,9 +1304,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1536,9 +1316,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1550,9 +1328,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1564,9 +1340,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1578,9 +1352,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1592,9 +1364,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1606,9 +1376,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1619,9 +1387,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1632,9 +1398,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1646,9 +1410,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1660,9 +1422,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1674,9 +1434,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1688,9 +1446,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1701,9 +1457,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1714,9 +1468,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1728,9 +1480,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1742,9 +1492,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1756,9 +1504,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1769,9 +1515,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1782,9 +1526,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1796,9 +1538,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1810,9 +1550,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1824,9 +1562,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1838,9 +1574,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1851,9 +1585,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1864,9 +1596,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1878,9 +1608,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1892,9 +1620,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1906,9 +1632,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1920,9 +1644,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1934,9 +1656,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1947,9 +1667,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1960,9 +1678,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1973,9 +1689,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1987,9 +1701,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2001,9 +1713,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.user`
+### `process.parent.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2014,9 +1724,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2028,9 +1736,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2042,9 +1748,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2056,9 +1760,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2070,9 +1772,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2084,9 +1784,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2097,9 +1795,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2110,9 +1806,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.md5`
+### `process.parent.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2123,9 +1817,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha1`
+### `process.parent.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2136,9 +1828,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha256`
+### `process.parent.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2149,9 +1839,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2163,9 +1851,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2177,9 +1863,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pgid`
+### `process.parent.pgid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2190,9 +1874,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2204,9 +1886,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.ppid`
+### `process.parent.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2218,9 +1898,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2231,9 +1909,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2244,9 +1920,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2258,9 +1932,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2272,9 +1944,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2286,9 +1956,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2299,9 +1967,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2312,9 +1978,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2326,9 +1990,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2340,9 +2002,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.uptime`
+### `process.parent.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2354,9 +2014,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2368,9 +2026,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2382,9 +2038,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2396,9 +2050,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pgid`
+### `process.pgid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2409,9 +2061,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2423,9 +2073,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2436,9 +2084,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2449,9 +2095,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2463,9 +2107,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2477,9 +2119,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2491,9 +2131,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2505,9 +2143,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2519,9 +2155,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2533,9 +2167,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2546,9 +2178,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2559,9 +2189,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2573,9 +2201,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2587,9 +2213,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2601,9 +2225,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2614,9 +2236,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2627,9 +2247,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2641,9 +2259,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2655,9 +2271,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2669,9 +2283,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2683,9 +2295,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2696,9 +2306,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2709,9 +2317,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2723,9 +2329,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2737,9 +2341,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2751,9 +2353,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2765,9 +2365,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2779,9 +2377,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2793,9 +2389,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2806,9 +2400,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2819,9 +2411,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.major`
+### `process.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2833,9 +2423,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.minor`
+### `process.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2847,9 +2435,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2861,9 +2447,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2875,9 +2459,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2889,9 +2471,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2903,9 +2483,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.id`
+### `rule.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2917,9 +2495,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.name`
+### `rule.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2931,9 +2507,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2945,9 +2519,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2959,5 +2531,3 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md
index 8c05e26de..205d12e29 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md
@@ -24,7 +24,9 @@ This alert is generated when a Memory Threat alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -76,9 +72,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -89,9 +83,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -102,9 +94,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -115,9 +105,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -128,9 +116,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -141,9 +127,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -154,9 +138,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -167,9 +149,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -180,9 +160,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -193,9 +171,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -206,9 +182,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -220,9 +194,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -234,9 +206,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -248,9 +218,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -262,9 +230,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -276,9 +242,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -290,9 +254,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -304,9 +266,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -318,9 +278,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -332,9 +290,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -346,9 +302,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -360,9 +314,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -374,9 +326,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -388,9 +338,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -402,9 +350,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -416,9 +362,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -430,9 +374,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -444,9 +386,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -457,9 +397,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -470,9 +408,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -484,9 +420,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -497,9 +431,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -511,9 +443,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -524,9 +454,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -537,9 +465,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -550,9 +476,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -564,9 +488,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -577,9 +499,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -591,9 +511,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -605,9 +523,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -619,9 +535,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -633,9 +547,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -647,9 +559,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -661,9 +571,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -675,9 +583,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -689,9 +595,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -703,9 +607,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -716,9 +618,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_base`
+### `process.Ext.memory_region.allocation_base`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -730,9 +630,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_size`
+### `process.Ext.memory_region.allocation_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -744,9 +642,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_type`
+### `process.Ext.memory_region.allocation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -758,9 +654,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_address`
+### `process.Ext.memory_region.bytes_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -772,9 +666,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_allocation_offset`
+### `process.Ext.memory_region.bytes_allocation_offset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -786,9 +678,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_compressed`
+### `process.Ext.memory_region.bytes_compressed`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -800,9 +690,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_compressed_present`
+### `process.Ext.memory_region.bytes_compressed_present`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -814,9 +702,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.all_names`
+### `process.Ext.memory_region.malware_signature.all_names`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -828,9 +714,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.identifier`
+### `process.Ext.memory_region.malware_signature.identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -841,9 +725,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.matches`
+### `process.Ext.memory_region.malware_signature.primary.matches`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -854,9 +736,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
+### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -867,9 +747,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.signature.id`
+### `process.Ext.memory_region.malware_signature.primary.signature.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -880,9 +758,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.signature.name`
+### `process.Ext.memory_region.malware_signature.primary.signature.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -893,9 +769,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.version`
+### `process.Ext.memory_region.malware_signature.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -906,9 +780,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_base`
+### `process.Ext.memory_region.region_base`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -920,9 +792,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_protection`
+### `process.Ext.memory_region.region_protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -934,9 +804,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_size`
+### `process.Ext.memory_region.region_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -948,9 +816,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.user`
+### `process.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -961,9 +827,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -975,9 +839,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -989,9 +851,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1003,9 +863,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1017,9 +875,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1031,9 +887,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1045,9 +899,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1059,9 +911,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1072,9 +922,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1085,9 +933,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1099,9 +945,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1112,9 +956,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1125,9 +967,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1139,9 +979,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1153,9 +991,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1167,9 +1003,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1181,9 +1015,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1195,9 +1027,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1209,9 +1039,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1222,9 +1050,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1235,9 +1061,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1249,9 +1073,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1263,9 +1085,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1277,9 +1097,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1291,9 +1109,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1304,9 +1120,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1317,9 +1131,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1331,9 +1143,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1345,9 +1155,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1359,9 +1167,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1373,9 +1179,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1387,9 +1191,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1401,9 +1203,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1414,9 +1214,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1427,9 +1225,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1441,9 +1237,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1455,9 +1249,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1469,9 +1261,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1483,9 +1273,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1496,9 +1284,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1509,9 +1295,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1523,9 +1307,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1537,9 +1319,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1551,9 +1331,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1564,9 +1342,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1577,9 +1353,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1591,9 +1365,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1605,9 +1377,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1619,9 +1389,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1633,9 +1401,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1646,9 +1412,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1659,9 +1423,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1673,9 +1435,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1687,9 +1447,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1701,9 +1459,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1715,9 +1471,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1729,9 +1483,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1742,9 +1494,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1755,9 +1505,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1768,9 +1516,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1782,9 +1528,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1796,9 +1540,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.user`
+### `process.parent.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1809,9 +1551,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1823,9 +1563,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1837,9 +1575,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1851,9 +1587,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1865,9 +1599,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1879,9 +1611,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.md5`
+### `process.parent.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1892,9 +1622,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha1`
+### `process.parent.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1905,9 +1633,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha256`
+### `process.parent.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1918,9 +1644,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1932,9 +1656,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pgid`
+### `process.parent.pgid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1945,9 +1667,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1959,9 +1679,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.ppid`
+### `process.parent.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1973,9 +1691,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1987,9 +1703,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.uptime`
+### `process.parent.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2001,9 +1715,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pgid`
+### `process.pgid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2014,9 +1726,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2028,9 +1738,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.ppid`
+### `process.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2042,9 +1750,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2056,9 +1762,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2070,9 +1774,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2084,9 +1786,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2097,9 +1797,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2110,9 +1808,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2124,9 +1820,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2138,9 +1832,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2152,9 +1844,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2166,9 +1856,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2180,9 +1868,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2194,9 +1880,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2207,9 +1891,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2220,9 +1902,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2234,9 +1914,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2248,9 +1926,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2262,9 +1938,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2275,9 +1949,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2288,9 +1960,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2302,9 +1972,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2316,9 +1984,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2330,9 +1996,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2344,9 +2008,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2357,9 +2019,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2370,9 +2030,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2384,9 +2042,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2398,9 +2054,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2412,9 +2066,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2426,9 +2078,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2440,9 +2090,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2454,9 +2102,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2467,9 +2113,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2480,9 +2124,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.major`
+### `process.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2494,9 +2136,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.minor`
+### `process.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2508,9 +2148,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2522,9 +2160,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2536,9 +2172,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2550,9 +2184,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2564,9 +2196,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.id`
+### `rule.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2578,9 +2208,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.name`
+### `rule.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2592,9 +2220,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2606,9 +2232,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2620,5 +2244,3 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md
index f62a8f70a..cbee3ae68 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md
@@ -24,7 +24,9 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -131,9 +119,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -144,9 +130,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -157,9 +141,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -170,9 +152,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -183,9 +163,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -196,9 +174,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -209,9 +185,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -222,9 +196,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -235,9 +207,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -248,9 +218,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -261,9 +229,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Events.*`
+### `Events.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +240,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Events._label`
+### `Events._label`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -287,9 +251,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Events._state`
+### `Events._state`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +262,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.@timestamp`
+### `Responses.@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +273,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.action`
+### `Responses.action.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +284,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.field`
+### `Responses.action.field`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +295,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.state`
+### `Responses.action.state`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +306,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.tree`
+### `Responses.action.tree`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -365,9 +317,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.message`
+### `Responses.message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -378,9 +328,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.process.entity_id`
+### `Responses.process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -391,9 +339,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.process.name`
+### `Responses.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -404,9 +350,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.process.pid`
+### `Responses.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -417,9 +361,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.result`
+### `Responses.result`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -430,9 +372,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -444,9 +384,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -458,9 +396,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +408,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -486,9 +420,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -500,9 +432,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -514,9 +444,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -528,9 +456,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -542,9 +468,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -556,9 +480,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -570,9 +492,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -584,9 +504,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -598,9 +516,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -612,9 +528,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -626,9 +540,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -640,9 +552,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -654,9 +564,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -668,9 +576,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -682,9 +588,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -695,9 +599,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -708,9 +610,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -722,9 +622,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -735,9 +633,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.*`
+### `file.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -748,9 +644,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -761,9 +655,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -774,9 +666,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -787,9 +677,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -800,9 +688,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -814,9 +700,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -827,9 +711,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -840,9 +722,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -853,9 +733,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -867,9 +745,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -880,9 +756,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -894,9 +768,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -908,9 +780,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -922,9 +792,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -936,9 +804,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -950,9 +816,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -964,9 +828,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -978,9 +840,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -992,9 +852,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1006,9 +864,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.*`
+### `process.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1019,9 +875,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.description`
+### `rule.description`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1033,9 +887,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.id`
+### `rule.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1047,9 +899,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.name`
+### `rule.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1061,9 +911,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.reference`
+### `rule.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1075,9 +923,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1089,9 +935,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.version`
+### `rule.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1103,9 +947,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.framework`
+### `threat.framework`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1117,9 +959,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.tactic.id`
+### `threat.tactic.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1131,9 +971,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.tactic.name`
+### `threat.tactic.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1145,9 +983,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.tactic.reference`
+### `threat.tactic.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1159,9 +995,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.id`
+### `threat.technique.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1173,9 +1007,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.name`
+### `threat.technique.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1187,9 +1019,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.reference`
+### `threat.technique.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1201,9 +1031,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.subtechnique`
+### `threat.technique.subtechnique`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1214,9 +1042,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1227,9 +1053,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1240,9 +1064,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1254,9 +1076,7 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1268,5 +1088,3 @@ This alert is generated when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md
index 0bc18a86e..001a4aea5 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md
@@ -24,7 +24,9 @@ This alert is generated when a macOS Malware alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -114,9 +104,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -127,9 +115,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -140,9 +126,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -153,9 +137,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -166,9 +148,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -179,9 +159,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -192,9 +170,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -205,9 +181,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -219,9 +193,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -233,9 +205,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -247,9 +217,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -261,9 +229,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -275,9 +241,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -289,9 +253,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -303,9 +265,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -317,9 +277,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -331,9 +289,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -345,9 +301,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -359,9 +313,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -373,9 +325,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -387,9 +337,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -401,9 +349,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -415,9 +361,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -429,9 +373,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -443,9 +385,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -457,9 +397,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -470,9 +408,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -483,9 +419,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -497,9 +431,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -510,9 +442,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.identifier`
+### `file.Ext.malware_classification.identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -523,9 +453,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.score`
+### `file.Ext.malware_classification.score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -536,9 +464,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.threshold`
+### `file.Ext.malware_classification.threshold`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -549,9 +475,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.version`
+### `file.Ext.malware_classification.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -562,9 +486,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.all_names`
+### `file.Ext.malware_signature.all_names`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -575,9 +497,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.identifier`
+### `file.Ext.malware_signature.identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -588,9 +508,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.matches`
+### `file.Ext.malware_signature.primary.matches`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +519,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.signature.hash.sha256`
+### `file.Ext.malware_signature.primary.signature.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +530,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.signature.id`
+### `file.Ext.malware_signature.primary.signature.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +541,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.signature.name`
+### `file.Ext.malware_signature.primary.signature.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -640,9 +552,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.matches`
+### `file.Ext.malware_signature.secondary.matches`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -653,9 +563,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.signature.hash.sha256`
+### `file.Ext.malware_signature.secondary.signature.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -666,9 +574,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.signature.id`
+### `file.Ext.malware_signature.secondary.signature.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +585,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.signature.name`
+### `file.Ext.malware_signature.secondary.signature.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,9 +596,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.version`
+### `file.Ext.malware_signature.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -705,9 +607,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.quarantine_message`
+### `file.Ext.quarantine_message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -718,9 +618,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.quarantine_path`
+### `file.Ext.quarantine_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -731,9 +629,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.quarantine_result`
+### `file.Ext.quarantine_result`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -744,9 +640,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.temp_file_path`
+### `file.Ext.temp_file_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -757,9 +651,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.accessed`
+### `file.accessed`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -770,9 +662,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.exists`
+### `file.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -784,9 +674,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.signing_id`
+### `file.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -798,9 +686,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.status`
+### `file.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -812,9 +698,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.subject_name`
+### `file.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -826,9 +710,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.team_id`
+### `file.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -840,9 +722,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.trusted`
+### `file.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -854,9 +734,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.created`
+### `file.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -867,9 +745,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.directory`
+### `file.directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -881,9 +757,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -895,9 +769,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.hash.md5`
+### `file.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -908,9 +780,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha1`
+### `file.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -921,9 +791,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -934,9 +802,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.mtime`
+### `file.mtime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -947,9 +813,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -961,9 +825,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.owner`
+### `file.owner`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -975,9 +837,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -989,9 +849,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1003,9 +861,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1017,9 +873,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1030,9 +884,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1043,9 +895,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1056,9 +906,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1070,9 +918,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1083,9 +929,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1097,9 +941,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1111,9 +953,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1125,9 +965,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1139,9 +977,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1153,9 +989,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1167,9 +1001,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1181,9 +1013,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1195,9 +1025,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1209,9 +1037,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1222,9 +1048,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.user`
+### `process.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1235,9 +1059,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1249,9 +1071,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1263,9 +1083,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1277,9 +1095,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1291,9 +1107,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1305,9 +1119,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1319,9 +1131,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1333,9 +1143,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1347,9 +1155,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1361,9 +1167,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1375,9 +1179,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1389,9 +1191,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1402,9 +1202,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1415,9 +1213,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1428,9 +1224,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1442,9 +1236,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.user`
+### `process.parent.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1455,9 +1247,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1469,9 +1259,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1483,9 +1271,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1497,9 +1283,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.signing_id`
+### `process.parent.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1511,9 +1295,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1525,9 +1307,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1539,9 +1319,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.team_id`
+### `process.parent.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1553,9 +1331,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1567,9 +1343,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1581,9 +1355,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1595,9 +1367,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1609,9 +1379,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.md5`
+### `process.parent.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1622,9 +1390,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha1`
+### `process.parent.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1635,9 +1401,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha256`
+### `process.parent.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1648,9 +1412,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1662,9 +1424,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pgid`
+### `process.parent.pgid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1675,9 +1435,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1689,9 +1447,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.ppid`
+### `process.parent.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1703,9 +1459,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1717,9 +1471,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.uptime`
+### `process.parent.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1731,9 +1483,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pgid`
+### `process.pgid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1744,9 +1494,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1758,9 +1506,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1772,9 +1518,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1786,9 +1530,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.id`
+### `rule.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1800,9 +1542,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.name`
+### `rule.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1814,9 +1554,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1828,9 +1566,7 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1842,5 +1578,3 @@ This alert is generated when a macOS Malware alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md
index 2c67fa3d7..bd158de35 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md
@@ -24,7 +24,9 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -114,9 +104,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -127,9 +115,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -140,9 +126,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -153,9 +137,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -166,9 +148,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -179,9 +159,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -192,9 +170,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -205,9 +181,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -219,9 +193,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -233,9 +205,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -247,9 +217,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -261,9 +229,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -275,9 +241,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -289,9 +253,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -303,9 +265,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -317,9 +277,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -331,9 +289,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -345,9 +301,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -359,9 +313,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -373,9 +325,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -387,9 +337,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -401,9 +349,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -415,9 +361,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -429,9 +373,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -443,9 +385,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -456,9 +396,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -469,9 +407,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -483,9 +419,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -496,9 +430,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -510,9 +442,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -523,9 +453,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -536,9 +464,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -549,9 +475,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -563,9 +487,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -576,9 +498,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -590,9 +510,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -604,9 +522,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -618,9 +534,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -632,9 +546,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -646,9 +558,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -660,9 +570,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -674,9 +582,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -688,9 +594,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -702,9 +606,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -715,9 +617,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_base`
+### `process.Ext.memory_region.allocation_base`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -729,9 +629,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_size`
+### `process.Ext.memory_region.allocation_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -743,9 +641,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_type`
+### `process.Ext.memory_region.allocation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -757,9 +653,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_address`
+### `process.Ext.memory_region.bytes_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -771,9 +665,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_allocation_offset`
+### `process.Ext.memory_region.bytes_allocation_offset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -785,9 +677,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_compressed`
+### `process.Ext.memory_region.bytes_compressed`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -799,9 +689,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_compressed_present`
+### `process.Ext.memory_region.bytes_compressed_present`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -813,9 +701,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.all_names`
+### `process.Ext.memory_region.malware_signature.all_names`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -827,9 +713,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.identifier`
+### `process.Ext.memory_region.malware_signature.identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -840,9 +724,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.matches`
+### `process.Ext.memory_region.malware_signature.primary.matches`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -853,9 +735,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
+### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -866,9 +746,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.signature.id`
+### `process.Ext.memory_region.malware_signature.primary.signature.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -879,9 +757,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.signature.name`
+### `process.Ext.memory_region.malware_signature.primary.signature.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -892,9 +768,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.version`
+### `process.Ext.memory_region.malware_signature.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -905,9 +779,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_base`
+### `process.Ext.memory_region.region_base`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -919,9 +791,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_protection`
+### `process.Ext.memory_region.region_protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -933,9 +803,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_size`
+### `process.Ext.memory_region.region_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -947,9 +815,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.user`
+### `process.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -960,9 +826,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -974,9 +838,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -988,9 +850,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1002,9 +862,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1016,9 +874,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1030,9 +886,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1044,9 +898,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1058,9 +910,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1072,9 +922,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1086,9 +934,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1100,9 +946,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1114,9 +958,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1127,9 +969,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1140,9 +980,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1153,9 +991,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1167,9 +1003,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.user`
+### `process.parent.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1180,9 +1014,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1194,9 +1026,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1208,9 +1038,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1222,9 +1050,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.signing_id`
+### `process.parent.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1236,9 +1062,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1250,9 +1074,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1264,9 +1086,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.team_id`
+### `process.parent.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1278,9 +1098,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1292,9 +1110,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1306,9 +1122,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1320,9 +1134,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1334,9 +1146,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.md5`
+### `process.parent.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1347,9 +1157,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha1`
+### `process.parent.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1360,9 +1168,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha256`
+### `process.parent.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1373,9 +1179,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1387,9 +1191,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pgid`
+### `process.parent.pgid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1400,9 +1202,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1414,9 +1214,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.ppid`
+### `process.parent.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1428,9 +1226,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1442,9 +1238,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.uptime`
+### `process.parent.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1456,9 +1250,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pgid`
+### `process.pgid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1469,9 +1261,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1483,9 +1273,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.ppid`
+### `process.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1497,9 +1285,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1511,9 +1297,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1525,9 +1309,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.id`
+### `rule.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1539,9 +1321,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.name`
+### `rule.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1553,9 +1333,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1567,9 +1345,7 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1581,5 +1357,3 @@ This alert is generated when a macOS Memory Thread alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md
index f9a106bc0..bdd70ae43 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md
@@ -24,7 +24,9 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -114,9 +104,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -127,9 +115,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -140,9 +126,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -153,9 +137,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -166,9 +148,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -179,9 +159,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -192,9 +170,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -205,9 +181,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Events.*`
+### `Events.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +192,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Events._label`
+### `Events._label`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +203,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Events._state`
+### `Events._state`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -244,9 +214,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.@timestamp`
+### `Responses.@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -257,9 +225,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.action`
+### `Responses.action.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -270,9 +236,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.field`
+### `Responses.action.field`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +247,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.attributes`
+### `Responses.action.file.attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -296,9 +258,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.path`
+### `Responses.action.file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -309,9 +269,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.reason`
+### `Responses.action.file.reason`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -322,9 +280,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.actions`
+### `Responses.action.key.actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -335,9 +291,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.path`
+### `Responses.action.key.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -348,9 +302,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.values.actions`
+### `Responses.action.key.values.actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -361,9 +313,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.values.name`
+### `Responses.action.key.values.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -374,9 +324,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.source.attributes`
+### `Responses.action.source.attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -387,9 +335,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.source.path`
+### `Responses.action.source.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -400,9 +346,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.state`
+### `Responses.action.state`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -413,9 +357,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.tree`
+### `Responses.action.tree`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -426,9 +368,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.message`
+### `Responses.message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -439,9 +379,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.process.entity_id`
+### `Responses.process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -452,9 +390,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.process.name`
+### `Responses.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -465,9 +401,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.process.pid`
+### `Responses.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +412,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.result`
+### `Responses.result`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +423,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.*`
+### `Target.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +434,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +446,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +458,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -546,9 +470,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -560,9 +482,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +494,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -588,9 +506,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -602,9 +518,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `destination.ip`
+### `destination.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -615,9 +529,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `destination.port`
+### `destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +540,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `dll.*`
+### `dll.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +551,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -655,9 +563,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +575,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +587,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +599,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +611,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +623,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +635,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +647,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +659,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -781,9 +671,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -795,9 +683,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -808,9 +694,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -821,9 +705,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -835,9 +717,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +728,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.*`
+### `file.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -861,9 +739,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -875,9 +751,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -888,9 +762,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -901,9 +773,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -914,9 +784,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -928,9 +796,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -941,9 +807,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -955,9 +819,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -969,9 +831,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -983,9 +843,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -997,9 +855,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1011,9 +867,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1025,9 +879,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1039,9 +891,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1053,9 +903,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1067,9 +915,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `network.transport`
+### `network.transport`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1081,9 +927,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `network.type`
+### `network.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1095,9 +939,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.*`
+### `process.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1108,9 +950,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `registry.*`
+### `registry.*`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1121,9 +961,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.description`
+### `rule.description`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1135,9 +973,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.id`
+### `rule.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1149,9 +985,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.name`
+### `rule.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1163,9 +997,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.reference`
+### `rule.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1177,9 +1009,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1191,9 +1021,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.version`
+### `rule.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1205,9 +1033,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.framework`
+### `threat.framework`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1219,9 +1045,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.tactic.id`
+### `threat.tactic.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1233,9 +1057,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.tactic.name`
+### `threat.tactic.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1247,9 +1069,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.tactic.reference`
+### `threat.tactic.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1261,9 +1081,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.id`
+### `threat.technique.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1275,9 +1093,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.name`
+### `threat.technique.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1289,9 +1105,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.reference`
+### `threat.technique.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1303,9 +1117,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.subtechnique.id`
+### `threat.technique.subtechnique.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1317,9 +1129,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.subtechnique.name`
+### `threat.technique.subtechnique.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1331,9 +1141,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `threat.technique.subtechnique.reference`
+### `threat.technique.subtechnique.reference`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1345,9 +1153,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1358,9 +1164,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1372,9 +1176,7 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1386,5 +1188,3 @@ This alert occurs when a Malicious Behavior alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md
index acbd53eae..15f9b5118 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md
@@ -24,7 +24,9 @@ This alert is generated when a Malware alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -114,9 +104,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -127,9 +115,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -140,9 +126,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -153,9 +137,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -166,9 +148,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -179,9 +159,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -192,9 +170,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -205,9 +181,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.@timestamp`
+### `Responses.@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +192,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.action`
+### `Responses.action.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +203,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.attributes`
+### `Responses.action.file.attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -244,9 +214,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.path`
+### `Responses.action.file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -257,9 +225,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.reason`
+### `Responses.action.file.reason`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -270,9 +236,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.actions`
+### `Responses.action.key.actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +247,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.path`
+### `Responses.action.key.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -296,9 +258,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.values.actions`
+### `Responses.action.key.values.actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -309,9 +269,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.values.name`
+### `Responses.action.key.values.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -322,9 +280,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.process.path`
+### `Responses.action.process.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -335,9 +291,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.source.attributes`
+### `Responses.action.source.attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -348,9 +302,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.source.path`
+### `Responses.action.source.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -361,9 +313,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.message`
+### `Responses.message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -374,9 +324,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.result`
+### `Responses.result`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -387,9 +335,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -401,9 +347,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -415,9 +359,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -429,9 +371,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -443,9 +383,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -457,9 +395,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -471,9 +407,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -485,9 +419,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +431,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -513,9 +443,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -527,9 +455,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -541,9 +467,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -555,9 +479,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -569,9 +491,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -583,9 +503,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -597,9 +515,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -611,9 +527,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -625,9 +539,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -639,9 +551,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -652,9 +562,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +573,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +585,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,9 +596,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.code_signature.exists`
+### `file.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -706,9 +608,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.code_signature.status`
+### `file.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -720,9 +620,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.code_signature.subject_name`
+### `file.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -734,9 +632,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.code_signature.trusted`
+### `file.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -748,9 +644,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.device.bus_type`
+### `file.Ext.device.bus_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -761,9 +655,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.device.dos_name`
+### `file.Ext.device.dos_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -774,9 +666,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.device.file_system_type`
+### `file.Ext.device.file_system_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -787,9 +677,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.device.nt_name`
+### `file.Ext.device.nt_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -800,9 +688,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.device.product_id`
+### `file.Ext.device.product_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -813,9 +699,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.device.vendor_id`
+### `file.Ext.device.vendor_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -826,9 +710,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.device.volume_device_type`
+### `file.Ext.device.volume_device_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -839,9 +721,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.identifier`
+### `file.Ext.malware_classification.identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -852,9 +732,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.score`
+### `file.Ext.malware_classification.score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -865,9 +743,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.threshold`
+### `file.Ext.malware_classification.threshold`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -878,9 +754,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_classification.version`
+### `file.Ext.malware_classification.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -891,9 +765,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.all_names`
+### `file.Ext.malware_signature.all_names`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -904,9 +776,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.identifier`
+### `file.Ext.malware_signature.identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -917,9 +787,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.matches`
+### `file.Ext.malware_signature.primary.matches`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -930,9 +798,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.signature.hash.sha256`
+### `file.Ext.malware_signature.primary.signature.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -943,9 +809,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.signature.id`
+### `file.Ext.malware_signature.primary.signature.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -956,9 +820,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.primary.signature.name`
+### `file.Ext.malware_signature.primary.signature.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -969,9 +831,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.matches`
+### `file.Ext.malware_signature.secondary.matches`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -982,9 +842,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.signature.hash.sha256`
+### `file.Ext.malware_signature.secondary.signature.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -995,9 +853,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.signature.id`
+### `file.Ext.malware_signature.secondary.signature.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1008,9 +864,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.secondary.signature.name`
+### `file.Ext.malware_signature.secondary.signature.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1021,9 +875,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.malware_signature.version`
+### `file.Ext.malware_signature.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1034,9 +886,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.quarantine_message`
+### `file.Ext.quarantine_message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1047,9 +897,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.quarantine_path`
+### `file.Ext.quarantine_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1060,9 +908,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.quarantine_result`
+### `file.Ext.quarantine_result`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1073,9 +919,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.Ext.temp_file_path`
+### `file.Ext.temp_file_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1086,9 +930,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.accessed`
+### `file.accessed`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1099,9 +941,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.exists`
+### `file.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1113,9 +953,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.status`
+### `file.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1127,9 +965,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.subject_name`
+### `file.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1141,9 +977,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.code_signature.trusted`
+### `file.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1155,9 +989,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.created`
+### `file.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1168,9 +1000,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.directory`
+### `file.directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1182,9 +1012,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.drive_letter`
+### `file.drive_letter`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1196,9 +1024,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1210,9 +1036,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.hash.md5`
+### `file.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1223,9 +1047,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha1`
+### `file.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1236,9 +1058,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1249,9 +1069,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.mtime`
+### `file.mtime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1262,9 +1080,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1276,9 +1092,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.owner`
+### `file.owner`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1290,9 +1104,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1304,9 +1116,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.Ext.dotnet`
+### `file.pe.Ext.dotnet`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1318,9 +1128,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.Ext.sections.hash.md5`
+### `file.pe.Ext.sections.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1331,9 +1139,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.Ext.sections.hash.sha256`
+### `file.pe.Ext.sections.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1344,9 +1150,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.Ext.sections.name`
+### `file.pe.Ext.sections.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1358,9 +1162,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.Ext.streams.hash.md5`
+### `file.pe.Ext.streams.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1371,9 +1173,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.Ext.streams.hash.sha256`
+### `file.pe.Ext.streams.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1384,9 +1184,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.Ext.streams.name`
+### `file.pe.Ext.streams.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1398,9 +1196,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.company`
+### `file.pe.company`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1412,9 +1208,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.description`
+### `file.pe.description`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1426,9 +1220,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.file_version`
+### `file.pe.file_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1440,9 +1232,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.original_file_name`
+### `file.pe.original_file_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1454,9 +1244,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.pe.product`
+### `file.pe.product`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1468,9 +1256,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1482,9 +1268,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1496,9 +1280,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1509,9 +1291,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1522,9 +1302,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1535,9 +1313,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1549,9 +1325,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1562,9 +1336,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1576,9 +1348,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1590,9 +1360,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1604,9 +1372,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1618,9 +1384,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1632,9 +1396,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1646,9 +1408,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1660,9 +1420,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1674,9 +1432,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1688,9 +1444,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1701,9 +1455,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.architecture`
+### `process.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1715,9 +1467,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1729,9 +1479,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1743,9 +1491,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1757,9 +1503,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1771,9 +1515,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1784,9 +1526,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.services`
+### `process.Ext.services`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1797,9 +1537,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.domain`
+### `process.Ext.token.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1810,9 +1548,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation`
+### `process.Ext.token.elevation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1823,9 +1559,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation_type`
+### `process.Ext.token.elevation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1837,9 +1571,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1851,9 +1583,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.sid`
+### `process.Ext.token.sid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1864,9 +1594,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.user`
+### `process.Ext.token.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1877,9 +1605,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.user`
+### `process.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1890,9 +1616,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1904,9 +1628,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1918,9 +1640,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1932,9 +1652,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1946,9 +1664,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1960,9 +1676,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1974,9 +1688,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1988,9 +1700,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2002,9 +1712,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2016,9 +1724,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2029,9 +1735,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2042,9 +1746,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2055,9 +1757,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2069,9 +1769,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.architecture`
+### `process.parent.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2083,9 +1781,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.exists`
+### `process.parent.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2097,9 +1793,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.status`
+### `process.parent.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2111,9 +1805,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.subject_name`
+### `process.parent.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2125,9 +1817,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.trusted`
+### `process.parent.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2139,9 +1829,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.protection`
+### `process.parent.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2152,9 +1840,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.user`
+### `process.parent.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2165,9 +1851,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2179,9 +1863,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2193,9 +1875,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2207,9 +1887,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2221,9 +1899,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2235,9 +1911,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2249,9 +1923,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2263,9 +1935,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2277,9 +1947,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2291,9 +1959,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.md5`
+### `process.parent.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2304,9 +1970,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha1`
+### `process.parent.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2317,9 +1981,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha256`
+### `process.parent.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2330,9 +1992,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2344,9 +2004,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2358,9 +2016,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.ppid`
+### `process.parent.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2372,9 +2028,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2386,9 +2040,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.uptime`
+### `process.parent.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2400,9 +2052,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.company`
+### `process.pe.company`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2414,9 +2064,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.description`
+### `process.pe.description`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2428,9 +2076,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.file_version`
+### `process.pe.file_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2442,9 +2088,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.original_file_name`
+### `process.pe.original_file_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2456,9 +2100,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.product`
+### `process.pe.product`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2470,9 +2112,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2484,9 +2124,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2498,9 +2136,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2512,9 +2148,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.id`
+### `rule.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2526,9 +2160,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.name`
+### `rule.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2540,9 +2172,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2554,9 +2184,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2567,9 +2195,7 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2581,5 +2207,3 @@ This alert is generated when a Malware alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md
index b89844a3f..653536c27 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md
@@ -24,7 +24,9 @@ This alert is generated when a Memory Threat alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -114,9 +104,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -127,9 +115,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -140,9 +126,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -153,9 +137,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -166,9 +148,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -179,9 +159,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -192,9 +170,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -205,9 +181,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -219,9 +193,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -233,9 +205,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -247,9 +217,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -261,9 +229,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -275,9 +241,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -289,9 +253,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -303,9 +265,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -317,9 +277,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -331,9 +289,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -345,9 +301,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -359,9 +313,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -373,9 +325,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -387,9 +337,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -401,9 +349,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -415,9 +361,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -429,9 +373,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -443,9 +385,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -456,9 +396,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -469,9 +407,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -483,9 +419,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -496,9 +430,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -510,9 +442,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -523,9 +453,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -536,9 +464,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -549,9 +475,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -563,9 +487,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -576,9 +498,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -590,9 +510,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -604,9 +522,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -618,9 +534,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -632,9 +546,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -646,9 +558,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -660,9 +570,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -674,9 +582,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -688,9 +594,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -702,9 +606,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -715,9 +617,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.architecture`
+### `process.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -729,9 +629,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -743,9 +641,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -757,9 +653,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -771,9 +665,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -785,9 +677,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_base`
+### `process.Ext.memory_region.allocation_base`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -799,9 +689,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_protection`
+### `process.Ext.memory_region.allocation_protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -813,9 +701,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_size`
+### `process.Ext.memory_region.allocation_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -827,9 +713,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.allocation_type`
+### `process.Ext.memory_region.allocation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -841,9 +725,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_address`
+### `process.Ext.memory_region.bytes_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -855,9 +737,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_allocation_offset`
+### `process.Ext.memory_region.bytes_allocation_offset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -869,9 +749,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_compressed`
+### `process.Ext.memory_region.bytes_compressed`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -883,9 +761,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.bytes_compressed_present`
+### `process.Ext.memory_region.bytes_compressed_present`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -897,9 +773,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.all_names`
+### `process.Ext.memory_region.malware_signature.all_names`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -911,9 +785,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.identifier`
+### `process.Ext.memory_region.malware_signature.identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -924,9 +796,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.matches`
+### `process.Ext.memory_region.malware_signature.primary.matches`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -937,9 +807,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
+### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -950,9 +818,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.signature.id`
+### `process.Ext.memory_region.malware_signature.primary.signature.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -963,9 +829,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.primary.signature.name`
+### `process.Ext.memory_region.malware_signature.primary.signature.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -976,9 +840,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.malware_signature.version`
+### `process.Ext.memory_region.malware_signature.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -989,9 +851,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_base`
+### `process.Ext.memory_region.region_base`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1003,9 +863,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_protection`
+### `process.Ext.memory_region.region_protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1017,9 +875,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_size`
+### `process.Ext.memory_region.region_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1031,9 +887,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_start_bytes`
+### `process.Ext.memory_region.region_start_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1045,9 +899,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memory_region.region_state`
+### `process.Ext.memory_region.region_state`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1059,9 +911,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1072,9 +922,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.domain`
+### `process.Ext.token.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1085,9 +933,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation`
+### `process.Ext.token.elevation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1098,9 +944,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation_type`
+### `process.Ext.token.elevation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1112,9 +956,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1126,9 +968,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.sid`
+### `process.Ext.token.sid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1139,9 +979,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.user`
+### `process.Ext.token.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1152,9 +990,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.user`
+### `process.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1165,9 +1001,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1179,9 +1013,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1193,9 +1025,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1207,9 +1037,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1221,9 +1049,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1235,9 +1061,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1249,9 +1073,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1263,9 +1085,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1277,9 +1097,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1291,9 +1109,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1304,9 +1120,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1317,9 +1131,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1330,9 +1142,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1344,9 +1154,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.architecture`
+### `process.parent.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1358,9 +1166,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.exists`
+### `process.parent.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1372,9 +1178,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.status`
+### `process.parent.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1386,9 +1190,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.subject_name`
+### `process.parent.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1400,9 +1202,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.trusted`
+### `process.parent.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1414,9 +1214,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.protection`
+### `process.parent.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1427,9 +1225,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.user`
+### `process.parent.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1440,9 +1236,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1454,9 +1248,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1468,9 +1260,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1482,9 +1272,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1496,9 +1284,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1510,9 +1296,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1524,9 +1308,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1538,9 +1320,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1552,9 +1332,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1566,9 +1344,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.md5`
+### `process.parent.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1579,9 +1355,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha1`
+### `process.parent.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1592,9 +1366,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha256`
+### `process.parent.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1605,9 +1377,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1619,9 +1389,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1633,9 +1401,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.ppid`
+### `process.parent.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1647,9 +1413,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1661,9 +1425,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.uptime`
+### `process.parent.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1675,9 +1437,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1689,9 +1449,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.ppid`
+### `process.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1703,9 +1461,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1717,9 +1473,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1731,9 +1485,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.id`
+### `rule.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1745,9 +1497,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.name`
+### `rule.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1759,9 +1509,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1773,9 +1521,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1786,9 +1532,7 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1800,5 +1544,3 @@ This alert is generated when a Memory Threat alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md
index 879c90f48..eb7ca2e8d 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md
@@ -24,7 +24,9 @@ This alert is generated when a Ransomware alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -114,9 +104,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -127,9 +115,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -140,9 +126,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -153,9 +137,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -166,9 +148,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -179,9 +159,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -192,9 +170,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -205,9 +181,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.executable`
+### `Ransomware.child_processes.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -219,9 +193,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.files.data`
+### `Ransomware.child_processes.files.data`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +204,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.files.entropy`
+### `Ransomware.child_processes.files.entropy`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +215,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.files.extension`
+### `Ransomware.child_processes.files.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +226,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.files.metrics`
+### `Ransomware.child_processes.files.metrics`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +237,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.files.operation`
+### `Ransomware.child_processes.files.operation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -284,9 +248,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.files.path`
+### `Ransomware.child_processes.files.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +259,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.files.score`
+### `Ransomware.child_processes.files.score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -310,9 +270,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.pid`
+### `Ransomware.child_processes.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -324,9 +282,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.child_processes.score`
+### `Ransomware.child_processes.score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -337,9 +293,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.feature`
+### `Ransomware.feature`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -350,9 +304,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.files.data`
+### `Ransomware.files.data`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -363,9 +315,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.files.entropy`
+### `Ransomware.files.entropy`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -376,9 +326,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.files.extension`
+### `Ransomware.files.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -389,9 +337,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.files.metrics`
+### `Ransomware.files.metrics`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -402,9 +348,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.files.operation`
+### `Ransomware.files.operation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -415,9 +359,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.files.path`
+### `Ransomware.files.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -428,9 +370,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.files.score`
+### `Ransomware.files.score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -441,9 +381,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.score`
+### `Ransomware.score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -454,9 +392,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Ransomware.version`
+### `Ransomware.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -467,9 +403,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.@timestamp`
+### `Responses.@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -480,9 +414,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.action`
+### `Responses.action.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -493,9 +425,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.attributes`
+### `Responses.action.file.attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -506,9 +436,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.path`
+### `Responses.action.file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +447,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.reason`
+### `Responses.action.file.reason`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +458,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.actions`
+### `Responses.action.key.actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +469,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.path`
+### `Responses.action.key.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -558,9 +480,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.source.attributes`
+### `Responses.action.source.attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -571,9 +491,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.source.path`
+### `Responses.action.source.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -584,9 +502,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.message`
+### `Responses.message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -597,9 +513,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.result`
+### `Responses.result`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -610,9 +524,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -624,9 +536,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -638,9 +548,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -652,9 +560,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -666,9 +572,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -680,9 +584,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -694,9 +596,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -708,9 +608,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -722,9 +620,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -736,9 +632,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -750,9 +644,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -764,9 +656,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +668,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -792,9 +680,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -806,9 +692,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +704,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +716,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +728,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +740,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -875,9 +751,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -888,9 +762,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -902,9 +774,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -915,9 +785,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -929,9 +797,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -942,9 +808,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -955,9 +819,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -968,9 +830,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -982,9 +842,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -995,9 +853,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1009,9 +865,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1023,9 +877,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1037,9 +889,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1051,9 +901,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1065,9 +913,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1079,9 +925,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1093,9 +937,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1107,9 +949,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1121,9 +961,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1134,9 +972,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.architecture`
+### `process.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1148,9 +984,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1162,9 +996,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1176,9 +1008,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1190,9 +1020,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1204,9 +1032,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.code_signature.exists`
+### `process.Ext.dll.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1218,9 +1044,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.code_signature.status`
+### `process.Ext.dll.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1232,9 +1056,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.code_signature.subject_name`
+### `process.Ext.dll.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1246,9 +1068,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.code_signature.trusted`
+### `process.Ext.dll.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1260,9 +1080,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.mapped_address`
+### `process.Ext.dll.Ext.mapped_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1273,9 +1091,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.mapped_size`
+### `process.Ext.dll.Ext.mapped_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1286,9 +1102,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.code_signature.exists`
+### `process.Ext.dll.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1300,9 +1114,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.code_signature.status`
+### `process.Ext.dll.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1314,9 +1126,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.code_signature.subject_name`
+### `process.Ext.dll.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1328,9 +1138,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.code_signature.trusted`
+### `process.Ext.dll.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1342,9 +1150,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.hash.md5`
+### `process.Ext.dll.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1355,9 +1161,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.hash.sha1`
+### `process.Ext.dll.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1368,9 +1172,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.hash.sha256`
+### `process.Ext.dll.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1381,9 +1183,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.name`
+### `process.Ext.dll.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1395,9 +1195,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.path`
+### `process.Ext.dll.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1409,9 +1207,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1422,9 +1218,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.domain`
+### `process.Ext.token.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1435,9 +1229,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation`
+### `process.Ext.token.elevation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1448,9 +1240,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation_type`
+### `process.Ext.token.elevation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1462,9 +1252,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1476,9 +1264,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.sid`
+### `process.Ext.token.sid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1489,9 +1275,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.user`
+### `process.Ext.token.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1502,9 +1286,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.user`
+### `process.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1515,9 +1297,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1529,9 +1309,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1543,9 +1321,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1557,9 +1333,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1571,9 +1345,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1585,9 +1357,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1599,9 +1369,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1613,9 +1381,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1627,9 +1393,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1641,9 +1405,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1654,9 +1416,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1667,9 +1427,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1680,9 +1438,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1694,9 +1450,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.architecture`
+### `process.parent.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1708,9 +1462,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.exists`
+### `process.parent.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1722,9 +1474,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.status`
+### `process.parent.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1736,9 +1486,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.subject_name`
+### `process.parent.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1750,9 +1498,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.trusted`
+### `process.parent.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1764,9 +1510,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.protection`
+### `process.parent.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1777,9 +1521,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.user`
+### `process.parent.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1790,9 +1532,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1804,9 +1544,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1818,9 +1556,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1832,9 +1568,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1846,9 +1580,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1860,9 +1592,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1874,9 +1604,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1888,9 +1616,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1902,9 +1628,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1916,9 +1640,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.md5`
+### `process.parent.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1929,9 +1651,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha1`
+### `process.parent.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1942,9 +1662,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha256`
+### `process.parent.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1955,9 +1673,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1969,9 +1685,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1983,9 +1697,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.ppid`
+### `process.parent.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1997,9 +1709,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2011,9 +1721,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.uptime`
+### `process.parent.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2025,9 +1733,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.company`
+### `process.pe.company`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2039,9 +1745,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.description`
+### `process.pe.description`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2053,9 +1757,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.file_version`
+### `process.pe.file_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2067,9 +1769,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.original_file_name`
+### `process.pe.original_file_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2081,9 +1781,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pe.product`
+### `process.pe.product`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2095,9 +1793,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2109,9 +1805,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2123,9 +1817,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2137,9 +1829,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2151,9 +1841,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2164,9 +1852,7 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2178,5 +1864,3 @@ This alert is generated when a Ransomware alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md
index 052779be2..9feae1198 100644
--- a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md
+++ b/custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md
@@ -24,7 +24,9 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -114,9 +104,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -127,9 +115,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -140,9 +126,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -153,9 +137,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -166,9 +148,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -179,9 +159,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -192,9 +170,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -205,9 +181,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Memory_protection.cross_session`
+### `Memory_protection.cross_session`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +192,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Memory_protection.feature`
+### `Memory_protection.feature`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +204,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Memory_protection.parent_to_child`
+### `Memory_protection.parent_to_child`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +215,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Memory_protection.self_injection`
+### `Memory_protection.self_injection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +226,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Memory_protection.unique_key_v1`
+### `Memory_protection.unique_key_v1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +237,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Memory_protection.unique_key_v2`
+### `Memory_protection.unique_key_v2`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -285,9 +249,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.@timestamp`
+### `Responses.@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -298,9 +260,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.action`
+### `Responses.action.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -311,9 +271,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.attributes`
+### `Responses.action.file.attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -324,9 +282,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.path`
+### `Responses.action.file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -337,9 +293,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.file.reason`
+### `Responses.action.file.reason`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -350,9 +304,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.actions`
+### `Responses.action.key.actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -363,9 +315,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.path`
+### `Responses.action.key.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -376,9 +326,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.values.actions`
+### `Responses.action.key.values.actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -389,9 +337,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.key.values.name`
+### `Responses.action.key.values.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -402,9 +348,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.source.attributes`
+### `Responses.action.source.attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -415,9 +359,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.action.source.path`
+### `Responses.action.source.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -428,9 +370,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.message`
+### `Responses.message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -441,9 +381,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Responses.result`
+### `Responses.result`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -454,9 +392,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.architecture`
+### `Target.process.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -468,9 +404,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.code_signature.exists`
+### `Target.process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -482,9 +416,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.Ext.code_signature.exists`
+### `Target.process.Ext.dll.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -496,9 +428,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.Ext.code_signature.status`
+### `Target.process.Ext.dll.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -510,9 +440,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.Ext.code_signature.subject_name`
+### `Target.process.Ext.dll.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -524,9 +452,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.Ext.code_signature.trusted`
+### `Target.process.Ext.dll.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -538,9 +464,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.Ext.mapped_address`
+### `Target.process.Ext.dll.Ext.mapped_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -551,9 +475,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.Ext.mapped_size`
+### `Target.process.Ext.dll.Ext.mapped_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -564,9 +486,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.code_signature.exists`
+### `Target.process.Ext.dll.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -578,9 +498,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.code_signature.status`
+### `Target.process.Ext.dll.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -592,9 +510,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.code_signature.subject_name`
+### `Target.process.Ext.dll.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -606,9 +522,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.code_signature.trusted`
+### `Target.process.Ext.dll.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -620,9 +534,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.hash.md5`
+### `Target.process.Ext.dll.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -633,9 +545,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.hash.sha1`
+### `Target.process.Ext.dll.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -646,9 +556,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.hash.sha256`
+### `Target.process.Ext.dll.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -659,9 +567,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.name`
+### `Target.process.Ext.dll.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -673,9 +579,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.dll.path`
+### `Target.process.Ext.dll.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -687,9 +591,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.allocation_base`
+### `Target.process.Ext.memory_region.allocation_base`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -701,9 +603,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.allocation_protection`
+### `Target.process.Ext.memory_region.allocation_protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -715,9 +615,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.allocation_size`
+### `Target.process.Ext.memory_region.allocation_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -729,9 +627,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.allocation_type`
+### `Target.process.Ext.memory_region.allocation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -743,9 +639,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.bytes_address`
+### `Target.process.Ext.memory_region.bytes_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -757,9 +651,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.bytes_allocation_offset`
+### `Target.process.Ext.memory_region.bytes_allocation_offset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -771,9 +663,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.mapped_path`
+### `Target.process.Ext.memory_region.mapped_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -785,9 +675,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.memory_pe_detected`
+### `Target.process.Ext.memory_region.memory_pe_detected`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -799,9 +687,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.region_base`
+### `Target.process.Ext.memory_region.region_base`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -813,9 +699,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.region_protection`
+### `Target.process.Ext.memory_region.region_protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -827,9 +711,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.region_size`
+### `Target.process.Ext.memory_region.region_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -841,9 +723,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.region_state`
+### `Target.process.Ext.memory_region.region_state`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -855,9 +735,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.memory_region.strings`
+### `Target.process.Ext.memory_region.strings`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -868,9 +746,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.protection`
+### `Target.process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -881,9 +757,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.token.domain`
+### `Target.process.Ext.token.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -894,9 +768,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.token.elevation`
+### `Target.process.Ext.token.elevation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -907,9 +779,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.token.elevation_type`
+### `Target.process.Ext.token.elevation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -921,9 +791,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.token.integrity_level_name`
+### `Target.process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -935,9 +803,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.token.sid`
+### `Target.process.Ext.token.sid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -948,9 +814,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.token.user`
+### `Target.process.Ext.token.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -961,9 +825,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.user`
+### `Target.process.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -974,9 +836,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.args`
+### `Target.process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -988,9 +848,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.args_count`
+### `Target.process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1002,9 +860,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.code_signature.exists`
+### `Target.process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1016,9 +872,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.command_line`
+### `Target.process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1030,9 +884,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.entity_id`
+### `Target.process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1044,9 +896,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.executable`
+### `Target.process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1058,9 +908,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.hash.md5`
+### `Target.process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1071,9 +919,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.hash.sha1`
+### `Target.process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1084,9 +930,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.hash.sha256`
+### `Target.process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1097,9 +941,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.name`
+### `Target.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1111,9 +953,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.Ext.architecture`
+### `Target.process.parent.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1125,9 +965,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.Ext.code_signature.exists`
+### `Target.process.parent.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1139,9 +977,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.Ext.code_signature.status`
+### `Target.process.parent.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1153,9 +989,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.Ext.code_signature.subject_name`
+### `Target.process.parent.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1167,9 +1001,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.Ext.code_signature.trusted`
+### `Target.process.parent.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1181,9 +1013,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.Ext.protection`
+### `Target.process.parent.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1194,9 +1024,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.Ext.user`
+### `Target.process.parent.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1207,9 +1035,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.args`
+### `Target.process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1221,9 +1047,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.args_count`
+### `Target.process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1235,9 +1059,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.code_signature.exists`
+### `Target.process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1249,9 +1071,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.code_signature.status`
+### `Target.process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1263,9 +1083,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.code_signature.subject_name`
+### `Target.process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1277,9 +1095,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.code_signature.trusted`
+### `Target.process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1291,9 +1107,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.command_line`
+### `Target.process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1305,9 +1119,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.entity_id`
+### `Target.process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1319,9 +1131,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.executable`
+### `Target.process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1333,9 +1143,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.hash.md5`
+### `Target.process.parent.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1346,9 +1154,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.hash.sha1`
+### `Target.process.parent.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1359,9 +1165,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.hash.sha256`
+### `Target.process.parent.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1372,9 +1176,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.name`
+### `Target.process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1386,9 +1188,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.pid`
+### `Target.process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1400,9 +1200,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.ppid`
+### `Target.process.parent.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1414,9 +1212,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.start`
+### `Target.process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1428,9 +1224,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.parent.uptime`
+### `Target.process.parent.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1442,9 +1236,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.pid`
+### `Target.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1456,9 +1248,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.ppid`
+### `Target.process.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1470,9 +1260,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.start`
+### `Target.process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1484,9 +1272,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.call_stack.instruction_pointer`
+### `Target.process.thread.Ext.call_stack.instruction_pointer`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1497,9 +1283,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.call_stack.memory_section.memory_address`
+### `Target.process.thread.Ext.call_stack.memory_section.memory_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1510,9 +1294,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.call_stack.memory_section.memory_size`
+### `Target.process.thread.Ext.call_stack.memory_section.memory_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1523,9 +1305,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.call_stack.memory_section.protection`
+### `Target.process.thread.Ext.call_stack.memory_section.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1536,9 +1316,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.call_stack.module_name`
+### `Target.process.thread.Ext.call_stack.module_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1549,9 +1327,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.call_stack.module_path`
+### `Target.process.thread.Ext.call_stack.module_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1562,9 +1338,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.call_stack.symbol_info`
+### `Target.process.thread.Ext.call_stack.symbol_info`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1575,9 +1349,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.call_stack_summary`
+### `Target.process.thread.Ext.call_stack_summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1589,9 +1361,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.original_start_address`
+### `Target.process.thread.Ext.original_start_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1603,9 +1373,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.original_start_address_allocation_offset`
+### `Target.process.thread.Ext.original_start_address_allocation_offset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1617,9 +1385,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.original_start_address_bytes`
+### `Target.process.thread.Ext.original_start_address_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1631,9 +1397,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.original_start_address_bytes_disasm`
+### `Target.process.thread.Ext.original_start_address_bytes_disasm`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1645,9 +1409,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.original_start_address_bytes_disasm_hash`
+### `Target.process.thread.Ext.original_start_address_bytes_disasm_hash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1659,9 +1421,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.original_start_address_module`
+### `Target.process.thread.Ext.original_start_address_module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1673,9 +1433,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.start_address`
+### `Target.process.thread.Ext.start_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1687,9 +1445,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.start_address_allocation_offset`
+### `Target.process.thread.Ext.start_address_allocation_offset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1701,9 +1457,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.start_address_bytes`
+### `Target.process.thread.Ext.start_address_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1715,9 +1469,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.start_address_bytes_disasm`
+### `Target.process.thread.Ext.start_address_bytes_disasm`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1729,9 +1481,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.start_address_bytes_disasm_hash`
+### `Target.process.thread.Ext.start_address_bytes_disasm_hash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1743,9 +1493,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.Ext.start_address_module`
+### `Target.process.thread.Ext.start_address_module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1757,9 +1505,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.thread.id`
+### `Target.process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1771,9 +1517,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `Target.process.uptime`
+### `Target.process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1785,9 +1529,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1799,9 +1541,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1813,9 +1553,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1827,9 +1565,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1841,9 +1577,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1855,9 +1589,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1869,9 +1601,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1883,9 +1613,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1897,9 +1625,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1911,9 +1637,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1925,9 +1649,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1939,9 +1661,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1953,9 +1673,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1967,9 +1685,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1981,9 +1697,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1995,9 +1709,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2009,9 +1721,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2023,9 +1733,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2037,9 +1745,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.risk_score`
+### `event.risk_score`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2050,9 +1756,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2063,9 +1767,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.severity`
+### `event.severity`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2077,9 +1779,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2090,9 +1790,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2104,9 +1802,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2117,9 +1813,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2130,9 +1824,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2143,9 +1835,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2157,9 +1847,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2170,9 +1858,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2184,9 +1870,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2198,9 +1882,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2212,9 +1894,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2226,9 +1906,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2240,9 +1918,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2254,9 +1930,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2268,9 +1942,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2282,9 +1954,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2296,9 +1966,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2309,9 +1977,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.architecture`
+### `process.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2323,9 +1989,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2337,9 +2001,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.code_signature.exists`
+### `process.Ext.dll.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2351,9 +2013,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.code_signature.status`
+### `process.Ext.dll.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2365,9 +2025,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.code_signature.subject_name`
+### `process.Ext.dll.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2379,9 +2037,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.code_signature.trusted`
+### `process.Ext.dll.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2393,9 +2049,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.mapped_address`
+### `process.Ext.dll.Ext.mapped_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2406,9 +2060,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.Ext.mapped_size`
+### `process.Ext.dll.Ext.mapped_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2419,9 +2071,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.code_signature.exists`
+### `process.Ext.dll.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2433,9 +2083,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.code_signature.status`
+### `process.Ext.dll.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2447,9 +2095,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.code_signature.subject_name`
+### `process.Ext.dll.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2461,9 +2107,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.code_signature.trusted`
+### `process.Ext.dll.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2475,9 +2119,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.hash.md5`
+### `process.Ext.dll.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2488,9 +2130,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.hash.sha1`
+### `process.Ext.dll.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2501,9 +2141,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.hash.sha256`
+### `process.Ext.dll.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2514,9 +2152,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.name`
+### `process.Ext.dll.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2528,9 +2164,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.dll.path`
+### `process.Ext.dll.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2542,9 +2176,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2555,9 +2187,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.domain`
+### `process.Ext.token.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2568,9 +2198,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation`
+### `process.Ext.token.elevation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2581,9 +2209,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation_type`
+### `process.Ext.token.elevation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2595,9 +2221,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2609,9 +2233,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.sid`
+### `process.Ext.token.sid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2622,9 +2244,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.user`
+### `process.Ext.token.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2635,9 +2255,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.Ext.user`
+### `process.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2648,9 +2266,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2662,9 +2278,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2676,9 +2290,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2690,9 +2302,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2704,9 +2314,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2718,9 +2326,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2732,9 +2338,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2745,9 +2349,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2758,9 +2360,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2771,9 +2371,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2785,9 +2383,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.architecture`
+### `process.parent.Ext.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2799,9 +2395,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.exists`
+### `process.parent.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2813,9 +2407,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.status`
+### `process.parent.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2827,9 +2419,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.subject_name`
+### `process.parent.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2841,9 +2431,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.trusted`
+### `process.parent.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2855,9 +2443,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.protection`
+### `process.parent.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2868,9 +2454,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.user`
+### `process.parent.Ext.user`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2881,9 +2465,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2895,9 +2477,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2909,9 +2489,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2923,9 +2501,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2937,9 +2513,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2951,9 +2525,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2965,9 +2537,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2979,9 +2549,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2993,9 +2561,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3007,9 +2573,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.md5`
+### `process.parent.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3020,9 +2584,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha1`
+### `process.parent.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3033,9 +2595,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.hash.sha256`
+### `process.parent.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3046,9 +2606,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3060,9 +2618,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3074,9 +2630,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.ppid`
+### `process.parent.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3088,9 +2642,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3102,9 +2654,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.parent.uptime`
+### `process.parent.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3116,9 +2666,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3130,9 +2678,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.ppid`
+### `process.ppid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3144,9 +2690,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3158,9 +2702,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack.instruction_pointer`
+### `process.thread.Ext.call_stack.instruction_pointer`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3171,9 +2713,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack.memory_section.memory_address`
+### `process.thread.Ext.call_stack.memory_section.memory_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3184,9 +2724,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack.memory_section.memory_size`
+### `process.thread.Ext.call_stack.memory_section.memory_size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3197,9 +2735,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack.memory_section.protection`
+### `process.thread.Ext.call_stack.memory_section.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3210,9 +2746,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack.module_name`
+### `process.thread.Ext.call_stack.module_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3223,9 +2757,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack.module_path`
+### `process.thread.Ext.call_stack.module_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3236,9 +2768,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack.symbol_info`
+### `process.thread.Ext.call_stack.symbol_info`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3249,9 +2779,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack_final_user_module.name`
+### `process.thread.Ext.call_stack_final_user_module.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3263,9 +2791,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack_summary`
+### `process.thread.Ext.call_stack_summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3277,9 +2803,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.start_address`
+### `process.thread.Ext.start_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3291,9 +2815,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.start_address_module`
+### `process.thread.Ext.start_address_module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3305,9 +2827,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3319,9 +2839,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3333,9 +2851,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `rule.ruleset`
+### `rule.ruleset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3347,9 +2863,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3360,9 +2874,7 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -3374,5 +2886,3 @@ This alert is generated when a Shellcode Threat alert occurs.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md
index 6d86c5c98..5704852b4 100644
--- a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md
@@ -23,7 +23,9 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.provider`
+### `event.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -272,9 +240,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -285,9 +251,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -312,9 +274,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +308,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -365,9 +319,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -463,9 +403,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.behaviors`
+### `process.Ext.api.behaviors`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.return_value`
+### `process.Ext.api.metadata.return_value`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.name`
+### `process.Ext.api.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -546,9 +474,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.app_name`
+### `process.Ext.api.parameters.app_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -560,9 +486,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.buffer`
+### `process.Ext.api.parameters.buffer`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +498,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.content_name`
+### `process.Ext.api.parameters.content_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -588,9 +510,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.size`
+### `process.Ext.api.parameters.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -602,9 +522,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.summary`
+### `process.Ext.api.summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -616,9 +534,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -630,9 +546,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -644,9 +558,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -658,9 +570,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -672,9 +582,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -686,9 +594,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -700,9 +606,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -714,9 +618,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -728,9 +630,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -742,9 +642,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -756,9 +654,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -770,9 +666,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -784,9 +678,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -798,9 +690,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -812,9 +702,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -826,9 +714,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -840,9 +726,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -853,9 +737,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -867,9 +749,7 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -881,5 +761,3 @@ This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md
index 0688bdcee..08de8cfd2 100644
--- a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md
@@ -23,7 +23,9 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.code_signature.exists`
+### `dll.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.code_signature.status`
+### `dll.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.code_signature.subject_name`
+### `dll.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.code_signature.trusted`
+### `dll.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `dll.hash.sha256`
+### `dll.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -188,9 +168,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `dll.path`
+### `dll.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -202,9 +180,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -216,9 +192,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -230,9 +204,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -244,9 +216,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +228,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -272,9 +240,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -314,9 +276,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -328,9 +288,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.provider`
+### `event.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -448,9 +390,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -462,9 +402,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -476,9 +414,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -546,9 +474,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -560,9 +486,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +498,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.behaviors`
+### `process.Ext.api.behaviors`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -588,9 +510,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.name`
+### `process.Ext.api.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -602,9 +522,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.device`
+### `process.Ext.api.parameters.device`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -616,9 +534,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.io_control_code`
+### `process.Ext.api.parameters.io_control_code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -630,9 +546,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.summary`
+### `process.Ext.api.summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -644,9 +558,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -658,9 +570,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -672,9 +582,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -686,9 +594,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -700,9 +606,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -713,9 +617,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -727,9 +629,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -741,9 +641,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -755,9 +653,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -769,9 +665,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -783,9 +677,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -797,9 +689,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -811,9 +701,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -825,9 +713,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -839,9 +725,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -853,9 +737,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -867,9 +749,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -881,9 +761,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -894,9 +772,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -908,9 +784,7 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -922,5 +796,3 @@ This event is generated when ETW AttackSurfaceMonitor events are generated.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md
index 6d6c7f2ad..7058238de 100644
--- a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md
@@ -23,7 +23,9 @@ This event is generated when a process attempts to access priviledged credential
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.protection`
+### `Target.process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -48,9 +48,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `Target.process.name`
+### `Target.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `Target.process.pid`
+### `Target.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -76,9 +72,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -90,9 +84,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -104,9 +96,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -174,9 +156,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -188,9 +168,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -202,9 +180,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -216,9 +192,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -230,9 +204,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -244,9 +216,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +228,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -272,9 +240,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.provider`
+### `event.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -448,9 +390,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -462,9 +402,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -476,9 +414,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.name`
+### `process.Ext.api.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.desired_access`
+### `process.Ext.api.parameters.desired_access`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.desired_access_numeric`
+### `process.Ext.api.parameters.desired_access_numeric`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -585,9 +507,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.handle_type`
+### `process.Ext.api.parameters.handle_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -599,9 +519,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -613,9 +531,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +555,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -655,9 +567,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +639,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +651,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack.instruction_pointer`
+### `process.thread.Ext.call_stack.instruction_pointer`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -780,9 +674,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack.module_path`
+### `process.thread.Ext.call_stack.module_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -793,9 +685,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack_contains_unbacked`
+### `process.thread.Ext.call_stack_contains_unbacked`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -806,9 +696,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.thread.Ext.call_stack_final_user_module.path`
+### `process.thread.Ext.call_stack_final_user_module.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -847,9 +731,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -861,9 +743,7 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -875,5 +755,3 @@ This event is generated when a process attempts to access priviledged credential
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md
index 79d9a9904..a6f3f28c5 100644
--- a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md
@@ -23,7 +23,9 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.provider`
+### `event.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -272,9 +240,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -285,9 +251,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -312,9 +274,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +308,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -365,9 +319,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -463,9 +403,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.behaviors`
+### `process.Ext.api.behaviors`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.name`
+### `process.Ext.api.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +451,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.summary`
+### `process.Ext.api.summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -533,9 +463,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -547,9 +475,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -561,9 +487,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -575,9 +499,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -589,9 +511,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -602,9 +522,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -616,9 +534,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -630,9 +546,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -644,9 +558,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -658,9 +570,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -672,9 +582,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -686,9 +594,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -700,9 +606,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -714,9 +618,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -728,9 +630,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -742,9 +642,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -756,9 +654,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -770,9 +666,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -783,9 +677,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -797,9 +689,7 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -811,5 +701,3 @@ This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md
index 8ce239ac0..f56b1b06b 100644
--- a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md
@@ -23,7 +23,9 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `destination.ip`
+### `destination.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `destination.port`
+### `destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -145,9 +131,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -159,9 +143,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -201,9 +179,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -215,9 +191,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -229,9 +203,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -243,9 +215,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -257,9 +227,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +239,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.provider`
+### `event.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -285,9 +251,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -298,9 +262,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -311,9 +273,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -351,9 +307,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -364,9 +318,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -378,9 +330,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -391,9 +341,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -405,9 +353,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -419,9 +365,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -461,9 +401,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -475,9 +413,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -489,9 +425,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `network.transport`
+### `network.transport`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -531,9 +461,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `network.type`
+### `network.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.behaviors`
+### `process.Ext.api.behaviors`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.name`
+### `process.Ext.api.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -573,9 +497,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.summary`
+### `process.Ext.api.summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -615,9 +533,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -629,9 +545,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -643,9 +557,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -670,9 +580,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -684,9 +592,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -698,9 +604,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -712,9 +616,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -726,9 +628,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -740,9 +640,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -754,9 +652,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -768,9 +664,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -782,9 +676,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -796,9 +688,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -810,9 +700,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -824,9 +712,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -837,9 +723,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -851,9 +735,7 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -865,5 +747,3 @@ This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md
index dd43f606e..c40afd523 100644
--- a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md
@@ -23,7 +23,9 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.created_suspended`
+### `Target.process.Ext.created_suspended`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.protection`
+### `Target.process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.token.integrity_level_name`
+### `Target.process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -76,9 +72,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `Target.process.entity_id`
+### `Target.process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -90,9 +84,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `Target.process.executable`
+### `Target.process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -104,9 +96,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `Target.process.name`
+### `Target.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `Target.process.pid`
+### `Target.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -174,9 +156,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -188,9 +168,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -202,9 +180,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -216,9 +192,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -230,9 +204,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -244,9 +216,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +228,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -272,9 +240,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -314,9 +276,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -328,9 +288,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.provider`
+### `event.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -356,9 +312,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -369,9 +323,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -396,9 +346,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -409,9 +357,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -462,9 +402,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -476,9 +414,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -546,9 +474,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -560,9 +486,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +498,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -588,9 +510,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.behaviors`
+### `process.Ext.api.behaviors`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -602,9 +522,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.target_address_name`
+### `process.Ext.api.metadata.target_address_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -616,9 +534,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.target_address_path`
+### `process.Ext.api.metadata.target_address_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -630,9 +546,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.name`
+### `process.Ext.api.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -644,9 +558,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.address`
+### `process.Ext.api.parameters.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -658,9 +570,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.allocation_type`
+### `process.Ext.api.parameters.allocation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -672,9 +582,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.argument1`
+### `process.Ext.api.parameters.argument1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -686,9 +594,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.argument2`
+### `process.Ext.api.parameters.argument2`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -700,9 +606,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.argument3`
+### `process.Ext.api.parameters.argument3`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -714,9 +618,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.context_flags`
+### `process.Ext.api.parameters.context_flags`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -728,9 +630,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.desired_access`
+### `process.Ext.api.parameters.desired_access`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -741,9 +641,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.desired_access_numeric`
+### `process.Ext.api.parameters.desired_access_numeric`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -754,9 +652,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.device`
+### `process.Ext.api.parameters.device`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -768,9 +664,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.driver`
+### `process.Ext.api.parameters.driver`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -782,9 +676,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.eax`
+### `process.Ext.api.parameters.eax`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -796,9 +688,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.ebp`
+### `process.Ext.api.parameters.ebp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -810,9 +700,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.ebx`
+### `process.Ext.api.parameters.ebx`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -824,9 +712,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.ecx`
+### `process.Ext.api.parameters.ecx`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -838,9 +724,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.edi`
+### `process.Ext.api.parameters.edi`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -852,9 +736,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.edx`
+### `process.Ext.api.parameters.edx`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -866,9 +748,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.eip`
+### `process.Ext.api.parameters.eip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -880,9 +760,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.esi`
+### `process.Ext.api.parameters.esi`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -894,9 +772,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.esp`
+### `process.Ext.api.parameters.esp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -908,9 +784,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.handle_type`
+### `process.Ext.api.parameters.handle_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -922,9 +796,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.procedure`
+### `process.Ext.api.parameters.procedure`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -936,9 +808,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.protection`
+### `process.Ext.api.parameters.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -950,9 +820,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.protection_old`
+### `process.Ext.api.parameters.protection_old`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -964,9 +832,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.r8`
+### `process.Ext.api.parameters.r8`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -978,9 +844,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.r9`
+### `process.Ext.api.parameters.r9`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -992,9 +856,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.rax`
+### `process.Ext.api.parameters.rax`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1006,9 +868,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.rbp`
+### `process.Ext.api.parameters.rbp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1020,9 +880,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.rbx`
+### `process.Ext.api.parameters.rbx`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1034,9 +892,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.rcx`
+### `process.Ext.api.parameters.rcx`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1048,9 +904,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.rdi`
+### `process.Ext.api.parameters.rdi`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1062,9 +916,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.rdx`
+### `process.Ext.api.parameters.rdx`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1076,9 +928,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.rip`
+### `process.Ext.api.parameters.rip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1090,9 +940,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.rsi`
+### `process.Ext.api.parameters.rsi`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1104,9 +952,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.rsp`
+### `process.Ext.api.parameters.rsp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1118,9 +964,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.size`
+### `process.Ext.api.parameters.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1132,9 +976,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.summary`
+### `process.Ext.api.summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1146,9 +988,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1160,9 +1000,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1174,9 +1012,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1188,9 +1024,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1202,9 +1036,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1215,9 +1047,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1229,9 +1059,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1243,9 +1071,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1257,9 +1083,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1271,9 +1095,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1285,9 +1107,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1299,9 +1119,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1313,9 +1131,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1327,9 +1143,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1341,9 +1155,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1355,9 +1167,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1369,9 +1179,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1383,9 +1191,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1396,9 +1202,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1410,9 +1214,7 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1424,5 +1226,3 @@ This event is generated when ETW Threat-Intelligence events are generated.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md
index ecbbdcf78..00779f3f2 100644
--- a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md
@@ -23,7 +23,9 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.protection`
+### `Target.process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -48,9 +48,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `Target.process.name`
+### `Target.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `Target.process.pid`
+### `Target.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -76,9 +72,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -90,9 +84,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -104,9 +96,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -174,9 +156,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -188,9 +168,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -202,9 +180,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -216,9 +192,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -230,9 +204,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -244,9 +216,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +228,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -272,9 +240,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.provider`
+### `event.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -448,9 +390,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -462,9 +402,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -476,9 +414,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.behaviors`
+### `process.Ext.api.behaviors`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.background_callcount`
+### `process.Ext.api.metadata.background_callcount`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -573,9 +497,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.ms_since_last_keyevent`
+### `process.Ext.api.metadata.ms_since_last_keyevent`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.procedure_symbol`
+### `process.Ext.api.metadata.procedure_symbol`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.return_value`
+### `process.Ext.api.metadata.return_value`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -615,9 +533,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.start_address_allocation_protection`
+### `process.Ext.api.metadata.start_address_allocation_protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -629,9 +545,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.start_address_module`
+### `process.Ext.api.metadata.start_address_module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -643,9 +557,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.target_address_name`
+### `process.Ext.api.metadata.target_address_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -657,9 +569,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.target_address_path`
+### `process.Ext.api.metadata.target_address_path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -671,9 +581,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.thread_info_flags`
+### `process.Ext.api.metadata.thread_info_flags`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -685,9 +593,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.visible_windows_count`
+### `process.Ext.api.metadata.visible_windows_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -699,9 +605,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.windows_count`
+### `process.Ext.api.metadata.windows_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -713,9 +617,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.name`
+### `process.Ext.api.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -727,9 +629,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.address`
+### `process.Ext.api.parameters.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -741,9 +641,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.allocation_type`
+### `process.Ext.api.parameters.allocation_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -755,9 +653,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.flags`
+### `process.Ext.api.parameters.flags`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -769,9 +665,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.hook_module`
+### `process.Ext.api.parameters.hook_module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -783,9 +677,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.hook_type`
+### `process.Ext.api.parameters.hook_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -797,9 +689,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.procedure`
+### `process.Ext.api.parameters.procedure`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -811,9 +701,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.protection`
+### `process.Ext.api.parameters.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -825,9 +713,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.protection_old`
+### `process.Ext.api.parameters.protection_old`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -839,9 +725,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.size`
+### `process.Ext.api.parameters.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -853,9 +737,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.usage`
+### `process.Ext.api.parameters.usage`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -867,9 +749,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.usage_page`
+### `process.Ext.api.parameters.usage_page`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -881,9 +761,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.summary`
+### `process.Ext.api.summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -895,9 +773,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -909,9 +785,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -923,9 +797,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -937,9 +809,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -951,9 +821,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -964,9 +832,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -978,9 +844,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -992,9 +856,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1006,9 +868,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1020,9 +880,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1034,9 +892,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1048,9 +904,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1062,9 +916,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1076,9 +928,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1090,9 +940,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1104,9 +952,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1118,9 +964,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1132,9 +976,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1145,9 +987,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1159,9 +999,7 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1173,5 +1011,3 @@ This event is generated when keylogging-related Win32k APIs are called.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md
index 2dcdc9479..1f6b63b83 100644
--- a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md
+++ b/custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md
@@ -23,7 +23,9 @@ This event is generated when WMI Activity-related APIs are called.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.protection`
+### `Target.process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -48,9 +48,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `Target.process.name`
+### `Target.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `Target.process.pid`
+### `Target.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -76,9 +72,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -90,9 +84,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -104,9 +96,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -174,9 +156,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -188,9 +168,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -202,9 +180,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -216,9 +192,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -230,9 +204,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -244,9 +216,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +228,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -272,9 +240,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.provider`
+### `event.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -448,9 +390,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -462,9 +402,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -476,9 +414,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.behaviors`
+### `process.Ext.api.behaviors`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.client_is_local`
+### `process.Ext.api.metadata.client_is_local`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -573,9 +497,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.client_machine`
+### `process.Ext.api.metadata.client_machine`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.client_machine_fqdn`
+### `process.Ext.api.metadata.client_machine_fqdn`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.metadata.client_process_id`
+### `process.Ext.api.metadata.client_process_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -615,9 +533,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.name`
+### `process.Ext.api.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -629,9 +545,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.consumer_details`
+### `process.Ext.api.parameters.consumer_details`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.consumer_name`
+### `process.Ext.api.parameters.consumer_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.consumer_type`
+### `process.Ext.api.parameters.consumer_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -670,9 +580,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.event_filter_details`
+### `process.Ext.api.parameters.event_filter_details`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.event_filter_name`
+### `process.Ext.api.parameters.event_filter_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.namespace`
+### `process.Ext.api.parameters.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.parameters.operation`
+### `process.Ext.api.parameters.operation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.api.summary`
+### `process.Ext.api.summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +639,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +651,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -781,9 +675,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -795,9 +687,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -808,9 +698,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -822,9 +710,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -836,9 +722,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -850,9 +734,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -864,9 +746,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -878,9 +758,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -892,9 +770,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -906,9 +782,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -920,9 +794,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -934,9 +806,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -948,9 +818,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -962,9 +830,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -976,9 +842,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -989,9 +853,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1003,9 +865,7 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1017,5 +877,3 @@ This event is generated when WMI Activity-related APIs are called.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md
index 8f8211172..864bb08d5 100644
--- a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md
+++ b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md
@@ -24,7 +24,9 @@ This event is generated when a file is created.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -327,9 +287,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -341,9 +299,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -354,9 +310,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -460,9 +400,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -487,9 +423,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -501,9 +435,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -515,9 +447,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -529,9 +459,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -543,9 +471,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +483,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -571,9 +495,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -585,9 +507,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -599,9 +519,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -612,9 +530,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -626,9 +542,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -640,9 +554,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -654,9 +566,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -668,9 +578,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -682,9 +590,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -696,9 +602,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -710,9 +614,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -724,9 +626,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -738,9 +638,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -752,9 +650,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -765,9 +661,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +672,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -792,9 +684,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -806,5 +696,3 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md
index 875c487ae..5cef18b3a 100644
--- a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md
+++ b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md
@@ -24,7 +24,9 @@ This event is generated when a file is deleted.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -314,9 +276,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -328,9 +288,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -341,9 +299,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -354,9 +310,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -460,9 +400,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -474,9 +412,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -488,9 +424,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -502,9 +436,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -516,9 +448,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -558,9 +484,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -586,9 +508,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -599,9 +519,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -613,9 +531,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +555,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -655,9 +567,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +639,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -752,9 +650,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -765,9 +661,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -779,9 +673,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -793,5 +685,3 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md
index 4ce505f63..96e9f95c2 100644
--- a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md
+++ b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md
@@ -24,7 +24,9 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.Ext.correlation.id`
+### `event.Ext.correlation.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.path`
+### `file.Ext.original.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -312,9 +274,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.hash.md5`
+### `file.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.hash.sha1`
+### `file.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -351,9 +307,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -365,9 +319,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -419,9 +365,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -432,9 +376,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -487,9 +423,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -501,9 +435,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -515,9 +447,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -529,9 +459,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -543,9 +471,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +483,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -571,5 +495,3 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md
index 5f136f3b6..a00aae414 100644
--- a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md
+++ b/custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md
@@ -24,7 +24,9 @@ This event is generated when a file is renamed.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.extension`
+### `file.Ext.original.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.name`
+### `file.Ext.original.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -312,9 +274,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.path`
+### `file.Ext.original.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +308,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -419,9 +365,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -432,9 +376,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +410,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -485,9 +421,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +433,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -512,9 +444,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -526,9 +456,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -540,9 +468,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -554,9 +480,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -568,9 +492,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -582,9 +504,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -596,9 +516,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -610,9 +528,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -624,9 +540,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -638,9 +552,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -651,9 +563,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +575,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +587,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -693,9 +599,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -707,9 +611,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -721,9 +623,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -735,9 +635,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -749,9 +647,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -763,9 +659,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -777,9 +671,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -791,9 +683,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -804,9 +694,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -817,9 +705,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -831,9 +717,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -845,5 +729,3 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md
index 5190ff80a..841efa4bf 100644
--- a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md
@@ -24,7 +24,9 @@ This event is generated when a file is accessed.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `file.inode`
+### `file.inode`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -369,9 +323,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -383,9 +335,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -397,9 +347,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -411,9 +359,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -424,9 +370,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -437,9 +381,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -451,9 +393,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -531,9 +461,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -573,9 +497,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -615,9 +533,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -629,9 +545,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -643,9 +557,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -657,9 +569,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -671,9 +581,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -684,9 +592,7 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -698,5 +604,3 @@ This event is generated when a file is accessed.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md
index af99fdd1c..f203d5040 100644
--- a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md
@@ -24,7 +24,9 @@ This event is generated when a file is deleted.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -356,9 +312,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.inode`
+### `file.inode`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -370,9 +324,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -384,9 +336,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -398,9 +348,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -412,9 +360,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -425,9 +371,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -438,9 +382,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -451,9 +393,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +416,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -531,9 +461,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -558,9 +484,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -586,9 +508,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -600,9 +520,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +544,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -670,9 +580,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +639,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +651,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -781,9 +675,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -795,9 +687,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -809,9 +699,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -823,9 +711,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -837,9 +723,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -851,9 +735,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -864,9 +746,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -877,9 +757,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -891,9 +769,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -905,5 +781,3 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md
index ee073f6b2..7cf69c607 100644
--- a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md
@@ -24,7 +24,9 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.Ext.correlation.id`
+### `event.Ext.correlation.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.path`
+### `file.Ext.original.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -312,9 +274,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.hash.md5`
+### `file.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.hash.sha1`
+### `file.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -351,9 +307,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -365,9 +319,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -419,9 +365,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -432,9 +376,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -487,9 +423,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -501,9 +435,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -515,9 +447,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -529,9 +459,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -543,9 +471,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +483,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -571,5 +495,3 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md
index 10eaf4113..8e41054ef 100644
--- a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md
@@ -24,7 +24,9 @@ This event is generated when extended file attributes are deleted.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `file.attributes`
+### `file.attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -356,9 +312,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -369,9 +323,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `file.inode`
+### `file.inode`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -383,9 +335,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -397,9 +347,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -411,9 +359,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -425,9 +371,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -438,9 +382,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -451,9 +393,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +483,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -571,9 +495,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -585,9 +507,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -599,9 +519,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -613,9 +531,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +555,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -655,9 +567,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -696,9 +602,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -710,9 +614,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -724,9 +626,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -738,9 +638,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -752,9 +650,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -766,9 +662,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -780,9 +674,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -794,9 +686,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -808,9 +698,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -822,9 +710,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -836,9 +722,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -850,9 +734,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -863,9 +745,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,9 +756,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -890,9 +768,7 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -904,5 +780,3 @@ This event is generated when extended file attributes are deleted.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md
index 0159557e8..dab2dc295 100644
--- a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md
@@ -24,7 +24,9 @@ This event includes information about a macOS Launch Daemon.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `Persistence.args`
+### `Persistence.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `Persistence.keepalive`
+### `Persistence.keepalive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `Persistence.name`
+### `Persistence.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -131,9 +119,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `Persistence.path`
+### `Persistence.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -144,9 +130,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `Persistence.runatload`
+### `Persistence.runatload`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -157,9 +141,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -171,9 +153,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -185,9 +165,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -199,9 +177,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -213,9 +189,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -227,9 +201,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -241,9 +213,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -255,9 +225,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -269,9 +237,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +249,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +261,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -311,9 +273,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -486,9 +422,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +433,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -512,9 +444,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -526,9 +456,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -539,9 +467,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -553,9 +479,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -567,9 +491,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -581,9 +503,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -595,9 +515,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -609,9 +527,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -623,9 +539,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -637,9 +551,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -651,9 +563,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +575,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -678,9 +586,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,9 +598,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -706,9 +610,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -720,9 +622,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -734,9 +634,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -748,9 +646,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -762,9 +658,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -776,9 +670,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -790,9 +682,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -804,9 +694,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -818,9 +706,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -831,9 +717,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -844,9 +728,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -858,9 +740,7 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -872,5 +752,3 @@ This event includes information about a macOS Launch Daemon.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md
index a588c714d..7e8ab07bb 100644
--- a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md
@@ -24,7 +24,9 @@ This event is generated when a file is modified.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.Ext.header_bytes`
+### `file.Ext.header_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -369,9 +323,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.inode`
+### `file.inode`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -396,9 +346,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -410,9 +358,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -424,9 +370,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -438,9 +382,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -451,9 +393,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -543,9 +471,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +483,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -570,9 +494,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -584,9 +506,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -598,9 +518,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -612,9 +530,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -626,9 +542,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -640,9 +554,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -654,9 +566,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -668,9 +578,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -682,9 +590,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -696,9 +602,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -709,9 +613,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -723,9 +625,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -737,9 +637,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -751,9 +649,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -765,9 +661,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -779,9 +673,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -793,9 +685,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -807,9 +697,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -821,9 +709,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -835,9 +721,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -849,9 +733,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -863,9 +745,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -877,9 +757,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -890,9 +768,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -903,9 +779,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -917,9 +791,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -931,5 +803,3 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md
index fbd8e8ce3..dfe8edfc3 100644
--- a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md
@@ -24,7 +24,9 @@ This event is generated when a file system is mounted.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.path`
+### `file.Ext.original.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `file.inode`
+### `file.inode`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -369,9 +323,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -383,9 +335,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -396,9 +346,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -409,9 +357,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -462,9 +402,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -475,9 +413,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -488,9 +424,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -502,9 +436,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -515,9 +447,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -529,9 +459,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -543,9 +471,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +483,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -571,9 +495,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -585,9 +507,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -599,9 +519,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -613,9 +531,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +555,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -654,9 +566,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -668,9 +578,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -682,9 +590,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -696,9 +602,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -710,9 +614,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -724,9 +626,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -738,9 +638,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -752,9 +650,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -766,9 +662,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -780,9 +674,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -794,9 +686,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -808,9 +698,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -821,9 +709,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +732,7 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,5 +744,3 @@ This event is generated when a file system is mounted.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md
index 99be5c83c..9856fb450 100644
--- a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md
+++ b/custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md
@@ -24,7 +24,9 @@ This event is generated when a file is renamed.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.extension`
+### `file.Ext.original.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.path`
+### `file.Ext.original.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.inode`
+### `file.inode`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -409,9 +357,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -423,9 +369,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -437,9 +381,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -451,9 +393,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -543,9 +471,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -556,9 +482,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -570,9 +494,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -583,9 +505,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -597,9 +517,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -611,9 +529,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -625,9 +541,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -639,9 +553,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -653,9 +565,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -667,9 +577,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -681,9 +589,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -695,9 +601,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -709,9 +613,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -722,9 +624,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -736,9 +636,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -750,9 +648,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -764,9 +660,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +672,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -792,9 +684,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -806,9 +696,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +732,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +744,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,9 +756,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -890,9 +768,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -903,9 +779,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -916,9 +790,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -930,9 +802,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -944,5 +814,3 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md
index 440d7016f..147f45c5a 100644
--- a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md
@@ -24,7 +24,9 @@ This event is generated when a file is created.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.Ext.entropy`
+### `file.Ext.entropy`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.Ext.header_bytes`
+### `file.Ext.header_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.Ext.monotonic_id`
+### `file.Ext.monotonic_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.Ext.windows.zone_identifier`
+### `file.Ext.windows.zone_identifier`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.origin_referrer_url`
+### `file.origin_referrer_url`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -448,9 +390,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.origin_url`
+### `file.origin_url`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -461,9 +401,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -475,9 +413,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -489,9 +425,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -516,9 +448,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -529,9 +459,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -542,9 +470,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -556,9 +482,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -569,9 +493,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -583,9 +505,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -597,9 +517,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -611,9 +529,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -625,9 +541,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -639,9 +553,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -653,9 +565,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -667,9 +577,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -681,9 +589,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -695,9 +601,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -708,9 +612,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -722,9 +624,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -736,9 +636,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -750,9 +648,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -764,9 +660,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +672,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -792,9 +684,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -806,9 +696,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +732,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +744,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,9 +756,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -890,9 +768,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -904,9 +780,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -918,9 +792,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -931,9 +803,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -945,9 +815,7 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -959,5 +827,3 @@ This event is generated when a file is created.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md
index cb6e2d73d..54040450e 100644
--- a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md
@@ -24,7 +24,9 @@ This event is generated when a file is deleted.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.Ext.entropy`
+### `file.Ext.entropy`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.Ext.monotonic_id`
+### `file.Ext.monotonic_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -396,9 +346,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -410,9 +358,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -424,9 +370,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -438,9 +382,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -451,9 +393,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -546,9 +474,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -560,9 +486,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +498,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -588,9 +510,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -602,9 +522,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -616,9 +534,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -630,9 +546,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -643,9 +557,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -657,9 +569,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -671,9 +581,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -685,9 +593,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -699,9 +605,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -713,9 +617,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -727,9 +629,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -741,9 +641,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -755,9 +653,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -769,9 +665,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -783,9 +677,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -797,9 +689,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -811,9 +701,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -825,9 +713,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -839,9 +725,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -853,9 +737,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -866,9 +748,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -880,9 +760,7 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -894,5 +772,3 @@ This event is generated when a file is deleted.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md
index 1b8c699bb..c5160c49d 100644
--- a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md
@@ -24,7 +24,9 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.Ext.correlation.id`
+### `event.Ext.correlation.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.path`
+### `file.Ext.original.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -312,9 +274,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.hash.md5`
+### `file.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.hash.sha1`
+### `file.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -351,9 +307,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -365,9 +319,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -419,9 +365,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -432,9 +376,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -487,9 +423,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -501,9 +435,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -515,9 +447,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -529,9 +459,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -543,9 +471,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +483,7 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -571,5 +495,3 @@ This event is generated when Endpoint restores a file from the malware quarantin
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md
index 297632216..b17a6c91a 100644
--- a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md
@@ -24,7 +24,9 @@ This event is generated when a file is modified.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.Ext.entropy`
+### `file.Ext.entropy`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.Ext.header_bytes`
+### `file.Ext.header_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.Ext.monotonic_id`
+### `file.Ext.monotonic_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -436,9 +380,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -450,9 +392,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -558,9 +484,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -586,9 +508,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -600,9 +520,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +544,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +639,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +651,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -781,9 +675,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -795,9 +687,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -809,9 +699,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -823,9 +711,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -837,9 +723,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -851,9 +735,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -865,9 +747,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -878,9 +758,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -892,9 +770,7 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -906,5 +782,3 @@ This event is generated when a file is modified.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md
index 9da4be12f..7f5e3e168 100644
--- a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md
@@ -24,7 +24,9 @@ This event is generated when a file is opened.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `file.Ext.entropy`
+### `file.Ext.entropy`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `file.Ext.header_bytes`
+### `file.Ext.header_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `file.Ext.monotonic_id`
+### `file.Ext.monotonic_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -436,9 +380,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -450,9 +392,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -558,9 +484,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -586,9 +508,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -600,9 +520,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +544,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +639,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +651,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -781,9 +675,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -795,9 +687,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -809,9 +699,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -823,9 +711,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -837,9 +723,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -851,9 +735,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -865,9 +747,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -879,9 +759,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -892,9 +770,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -906,9 +782,7 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -920,5 +794,3 @@ This event is generated when a file is opened.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md
index 64257aa30..32a414374 100644
--- a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md
@@ -24,7 +24,9 @@ This event is generated when a file is overwritten
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `file.Ext.entropy`
+### `file.Ext.entropy`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `file.Ext.header_bytes`
+### `file.Ext.header_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `file.Ext.monotonic_id`
+### `file.Ext.monotonic_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -436,9 +380,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -450,9 +392,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -558,9 +484,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -586,9 +508,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -600,9 +520,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +544,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +639,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +651,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -781,9 +675,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -795,9 +687,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -809,9 +699,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -823,9 +711,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -837,9 +723,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -851,9 +735,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -865,9 +747,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -878,9 +758,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -892,9 +770,7 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -906,5 +782,3 @@ This event is generated when a file is overwritten
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md
index 319c8e3ec..b7766f48e 100644
--- a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md
+++ b/custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md
@@ -24,7 +24,9 @@ This event is generated when a file is renamed.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.entropy`
+### `file.Ext.entropy`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.header_bytes`
+### `file.Ext.header_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.monotonic_id`
+### `file.Ext.monotonic_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.extension`
+### `file.Ext.original.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.name`
+### `file.Ext.original.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.Ext.original.path`
+### `file.Ext.original.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.extension`
+### `file.extension`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.hash.sha256`
+### `file.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.name`
+### `file.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -461,9 +401,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -475,9 +413,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `file.size`
+### `file.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -489,9 +425,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -516,9 +448,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -529,9 +459,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -542,9 +470,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -556,9 +482,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -569,9 +493,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -583,9 +505,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -597,9 +517,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -611,9 +529,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -625,9 +541,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -639,9 +553,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -653,9 +565,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -667,9 +577,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -681,9 +589,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -695,9 +601,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -708,9 +612,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -722,9 +624,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -736,9 +636,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -750,9 +648,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -764,9 +660,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +672,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -792,9 +684,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -806,9 +696,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +732,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +744,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,9 +756,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -890,9 +768,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -904,9 +780,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `process.thread.id`
+### `process.thread.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -918,9 +792,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -931,9 +803,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -945,9 +815,7 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -959,5 +827,3 @@ This event is generated when a file is renamed.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md b/custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md
index 40c250a4c..6ac69c933 100644
--- a/custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md
+++ b/custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md
@@ -24,7 +24,9 @@ This event is generated when a dynlib is loaded.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.size`
+### `dll.Ext.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.code_signature.exists`
+### `dll.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.code_signature.subject_name`
+### `dll.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.code_signature.team_id`
+### `dll.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.code_signature.trusted`
+### `dll.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.hash.md5`
+### `dll.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +228,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.hash.sha1`
+### `dll.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +239,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.hash.sha256`
+### `dll.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -284,9 +250,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.name`
+### `dll.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -298,9 +262,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.path`
+### `dll.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -312,9 +274,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -354,9 +310,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -396,9 +346,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -410,9 +358,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -424,9 +370,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -438,9 +382,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -452,9 +394,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -465,9 +405,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +416,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +483,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -570,9 +494,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -583,9 +505,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -597,9 +517,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -610,9 +528,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -624,9 +540,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -638,9 +552,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -652,9 +564,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -666,9 +576,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -680,9 +588,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -694,9 +600,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -708,9 +612,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -722,9 +624,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -736,9 +636,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -749,9 +647,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -763,9 +659,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -777,9 +671,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -791,9 +683,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -805,9 +695,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -819,9 +707,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -833,9 +719,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -847,9 +731,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -861,9 +743,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -875,9 +755,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -889,9 +767,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -902,9 +778,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -915,9 +789,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -929,9 +801,7 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -943,5 +813,3 @@ This event is generated when a dynlib is loaded.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md b/custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md
index efa2a1be2..59a1e53fb 100644
--- a/custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md
+++ b/custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md
@@ -24,7 +24,9 @@ This event is generated when a DLL or driver is loaded.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.code_signature.exists`
+### `dll.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.code_signature.status`
+### `dll.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.code_signature.subject_name`
+### `dll.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.code_signature.trusted`
+### `dll.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.defense_evasions`
+### `dll.Ext.defense_evasions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.load_index`
+### `dll.Ext.load_index`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -202,9 +180,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.relative_file_creation_time`
+### `dll.Ext.relative_file_creation_time`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -215,9 +191,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.relative_file_name_modify_time`
+### `dll.Ext.relative_file_name_modify_time`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -228,9 +202,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.Ext.size`
+### `dll.Ext.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -241,9 +213,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.code_signature.exists`
+### `dll.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -255,9 +225,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.code_signature.status`
+### `dll.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -269,9 +237,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.code_signature.subject_name`
+### `dll.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +249,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.code_signature.trusted`
+### `dll.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +261,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.hash.md5`
+### `dll.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -310,9 +272,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.hash.sha1`
+### `dll.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -323,9 +283,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.hash.sha256`
+### `dll.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -336,9 +294,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.name`
+### `dll.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -350,9 +306,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.path`
+### `dll.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -364,9 +318,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.pe.file_version`
+### `dll.pe.file_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -378,9 +330,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.pe.imphash`
+### `dll.pe.imphash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -392,9 +342,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `dll.pe.original_file_name`
+### `dll.pe.original_file_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -448,9 +390,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -462,9 +402,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -476,9 +414,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -490,9 +426,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +438,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -546,9 +474,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -586,9 +508,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -599,9 +519,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -612,9 +530,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -625,9 +541,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -639,9 +553,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -652,9 +564,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -666,9 +576,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -680,9 +588,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -694,9 +600,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -708,9 +612,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -722,9 +624,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -736,9 +636,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -750,9 +648,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -764,9 +660,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +672,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -791,9 +683,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -805,9 +695,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -819,9 +707,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -833,9 +719,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -847,9 +731,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -860,9 +742,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -874,9 +754,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -888,9 +766,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -902,9 +778,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -916,9 +790,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -930,9 +802,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -944,9 +814,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -958,9 +826,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -972,9 +838,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -986,9 +850,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -999,9 +861,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1013,9 +873,7 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1027,5 +885,3 @@ This event is generated when a DLL or driver is loaded.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/metadata/metadata.md b/custom_documentation/doc/sample_variant_1/metadata/metadata.md
index 6d4f2637e..ebee6220c 100644
--- a/custom_documentation/doc/sample_variant_1/metadata/metadata.md
+++ b/custom_documentation/doc/sample_variant_1/metadata/metadata.md
@@ -24,7 +24,9 @@ This is a relatively small state management document that includes details about
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.capabilities`
+### `Endpoint.capabilities`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.configuration.isolation`
+### `Endpoint.configuration.isolation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.status`
+### `Endpoint.policy.applied.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -114,9 +104,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -127,9 +115,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.state.isolation`
+### `Endpoint.state.isolation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -140,9 +126,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.state.tamper_protection`
+### `Endpoint.state.tamper_protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -153,9 +137,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `Endpoint.status`
+### `Endpoint.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -166,9 +148,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -180,9 +160,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -194,9 +172,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -208,9 +184,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -222,9 +196,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -236,9 +208,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -250,9 +220,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -264,9 +232,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -278,9 +244,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -292,9 +256,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -306,9 +268,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -320,9 +280,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -334,9 +292,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -348,9 +304,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -362,9 +316,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -376,9 +328,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -390,9 +340,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -403,9 +351,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -416,9 +362,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -430,9 +374,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -443,9 +385,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -456,9 +396,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -469,9 +407,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -483,9 +419,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -496,9 +430,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -510,9 +442,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -524,9 +454,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -538,9 +466,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -552,9 +478,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -566,9 +490,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -580,9 +502,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -594,9 +514,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -608,9 +526,7 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -622,5 +538,3 @@ This is a relatively small state management document that includes details about
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/metrics/metrics.md b/custom_documentation/doc/sample_variant_1/metrics/metrics.md
index ce3ffff09..1c521cd60 100644
--- a/custom_documentation/doc/sample_variant_1/metrics/metrics.md
+++ b/custom_documentation/doc/sample_variant_1/metrics/metrics.md
@@ -24,7 +24,9 @@ This is an internal state management document that includes metrics on Endpoint'
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.behavior.rtt`
+### `Endpoint.metrics.cloud_services.reputation_lookups.behavior.rtt`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.behavior.timeout_count`
+### `Endpoint.metrics.cloud_services.reputation_lookups.behavior.timeout_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.malware_score.rtt`
+### `Endpoint.metrics.cloud_services.reputation_lookups.malware_score.rtt`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.malware_score.timeout_count`
+### `Endpoint.metrics.cloud_services.reputation_lookups.malware_score.timeout_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.rtt`
+### `Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.rtt`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.timeout_count`
+### `Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.timeout_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -114,9 +104,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.ransomware.rtt`
+### `Endpoint.metrics.cloud_services.reputation_lookups.ransomware.rtt`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -127,9 +115,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.ransomware.timeout_count`
+### `Endpoint.metrics.cloud_services.reputation_lookups.ransomware.timeout_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -140,9 +126,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.rtt`
+### `Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.rtt`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -153,9 +137,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.timeout_count`
+### `Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.timeout_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -166,9 +148,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.shell_code.rtt`
+### `Endpoint.metrics.cloud_services.reputation_lookups.shell_code.rtt`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -179,9 +159,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cloud_services.reputation_lookups.shell_code.timeout_count`
+### `Endpoint.metrics.cloud_services.reputation_lookups.shell_code.timeout_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -192,9 +170,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cpu.endpoint.histogram.counts`
+### `Endpoint.metrics.cpu.endpoint.histogram.counts`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -205,9 +181,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cpu.endpoint.histogram.values`
+### `Endpoint.metrics.cpu.endpoint.histogram.values`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +192,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cpu.endpoint.latest`
+### `Endpoint.metrics.cpu.endpoint.latest`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +203,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.cpu.endpoint.mean`
+### `Endpoint.metrics.cpu.endpoint.mean`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -244,9 +214,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.disks.device`
+### `Endpoint.metrics.disks.device`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -257,9 +225,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.disks.endpoint_drive`
+### `Endpoint.metrics.disks.endpoint_drive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -270,9 +236,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.disks.free`
+### `Endpoint.metrics.disks.free`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +247,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.disks.fstype`
+### `Endpoint.metrics.disks.fstype`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -296,9 +258,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.disks.mount`
+### `Endpoint.metrics.disks.mount`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -309,9 +269,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.disks.total`
+### `Endpoint.metrics.disks.total`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -322,9 +280,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.alerts.sent_bytes`
+### `Endpoint.metrics.documents_volume.alerts.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -335,9 +291,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.alerts.sent_count`
+### `Endpoint.metrics.documents_volume.alerts.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -348,9 +302,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.alerts.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.alerts.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -361,9 +313,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.alerts.suppressed_count`
+### `Endpoint.metrics.documents_volume.alerts.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -374,9 +324,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.api_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.api_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -387,9 +335,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.api_events.sent_count`
+### `Endpoint.metrics.documents_volume.api_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -400,9 +346,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.api_events.sources.sent_bytes`
+### `Endpoint.metrics.documents_volume.api_events.sources.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -413,9 +357,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.api_events.sources.sent_count`
+### `Endpoint.metrics.documents_volume.api_events.sources.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -426,9 +368,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.api_events.sources.source`
+### `Endpoint.metrics.documents_volume.api_events.sources.source`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -439,9 +379,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -452,9 +390,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.api_events.sources.suppressed_count`
+### `Endpoint.metrics.documents_volume.api_events.sources.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -465,9 +401,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.api_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.api_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +412,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.api_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.api_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +423,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.device_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.device_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -504,9 +434,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.device_events.sent_count`
+### `Endpoint.metrics.documents_volume.device_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +445,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.device_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.device_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +456,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.device_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.device_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -543,9 +467,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes`
+### `Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -556,9 +478,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count`
+### `Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -569,9 +489,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -582,9 +500,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count`
+### `Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -595,9 +511,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.dns_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.dns_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -608,9 +522,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.dns_events.sent_count`
+### `Endpoint.metrics.documents_volume.dns_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -621,9 +533,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.dns_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.dns_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -634,9 +544,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.dns_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.dns_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -647,9 +555,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.file_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.file_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -660,9 +566,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.file_events.sent_count`
+### `Endpoint.metrics.documents_volume.file_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -673,9 +577,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.file_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.file_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -686,9 +588,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.file_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.file_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -699,9 +599,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.library_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.library_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -712,9 +610,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.library_events.sent_count`
+### `Endpoint.metrics.documents_volume.library_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +621,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.library_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.library_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -738,9 +632,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.library_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.library_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -751,9 +643,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.network_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.network_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -764,9 +654,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.network_events.sent_count`
+### `Endpoint.metrics.documents_volume.network_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -777,9 +665,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.network_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.network_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -790,9 +676,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.network_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.network_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -803,9 +687,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.overall.sent_bytes`
+### `Endpoint.metrics.documents_volume.overall.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -816,9 +698,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.overall.sent_count`
+### `Endpoint.metrics.documents_volume.overall.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -829,9 +709,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.overall.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.overall.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -842,9 +720,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.overall.suppressed_count`
+### `Endpoint.metrics.documents_volume.overall.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -855,9 +731,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.process_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.process_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -868,9 +742,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.process_events.sent_count`
+### `Endpoint.metrics.documents_volume.process_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -881,9 +753,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.process_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.process_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -894,9 +764,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.process_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.process_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -907,9 +775,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.registry_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.registry_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -920,9 +786,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.registry_events.sent_count`
+### `Endpoint.metrics.documents_volume.registry_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -933,9 +797,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.registry_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.registry_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -946,9 +808,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.registry_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.registry_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -959,9 +819,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.security_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.security_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -972,9 +830,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.security_events.sent_count`
+### `Endpoint.metrics.documents_volume.security_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -985,9 +841,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.security_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.security_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -998,9 +852,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.security_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.security_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1011,9 +863,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.volume_device_events.sent_bytes`
+### `Endpoint.metrics.documents_volume.volume_device_events.sent_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1024,9 +874,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.volume_device_events.sent_count`
+### `Endpoint.metrics.documents_volume.volume_device_events.sent_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1037,9 +885,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.volume_device_events.suppressed_bytes`
+### `Endpoint.metrics.documents_volume.volume_device_events.suppressed_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1050,9 +896,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.documents_volume.volume_device_events.suppressed_count`
+### `Endpoint.metrics.documents_volume.volume_device_events.suppressed_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1063,9 +907,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.event_filter.active_global_count`
+### `Endpoint.metrics.event_filter.active_global_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1076,9 +918,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.event_filter.active_user_count`
+### `Endpoint.metrics.event_filter.active_user_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1089,9 +929,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent`
+### `Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1102,9 +940,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.malicious_behavior_rules.id`
+### `Endpoint.metrics.malicious_behavior_rules.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1115,9 +951,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.memory.endpoint.private.latest`
+### `Endpoint.metrics.memory.endpoint.private.latest`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1128,9 +962,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.memory.endpoint.private.mean`
+### `Endpoint.metrics.memory.endpoint.private.mean`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1141,9 +973,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.amsi_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.amsi_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1154,9 +984,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.amsi_events.week_ms`
+### `Endpoint.metrics.system_impact.amsi_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1167,9 +995,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.attack_surface_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.attack_surface_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1180,9 +1006,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.attack_surface_events.week_ms`
+### `Endpoint.metrics.system_impact.attack_surface_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1193,9 +1017,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.authentication_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.authentication_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1206,9 +1028,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.authentication_events.week_ms`
+### `Endpoint.metrics.system_impact.authentication_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1219,9 +1039,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.behavior_protection.week_idle_ms`
+### `Endpoint.metrics.system_impact.behavior_protection.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1232,9 +1050,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.behavior_protection.week_ms`
+### `Endpoint.metrics.system_impact.behavior_protection.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1245,9 +1061,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.cred_access_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.cred_access_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1258,9 +1072,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.cred_access_events.week_ms`
+### `Endpoint.metrics.system_impact.cred_access_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1271,9 +1083,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_idle_ms`
+### `Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1284,9 +1094,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_ms`
+### `Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1297,9 +1105,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.dns_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.dns_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1310,9 +1116,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.dns_events.week_ms`
+### `Endpoint.metrics.system_impact.dns_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1323,9 +1127,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.file_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.file_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1336,9 +1138,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.file_events.week_ms`
+### `Endpoint.metrics.system_impact.file_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1349,9 +1149,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.kernel_api_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.kernel_api_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1362,9 +1160,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.kernel_api_events.week_ms`
+### `Endpoint.metrics.system_impact.kernel_api_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1375,9 +1171,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.library_load_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.library_load_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1388,9 +1182,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.library_load_events.week_ms`
+### `Endpoint.metrics.system_impact.library_load_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1401,9 +1193,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.malware.week_idle_ms`
+### `Endpoint.metrics.system_impact.malware.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1414,9 +1204,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.malware.week_ms`
+### `Endpoint.metrics.system_impact.malware.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1427,9 +1215,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.memory_scan.week_idle_ms`
+### `Endpoint.metrics.system_impact.memory_scan.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1440,9 +1226,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.memory_scan.week_ms`
+### `Endpoint.metrics.system_impact.memory_scan.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1453,9 +1237,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.network_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.network_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1466,9 +1248,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.network_events.week_ms`
+### `Endpoint.metrics.system_impact.network_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1479,9 +1259,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.overall.week_idle_ms`
+### `Endpoint.metrics.system_impact.overall.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1492,9 +1270,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.overall.week_ms`
+### `Endpoint.metrics.system_impact.overall.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1505,9 +1281,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process.code_signature.exists`
+### `Endpoint.metrics.system_impact.process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1519,9 +1293,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process.code_signature.signing_id`
+### `Endpoint.metrics.system_impact.process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1533,9 +1305,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process.code_signature.status`
+### `Endpoint.metrics.system_impact.process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1547,9 +1317,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process.code_signature.subject_name`
+### `Endpoint.metrics.system_impact.process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1561,9 +1329,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process.code_signature.team_id`
+### `Endpoint.metrics.system_impact.process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1575,9 +1341,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process.code_signature.trusted`
+### `Endpoint.metrics.system_impact.process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1589,9 +1353,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process.executable`
+### `Endpoint.metrics.system_impact.process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1602,9 +1364,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.process_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1615,9 +1375,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process_events.week_ms`
+### `Endpoint.metrics.system_impact.process_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1628,9 +1386,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process_injection.week_idle_ms`
+### `Endpoint.metrics.system_impact.process_injection.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1641,9 +1397,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.process_injection.week_ms`
+### `Endpoint.metrics.system_impact.process_injection.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1654,9 +1408,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.ransomware.week_idle_ms`
+### `Endpoint.metrics.system_impact.ransomware.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1667,9 +1419,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.ransomware.week_ms`
+### `Endpoint.metrics.system_impact.ransomware.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1680,9 +1430,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.registry_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.registry_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1693,9 +1441,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.registry_events.week_ms`
+### `Endpoint.metrics.system_impact.registry_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1706,9 +1452,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.tcpip_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.tcpip_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1719,9 +1463,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.tcpip_events.week_ms`
+### `Endpoint.metrics.system_impact.tcpip_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1732,9 +1474,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1745,9 +1485,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.threat_intelligence_events.week_ms`
+### `Endpoint.metrics.system_impact.threat_intelligence_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1758,9 +1496,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.volume_device_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.volume_device_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1771,9 +1507,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.volume_device_events.week_ms`
+### `Endpoint.metrics.system_impact.volume_device_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1784,9 +1518,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.win32k_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.win32k_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1797,9 +1529,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.win32k_events.week_ms`
+### `Endpoint.metrics.system_impact.win32k_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1810,9 +1540,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.wmi_events.week_idle_ms`
+### `Endpoint.metrics.system_impact.wmi_events.week_idle_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1823,9 +1551,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.system_impact.wmi_events.week_ms`
+### `Endpoint.metrics.system_impact.wmi_events.week_ms`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1836,9 +1562,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.threads.cpu.mean`
+### `Endpoint.metrics.threads.cpu.mean`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1849,9 +1573,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.threads.name`
+### `Endpoint.metrics.threads.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1862,9 +1584,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.top_process_trees.values.event_count`
+### `Endpoint.metrics.top_process_trees.values.event_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1875,9 +1595,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.top_process_trees.values.last_seen`
+### `Endpoint.metrics.top_process_trees.values.last_seen`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1888,9 +1606,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.top_process_trees.values.sample.command_line`
+### `Endpoint.metrics.top_process_trees.values.sample.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1901,9 +1617,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.top_process_trees.values.sample.entity_id`
+### `Endpoint.metrics.top_process_trees.values.sample.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1914,9 +1628,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.top_process_trees.values.sample.executable`
+### `Endpoint.metrics.top_process_trees.values.sample.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1927,9 +1639,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.top_process_trees.values.sample.parent_command_line`
+### `Endpoint.metrics.top_process_trees.values.sample.parent_command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1940,9 +1650,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.top_process_trees.window_end`
+### `Endpoint.metrics.top_process_trees.window_end`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1953,9 +1661,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.top_process_trees.window_start`
+### `Endpoint.metrics.top_process_trees.window_start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1966,9 +1672,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.uptime.endpoint`
+### `Endpoint.metrics.uptime.endpoint`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1979,9 +1683,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `Endpoint.metrics.uptime.system`
+### `Endpoint.metrics.uptime.system`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1992,9 +1694,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2006,9 +1706,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2020,9 +1718,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2034,9 +1730,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2048,9 +1742,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2062,9 +1754,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2076,9 +1766,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2090,9 +1778,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2104,9 +1790,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2118,9 +1802,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2132,9 +1814,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2146,9 +1826,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2160,9 +1838,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2174,9 +1850,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2188,9 +1862,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2202,9 +1874,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2216,9 +1886,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2229,9 +1897,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2242,9 +1908,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2256,9 +1920,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2269,9 +1931,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2282,9 +1942,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2295,9 +1953,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2309,9 +1965,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2322,9 +1976,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2336,9 +1988,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2350,9 +2000,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2364,9 +2012,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2378,9 +2024,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2392,9 +2036,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2406,9 +2048,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2420,9 +2060,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2434,9 +2072,7 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2448,5 +2084,3 @@ This is an internal state management document that includes metrics on Endpoint'
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md
index ff068858c..d4c1f8c37 100644
--- a/custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md
+++ b/custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md
@@ -24,7 +24,9 @@ This event is generated when a network session is accepted, attempted or termina
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `destination.address`
+### `destination.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `destination.bytes`
+### `destination.bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `destination.ip`
+### `destination.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `destination.port`
+### `destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -201,9 +179,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -215,9 +191,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -229,9 +203,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -243,9 +215,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -257,9 +227,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +239,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -285,9 +251,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +308,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -365,9 +319,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -378,9 +330,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -391,9 +341,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -405,9 +353,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -418,9 +364,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -431,9 +375,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -444,9 +386,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -458,9 +398,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -471,9 +409,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -485,9 +421,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +433,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -513,9 +445,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -527,9 +457,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -541,9 +469,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -555,9 +481,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -569,9 +493,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -583,9 +505,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -597,9 +517,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `network.direction`
+### `network.direction`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -611,9 +529,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `network.transport`
+### `network.transport`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -625,9 +541,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `network.type`
+### `network.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -639,9 +553,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -652,9 +564,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -666,9 +576,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -680,9 +588,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -694,9 +600,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -708,9 +612,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -722,9 +624,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -736,9 +636,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -750,9 +648,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -764,9 +660,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +672,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -792,9 +684,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.effective`
+### `process.thread.capabilities.effective`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -806,9 +696,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.permitted`
+### `process.thread.capabilities.permitted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `source.address`
+### `source.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -847,9 +731,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `source.bytes`
+### `source.bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -861,9 +743,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `source.ip`
+### `source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -874,9 +754,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `source.port`
+### `source.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -887,9 +765,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -900,9 +776,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -913,9 +787,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -926,9 +798,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -940,9 +810,7 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -954,5 +822,3 @@ This event is generated when a network session is accepted, attempted or termina
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md b/custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md
index 97a50073a..2c1ebe4aa 100644
--- a/custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md
+++ b/custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md
@@ -23,7 +23,9 @@ This event is generated when results are returned for a DNS lookup request.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `destination.address`
+### `destination.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `destination.ip`
+### `destination.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -145,9 +131,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `destination.port`
+### `destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -158,9 +142,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.question.name`
+### `dns.question.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -172,9 +154,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.question.type`
+### `dns.question.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -186,9 +166,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.resolved_ip`
+### `dns.resolved_ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -200,9 +178,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -214,9 +190,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -228,9 +202,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -242,9 +214,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -256,9 +226,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -270,9 +238,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -284,9 +250,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -298,9 +262,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -312,9 +274,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -392,9 +342,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -405,9 +353,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -418,9 +364,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -431,9 +375,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -444,9 +386,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -458,9 +398,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +410,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `network.protocol`
+### `network.protocol`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -486,9 +422,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `network.transport`
+### `network.transport`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -500,9 +434,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -513,9 +445,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -527,9 +457,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -541,9 +469,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -555,9 +481,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -569,9 +493,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -583,9 +505,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -597,9 +517,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.effective`
+### `process.thread.capabilities.effective`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -611,9 +529,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.permitted`
+### `process.thread.capabilities.permitted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -625,9 +541,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `source.address`
+### `source.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -638,9 +552,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `source.ip`
+### `source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -651,9 +563,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `source.port`
+### `source.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -664,9 +574,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -677,9 +585,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -690,9 +596,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -704,9 +608,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -718,5 +620,3 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md b/custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md
index 134ed9c6e..3247bdfb4 100644
--- a/custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md
+++ b/custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md
@@ -24,7 +24,9 @@ This event is generated when a connection is attempted or a request to terminate
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `destination.address`
+### `destination.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `destination.bytes`
+### `destination.bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `destination.domain`
+### `destination.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `destination.ip`
+### `destination.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -174,9 +156,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `destination.port`
+### `destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -201,9 +179,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -215,9 +191,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -229,9 +203,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -243,9 +215,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -257,9 +227,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +239,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -285,9 +251,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -327,9 +287,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -392,9 +342,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -405,9 +353,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -419,9 +365,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -432,9 +376,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -445,9 +387,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -458,9 +398,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +410,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -485,9 +421,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +433,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -513,9 +445,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -527,9 +457,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -541,9 +469,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -555,9 +481,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -569,9 +493,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -583,9 +505,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -597,9 +517,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -611,9 +529,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `network.transport`
+### `network.transport`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -625,9 +541,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `network.type`
+### `network.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -639,9 +553,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -652,9 +564,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -666,9 +576,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -680,9 +588,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -694,9 +600,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -708,9 +612,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -722,9 +624,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -736,9 +636,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -750,9 +648,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -764,9 +660,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +672,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -792,9 +684,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -806,9 +696,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `source.address`
+### `source.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -833,9 +719,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `source.bytes`
+### `source.bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -847,9 +731,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `source.ip`
+### `source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -860,9 +742,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `source.port`
+### `source.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -873,9 +753,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -886,9 +764,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -899,9 +775,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -913,9 +787,7 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -927,5 +799,3 @@ This event is generated when a connection is attempted or a request to terminate
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md b/custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md
index fc90dc694..f33250493 100644
--- a/custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md
+++ b/custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md
@@ -24,7 +24,9 @@ This event is generated when results are returned for a DNS lookup request.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `destination.address`
+### `destination.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `destination.ip`
+### `destination.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `destination.port`
+### `destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -159,9 +143,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.Ext.options`
+### `dns.Ext.options`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -172,9 +154,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.Ext.status`
+### `dns.Ext.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -185,9 +165,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.question.name`
+### `dns.question.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -199,9 +177,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.question.type`
+### `dns.question.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -213,9 +189,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.resolved_ip`
+### `dns.resolved_ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -227,9 +201,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -241,9 +213,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -255,9 +225,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -269,9 +237,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +249,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +261,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -311,9 +273,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -419,9 +365,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -432,9 +376,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -445,9 +387,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +410,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -485,9 +421,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -498,9 +432,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -512,9 +444,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -525,9 +455,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -539,9 +467,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -553,9 +479,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -567,9 +491,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -581,9 +503,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -595,9 +515,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -609,9 +527,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -623,9 +539,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -637,9 +551,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -651,9 +563,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `network.protocol`
+### `network.protocol`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +575,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `network.transport`
+### `network.transport`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +587,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `network.type`
+### `network.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -693,9 +599,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -706,9 +610,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -720,9 +622,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -734,9 +634,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -748,9 +646,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -762,9 +658,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -776,9 +670,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -790,9 +682,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -804,9 +694,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -818,9 +706,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -832,9 +718,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -846,9 +730,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -860,9 +742,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -874,9 +754,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `source.address`
+### `source.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -887,9 +765,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `source.ip`
+### `source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -900,9 +776,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `source.port`
+### `source.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -913,9 +787,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -926,9 +798,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -939,9 +809,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -953,9 +821,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -967,5 +833,3 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md
index d2ffedc25..5718edec4 100644
--- a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md
+++ b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md
@@ -24,7 +24,9 @@ This event is generated when a connection is attempted, a connection is accepted
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `destination.address`
+### `destination.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `destination.bytes`
+### `destination.bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `destination.ip`
+### `destination.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `destination.port`
+### `destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -201,9 +179,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -215,9 +191,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -229,9 +203,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -243,9 +215,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -257,9 +227,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +239,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -285,9 +251,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -392,9 +342,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -419,9 +365,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -461,9 +401,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -475,9 +413,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -489,9 +425,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -531,9 +461,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `network.direction`
+### `network.direction`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `network.transport`
+### `network.transport`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -573,9 +497,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `network.type`
+### `network.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -600,9 +520,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +544,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -670,9 +580,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -684,9 +592,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -698,9 +604,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -712,9 +616,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -726,9 +628,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -740,9 +640,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -754,9 +652,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -768,9 +664,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `process.uptime`
+### `process.uptime`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -782,9 +676,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `source.address`
+### `source.address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -795,9 +687,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `source.bytes`
+### `source.bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -809,9 +699,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `source.ip`
+### `source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -822,9 +710,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `source.port`
+### `source.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -835,9 +721,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +732,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +744,7 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,5 +756,3 @@ This event is generated when a connection is attempted, a connection is accepted
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md
index 94098b9e8..26904d43a 100644
--- a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md
+++ b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md
@@ -24,7 +24,9 @@ This event is generated when a DNS lookup request is initiated.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `destination.port`
+### `destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `dns.Ext.options`
+### `dns.Ext.options`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `dns.Ext.status`
+### `dns.Ext.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -159,9 +143,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `dns.question.name`
+### `dns.question.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -201,9 +179,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -215,9 +191,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -229,9 +203,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -243,9 +215,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -257,9 +227,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +239,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -285,9 +251,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -379,9 +331,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -392,9 +342,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -419,9 +365,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -461,9 +401,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -475,9 +413,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -489,9 +425,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -531,9 +461,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `network.destination.port`
+### `network.destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -558,9 +484,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `network.protocol`
+### `network.protocol`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -585,9 +507,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -599,9 +519,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -613,9 +531,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +555,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -655,9 +567,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +639,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +651,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -766,9 +662,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -780,9 +674,7 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -794,5 +686,3 @@ This event is generated when a DNS lookup request is initiated.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md
index a05dc7ab2..d4f4ab234 100644
--- a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md
+++ b/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md
@@ -24,7 +24,9 @@ This event is generated when results are returned for a DNS lookup request.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `destination.port`
+### `destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.Ext.options`
+### `dns.Ext.options`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.Ext.status`
+### `dns.Ext.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -159,9 +143,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.question.name`
+### `dns.question.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `dns.resolved_ip`
+### `dns.resolved_ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -201,9 +179,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -215,9 +191,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -229,9 +203,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -243,9 +215,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -257,9 +227,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +239,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -285,9 +251,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -327,9 +287,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -406,9 +354,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -461,9 +401,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -475,9 +413,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -489,9 +425,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -503,9 +437,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -517,9 +449,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -531,9 +461,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `network.destination.port`
+### `network.destination.port`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `network.protocol`
+### `network.protocol`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -586,9 +508,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -599,9 +519,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -613,9 +531,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +555,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -655,9 +567,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -739,9 +639,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +651,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -780,9 +674,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -794,9 +686,7 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -808,5 +698,3 @@ This event is generated when results are returned for a DNS lookup request.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/policy/policy_response.md b/custom_documentation/doc/sample_variant_1/policy/policy_response.md
index bc246ffed..5a482ae23 100644
--- a/custom_documentation/doc/sample_variant_1/policy/policy_response.md
+++ b/custom_documentation/doc/sample_variant_1/policy/policy_response.md
@@ -24,7 +24,9 @@ This is a state management document that is generated every time Endpoint refres
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.configuration.isolation`
+### `Endpoint.configuration.isolation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.actions.message`
+### `Endpoint.policy.applied.actions.message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -62,9 +60,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.actions.name`
+### `Endpoint.policy.applied.actions.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -75,9 +71,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.actions.status`
+### `Endpoint.policy.applied.actions.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -88,9 +82,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.actions.status`
+### `Endpoint.policy.applied.actions.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -101,9 +93,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.channel`
+### `Endpoint.policy.applied.artifacts.global.channel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -115,9 +105,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.name`
+### `Endpoint.policy.applied.artifacts.global.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -128,9 +116,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -141,9 +127,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.snapshot`
+### `Endpoint.policy.applied.artifacts.global.snapshot`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -154,9 +138,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.update_age`
+### `Endpoint.policy.applied.artifacts.global.update_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -167,9 +149,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.global.version`
+### `Endpoint.policy.applied.artifacts.global.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -180,9 +160,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.name`
+### `Endpoint.policy.applied.artifacts.user.identifiers.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -193,9 +171,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
+### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -206,9 +182,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.artifacts.user.version`
+### `Endpoint.policy.applied.artifacts.user.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -219,9 +193,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.endpoint_policy_version`
+### `Endpoint.policy.applied.endpoint_policy_version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +204,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.id`
+### `Endpoint.policy.applied.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +215,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.name`
+### `Endpoint.policy.applied.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -258,9 +226,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -271,9 +237,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.antivirus_registration.status`
+### `Endpoint.policy.applied.response.configurations.antivirus_registration.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -284,9 +248,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +259,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.attack_surface_reduction.status`
+### `Endpoint.policy.applied.response.configurations.attack_surface_reduction.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -310,9 +270,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -323,9 +281,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.behavior_protection.status`
+### `Endpoint.policy.applied.response.configurations.behavior_protection.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -336,9 +292,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.events.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.events.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -349,9 +303,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.events.status`
+### `Endpoint.policy.applied.response.configurations.events.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -362,9 +314,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -375,9 +325,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.host_isolation.status`
+### `Endpoint.policy.applied.response.configurations.host_isolation.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -388,9 +336,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.logging.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.logging.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -401,9 +347,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.logging.status`
+### `Endpoint.policy.applied.response.configurations.logging.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -414,9 +358,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.malware.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.malware.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -427,9 +369,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.malware.status`
+### `Endpoint.policy.applied.response.configurations.malware.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -440,9 +380,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -453,9 +391,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.memory_protection.status`
+### `Endpoint.policy.applied.response.configurations.memory_protection.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -466,9 +402,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.ransomware.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.ransomware.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -479,9 +413,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.ransomware.status`
+### `Endpoint.policy.applied.response.configurations.ransomware.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -492,9 +424,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.response_actions.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.response_actions.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +435,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.response_actions.status`
+### `Endpoint.policy.applied.response.configurations.response_actions.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +446,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.streaming.concerned_actions`
+### `Endpoint.policy.applied.response.configurations.streaming.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -531,9 +457,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.configurations.streaming.status`
+### `Endpoint.policy.applied.response.configurations.streaming.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +468,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions`
+### `Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +479,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.diagnostic.behavior_protection.status`
+### `Endpoint.policy.applied.response.diagnostic.behavior_protection.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -570,9 +490,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.diagnostic.malware.concerned_actions`
+### `Endpoint.policy.applied.response.diagnostic.malware.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -583,9 +501,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.diagnostic.malware.status`
+### `Endpoint.policy.applied.response.diagnostic.malware.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -596,9 +512,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions`
+### `Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -609,9 +523,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.diagnostic.memory_protection.status`
+### `Endpoint.policy.applied.response.diagnostic.memory_protection.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -622,9 +534,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions`
+### `Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -635,9 +545,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.response.diagnostic.ransomware.status`
+### `Endpoint.policy.applied.response.diagnostic.ransomware.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -648,9 +556,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.status`
+### `Endpoint.policy.applied.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -661,9 +567,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.policy.applied.version`
+### `Endpoint.policy.applied.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -674,9 +578,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.state.isolation`
+### `Endpoint.state.isolation`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -687,9 +589,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `Endpoint.state.tamper_protection`
+### `Endpoint.state.tamper_protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -700,9 +600,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `agent.build.original`
+### `agent.build.original`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -714,9 +612,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -728,9 +624,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -742,9 +636,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -756,9 +648,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -770,9 +660,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -784,9 +672,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -798,9 +684,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -812,9 +696,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -826,9 +708,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -840,9 +720,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -854,9 +732,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -868,9 +744,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -882,9 +756,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -896,9 +768,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -910,9 +780,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -924,9 +792,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -937,9 +803,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -950,9 +814,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -964,9 +826,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -977,9 +837,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -990,9 +848,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1003,9 +859,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1017,9 +871,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1030,9 +882,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1044,9 +894,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1058,9 +906,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1072,9 +918,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1086,9 +930,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1100,9 +942,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1114,9 +954,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1128,9 +966,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1142,9 +978,7 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1156,5 +990,3 @@ This is a state management document that is generated every time Endpoint refres
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md
index 2be70b01a..83765000e 100644
--- a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md
@@ -24,7 +24,9 @@ This event is generated for a process that was already running before Endpoint's
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `cloud.account.id`
+### `cloud.account.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -174,9 +156,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -200,9 +178,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -213,9 +189,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -227,9 +201,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -241,9 +213,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -255,9 +225,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -269,9 +237,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +249,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +261,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -311,9 +273,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -460,9 +400,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -487,9 +423,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -500,9 +434,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -513,9 +445,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -526,9 +456,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -540,9 +468,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -553,9 +479,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -567,9 +491,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -581,9 +503,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -595,9 +515,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -609,9 +527,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -623,9 +539,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -637,9 +551,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -651,9 +563,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +575,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +587,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,9 +598,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -705,9 +609,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -719,9 +621,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -732,9 +632,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -746,9 +644,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -760,9 +656,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -774,9 +668,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -787,9 +679,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted`
+### `process.Ext.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -800,9 +690,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -814,9 +702,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -828,9 +714,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -842,9 +726,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -855,9 +737,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -869,9 +749,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -883,9 +761,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -897,9 +773,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -911,9 +785,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -924,9 +796,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -937,9 +807,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -951,9 +819,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -964,9 +830,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -977,9 +841,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -991,9 +853,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1005,9 +865,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1019,9 +877,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1033,9 +889,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1047,9 +901,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1061,9 +913,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1074,9 +924,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1087,9 +935,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1101,9 +947,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1115,9 +959,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1129,9 +971,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1143,9 +983,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1156,9 +994,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1169,9 +1005,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1183,9 +1017,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1197,9 +1029,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1211,9 +1041,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1225,9 +1053,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1239,9 +1065,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1253,9 +1077,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1266,9 +1088,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1279,9 +1099,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1293,9 +1111,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1307,9 +1123,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1321,9 +1135,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1335,9 +1147,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1348,9 +1158,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1361,9 +1169,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1375,9 +1181,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1389,9 +1193,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1403,9 +1205,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1416,9 +1216,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1429,9 +1227,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1443,9 +1239,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1457,9 +1251,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1471,9 +1263,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1485,9 +1275,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1498,9 +1286,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1511,9 +1297,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1525,9 +1309,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1539,9 +1321,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1553,9 +1333,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1567,9 +1345,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1581,9 +1357,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1594,9 +1368,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1607,9 +1379,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1620,9 +1390,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1634,9 +1402,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1648,9 +1414,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1662,9 +1426,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1676,9 +1438,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1690,9 +1450,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1703,9 +1461,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1717,9 +1473,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1731,9 +1485,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1744,9 +1496,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1757,9 +1507,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1771,9 +1519,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1785,9 +1531,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1799,9 +1543,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1812,9 +1554,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1825,9 +1565,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1839,9 +1577,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1853,9 +1589,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1867,9 +1601,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1880,9 +1612,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1893,9 +1623,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1907,9 +1635,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1921,9 +1647,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1935,9 +1659,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1949,9 +1671,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1963,9 +1683,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1977,9 +1695,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1991,9 +1707,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2005,9 +1719,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2019,9 +1731,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2032,9 +1742,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2045,9 +1753,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2059,9 +1765,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2073,9 +1777,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2087,9 +1789,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2101,9 +1801,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2115,9 +1813,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2129,9 +1825,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2142,9 +1836,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2155,9 +1847,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2169,9 +1859,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2183,9 +1871,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2197,9 +1883,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2210,9 +1894,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2223,9 +1905,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2237,9 +1917,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2251,9 +1929,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2265,9 +1941,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2279,9 +1953,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2292,9 +1964,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2305,9 +1975,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2319,9 +1987,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2333,9 +1999,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2347,9 +2011,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2361,9 +2023,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2375,9 +2035,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2389,9 +2047,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2402,9 +2058,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2415,9 +2069,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.effective`
+### `process.thread.capabilities.effective`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2429,9 +2081,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.permitted`
+### `process.thread.capabilities.permitted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2443,9 +2093,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.major`
+### `process.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2457,9 +2105,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.minor`
+### `process.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2471,9 +2117,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2485,9 +2129,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2499,9 +2141,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2513,9 +2153,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2526,9 +2164,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2539,9 +2175,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2553,9 +2187,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2567,5 +2199,3 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md
index 2af06a408..a196ada1a 100644
--- a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md
@@ -24,7 +24,9 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `cloud.account.id`
+### `cloud.account.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -174,9 +156,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -200,9 +178,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -213,9 +189,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -227,9 +201,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -241,9 +213,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -255,9 +225,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -269,9 +237,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +249,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +261,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -311,9 +273,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -460,9 +400,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -487,9 +423,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -500,9 +434,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -513,9 +445,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -526,9 +456,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -540,9 +468,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -553,9 +479,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -567,9 +491,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -581,9 +503,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -595,9 +515,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -609,9 +527,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -623,9 +539,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -637,9 +551,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -651,9 +563,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +575,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +587,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,9 +598,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -705,9 +609,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -719,9 +621,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -732,9 +632,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -746,9 +644,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -760,9 +656,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -774,9 +668,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -787,9 +679,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted`
+### `process.Ext.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -800,9 +690,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted_descendant`
+### `process.Ext.trusted_descendant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -813,9 +701,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -827,9 +713,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -841,9 +725,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -855,9 +737,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -868,9 +748,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.end`
+### `process.end`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -882,9 +760,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -896,9 +772,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -910,9 +784,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -924,9 +796,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -938,9 +808,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -951,9 +819,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -964,9 +830,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -978,9 +842,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -991,9 +853,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1004,9 +864,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1018,9 +876,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1032,9 +888,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1046,9 +900,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1060,9 +912,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1074,9 +924,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1088,9 +936,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1101,9 +947,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1114,9 +958,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1128,9 +970,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1142,9 +982,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1156,9 +994,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1170,9 +1006,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1183,9 +1017,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1196,9 +1028,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1210,9 +1040,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1224,9 +1052,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1238,9 +1064,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1252,9 +1076,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1266,9 +1088,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.env_vars`
+### `process.env_vars`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1280,9 +1100,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1294,9 +1112,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.exit_code`
+### `process.exit_code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1308,9 +1124,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1321,9 +1135,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1334,9 +1146,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1348,9 +1158,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1362,9 +1170,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1376,9 +1182,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1390,9 +1194,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1403,9 +1205,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1416,9 +1216,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1430,9 +1228,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1444,9 +1240,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1458,9 +1252,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1471,9 +1263,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1484,9 +1274,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1498,9 +1286,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1512,9 +1298,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1526,9 +1310,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1540,9 +1322,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1553,9 +1333,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1566,9 +1344,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1580,9 +1356,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1594,9 +1368,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1608,9 +1380,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1622,9 +1392,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1636,9 +1404,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1649,9 +1415,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1662,9 +1426,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1675,9 +1437,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1689,9 +1449,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1703,9 +1461,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1717,9 +1473,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1731,9 +1485,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1745,9 +1497,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1758,9 +1508,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1772,9 +1520,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1786,9 +1532,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1799,9 +1543,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1812,9 +1554,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1826,9 +1566,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1840,9 +1578,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1854,9 +1590,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1867,9 +1601,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1880,9 +1612,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1894,9 +1624,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1908,9 +1636,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1922,9 +1648,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1935,9 +1659,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1948,9 +1670,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1962,9 +1682,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1976,9 +1694,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1990,9 +1706,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2004,9 +1718,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2018,9 +1730,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2032,9 +1742,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2046,9 +1754,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2060,9 +1766,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2074,9 +1778,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2087,9 +1789,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2100,9 +1800,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2114,9 +1812,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2128,9 +1824,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2142,9 +1836,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2156,9 +1848,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2170,9 +1860,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2184,9 +1872,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2197,9 +1883,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2210,9 +1894,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2224,9 +1906,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2238,9 +1918,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2252,9 +1930,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2265,9 +1941,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2278,9 +1952,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2292,9 +1964,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2306,9 +1976,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2320,9 +1988,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2334,9 +2000,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2347,9 +2011,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2360,9 +2022,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2374,9 +2034,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2388,9 +2046,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2402,9 +2058,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2416,9 +2070,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2430,9 +2082,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2444,9 +2094,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2457,9 +2105,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2470,9 +2116,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.effective`
+### `process.thread.capabilities.effective`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2484,9 +2128,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.permitted`
+### `process.thread.capabilities.permitted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2498,9 +2140,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.major`
+### `process.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2512,9 +2152,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.minor`
+### `process.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2526,9 +2164,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2540,9 +2176,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2554,9 +2188,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2568,9 +2200,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2581,9 +2211,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2594,9 +2222,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2608,9 +2234,7 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2622,5 +2246,3 @@ This event is generated when a process calls `fork()`, `exec()`, exits, or an ag
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md
index cf734c6b2..0832743c8 100644
--- a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md
@@ -24,7 +24,9 @@ This event is generated when the group id changes for a process.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.account.id`
+### `cloud.account.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -174,9 +156,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -200,9 +178,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -213,9 +189,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -227,9 +201,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -241,9 +213,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -255,9 +225,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -269,9 +237,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +249,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +261,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -311,9 +273,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -460,9 +400,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -487,9 +423,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -500,9 +434,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -513,9 +445,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -526,9 +456,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -540,9 +468,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -553,9 +479,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -567,9 +491,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -581,9 +503,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -595,9 +515,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -609,9 +527,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -623,9 +539,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -637,9 +551,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -651,9 +563,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +575,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +587,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,9 +598,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -705,9 +609,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -719,9 +621,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -732,9 +632,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -746,9 +644,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -760,9 +656,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -774,9 +668,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -787,9 +679,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted_descendant`
+### `process.Ext.trusted_descendant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -800,9 +690,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -814,9 +702,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -828,9 +714,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -842,9 +726,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -855,9 +737,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.end`
+### `process.end`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -869,9 +749,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -883,9 +761,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -897,9 +773,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -911,9 +785,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -925,9 +797,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -938,9 +808,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -951,9 +819,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -965,9 +831,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -978,9 +842,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -991,9 +853,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1005,9 +865,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1019,9 +877,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1033,9 +889,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1047,9 +901,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1061,9 +913,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1075,9 +925,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1088,9 +936,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1101,9 +947,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1115,9 +959,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1129,9 +971,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1143,9 +983,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1157,9 +995,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1170,9 +1006,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1183,9 +1017,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1197,9 +1029,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1211,9 +1041,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1225,9 +1053,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1239,9 +1065,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1253,9 +1077,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1267,9 +1089,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.exit_code`
+### `process.exit_code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1281,9 +1101,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1294,9 +1112,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1307,9 +1123,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1321,9 +1135,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1335,9 +1147,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1349,9 +1159,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1363,9 +1171,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1376,9 +1182,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1389,9 +1193,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1403,9 +1205,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1417,9 +1217,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1431,9 +1229,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1444,9 +1240,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1457,9 +1251,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1471,9 +1263,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1485,9 +1275,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1499,9 +1287,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1513,9 +1299,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1526,9 +1310,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1539,9 +1321,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1553,9 +1333,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1567,9 +1345,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1581,9 +1357,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1595,9 +1369,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1609,9 +1381,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1622,9 +1392,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1635,9 +1403,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1648,9 +1414,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1662,9 +1426,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1676,9 +1438,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1690,9 +1450,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1704,9 +1462,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1718,9 +1474,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1731,9 +1485,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1745,9 +1497,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1759,9 +1509,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1772,9 +1520,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1785,9 +1531,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1799,9 +1543,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1813,9 +1555,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1827,9 +1567,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1840,9 +1578,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1853,9 +1589,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1867,9 +1601,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1881,9 +1613,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1895,9 +1625,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1908,9 +1636,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1921,9 +1647,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1935,9 +1659,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1949,9 +1671,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1963,9 +1683,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1977,9 +1695,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1991,9 +1707,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2005,9 +1719,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2019,9 +1731,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2033,9 +1743,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2047,9 +1755,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2060,9 +1766,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2073,9 +1777,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2087,9 +1789,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2101,9 +1801,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2115,9 +1813,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2129,9 +1825,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2143,9 +1837,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2157,9 +1849,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2170,9 +1860,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2183,9 +1871,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2197,9 +1883,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2211,9 +1895,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2225,9 +1907,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2238,9 +1918,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2251,9 +1929,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2265,9 +1941,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2279,9 +1953,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2293,9 +1965,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2307,9 +1977,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2320,9 +1988,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2333,9 +1999,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2347,9 +2011,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2361,9 +2023,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2375,9 +2035,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2389,9 +2047,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2403,9 +2059,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2417,9 +2071,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2430,9 +2082,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2443,9 +2093,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.effective`
+### `process.thread.capabilities.effective`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2457,9 +2105,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.permitted`
+### `process.thread.capabilities.permitted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2471,9 +2117,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.major`
+### `process.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2485,9 +2129,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.minor`
+### `process.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2499,9 +2141,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2513,9 +2153,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2527,9 +2165,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2541,9 +2177,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2554,9 +2188,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2567,9 +2199,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2581,9 +2211,7 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2595,5 +2223,3 @@ This event is generated when the group id changes for a process.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md
index c647c4a15..2e0636889 100644
--- a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md
@@ -23,7 +23,9 @@ This event is generated when when a memfd anonymous file is created.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `cloud.account.id`
+### `cloud.account.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -104,9 +96,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -159,9 +143,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -186,9 +166,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -199,9 +177,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -212,9 +188,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -226,9 +200,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -240,9 +212,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -254,9 +224,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -268,9 +236,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -282,9 +248,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -296,9 +260,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -310,9 +272,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -324,9 +284,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +308,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +410,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -486,9 +422,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +433,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -512,9 +444,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -525,9 +455,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -539,9 +467,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -552,9 +478,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -566,9 +490,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -580,9 +502,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -594,9 +514,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -608,9 +526,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -622,9 +538,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -636,9 +550,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -650,9 +562,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -664,9 +574,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -678,9 +586,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -691,9 +597,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -704,9 +608,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -718,9 +620,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -731,9 +631,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -745,9 +643,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -759,9 +655,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -773,9 +667,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -786,9 +678,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted`
+### `process.Ext.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -799,9 +689,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted_descendant`
+### `process.Ext.trusted_descendant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -812,9 +700,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memfd.flag_hugetlb`
+### `process.Ext.memfd.flag_hugetlb`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -826,9 +712,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memfd.flag_allow_seal`
+### `process.Ext.memfd.flag_allow_seal`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -840,9 +724,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memfd.flags`
+### `process.Ext.memfd.flags`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -854,9 +736,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memfd.name`
+### `process.Ext.memfd.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -868,9 +748,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memfd.flag_exec`
+### `process.Ext.memfd.flag_exec`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -882,9 +760,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memfd.flag_cloexec`
+### `process.Ext.memfd.flag_cloexec`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -896,9 +772,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.memfd.flag_noexec_seal`
+### `process.Ext.memfd.flag_noexec_seal`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -910,9 +784,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -924,9 +796,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -938,9 +808,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -952,9 +820,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -965,9 +831,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.end`
+### `process.end`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -979,9 +843,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -993,9 +855,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1007,9 +867,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1021,9 +879,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1035,9 +891,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1048,9 +902,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1061,9 +913,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1075,9 +925,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1088,9 +936,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1101,9 +947,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1115,9 +959,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1129,9 +971,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1143,9 +983,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1157,9 +995,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1171,9 +1007,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1185,9 +1019,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1198,9 +1030,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1211,9 +1041,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1225,9 +1053,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1239,9 +1065,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1253,9 +1077,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1267,9 +1089,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1280,9 +1100,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1293,9 +1111,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1307,9 +1123,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1321,9 +1135,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1335,9 +1147,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1349,9 +1159,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1363,9 +1171,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1377,9 +1183,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.exit_code`
+### `process.exit_code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1391,9 +1195,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1404,9 +1206,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1417,9 +1217,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1431,9 +1229,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1445,9 +1241,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1459,9 +1253,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1473,9 +1265,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1486,9 +1276,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1499,9 +1287,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1513,9 +1299,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1527,9 +1311,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1541,9 +1323,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1554,9 +1334,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1567,9 +1345,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1581,9 +1357,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1595,9 +1369,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1609,9 +1381,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1623,9 +1393,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1636,9 +1404,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1649,9 +1415,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1663,9 +1427,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1677,9 +1439,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1691,9 +1451,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1705,9 +1463,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1719,9 +1475,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1732,9 +1486,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1745,9 +1497,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1758,9 +1508,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1772,9 +1520,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1786,9 +1532,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1800,9 +1544,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1814,9 +1556,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1828,9 +1568,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1841,9 +1579,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1855,9 +1591,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1869,9 +1603,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1882,9 +1614,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1895,9 +1625,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1909,9 +1637,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1923,9 +1649,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1937,9 +1661,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1950,9 +1672,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1963,9 +1683,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1977,9 +1695,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1991,9 +1707,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2005,9 +1719,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2018,9 +1730,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2031,9 +1741,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2045,9 +1753,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2059,9 +1765,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2073,9 +1777,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2087,9 +1789,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2101,9 +1801,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2115,9 +1813,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2129,9 +1825,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2143,9 +1837,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2157,9 +1849,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2170,9 +1860,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2183,9 +1871,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2197,9 +1883,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2211,9 +1895,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2225,9 +1907,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2239,9 +1919,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2253,9 +1931,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2267,9 +1943,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2280,9 +1954,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2293,9 +1965,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2307,9 +1977,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2321,9 +1989,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2335,9 +2001,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2348,9 +2012,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2361,9 +2023,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2375,9 +2035,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2389,9 +2047,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2403,9 +2059,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2417,9 +2071,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2430,9 +2082,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2443,9 +2093,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2457,9 +2105,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2471,9 +2117,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2485,9 +2129,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2499,9 +2141,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2513,9 +2153,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2527,9 +2165,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2540,9 +2176,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2553,9 +2187,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2567,9 +2199,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2581,9 +2211,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2595,9 +2223,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2608,9 +2234,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2621,9 +2245,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2635,9 +2257,7 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2649,5 +2269,3 @@ This event is generated when when a memfd anonymous file is created.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md
index 8ce55b89b..fb0a1cdbf 100644
--- a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md
@@ -23,7 +23,9 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `cloud.account.id`
+### `cloud.account.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -104,9 +96,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -159,9 +143,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -186,9 +166,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -199,9 +177,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -212,9 +188,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -226,9 +200,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -240,9 +212,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -254,9 +224,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -268,9 +236,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -282,9 +248,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -296,9 +260,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -310,9 +272,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -324,9 +284,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +308,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +410,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -486,9 +422,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +433,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -512,9 +444,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -525,9 +455,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -539,9 +467,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -552,9 +478,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -566,9 +490,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -580,9 +502,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -594,9 +514,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -608,9 +526,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -622,9 +538,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -636,9 +550,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -650,9 +562,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -664,9 +574,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -678,9 +586,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -691,9 +597,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -704,9 +608,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -718,9 +620,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -731,9 +631,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -745,9 +643,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -759,9 +655,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -773,9 +667,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -786,9 +678,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted`
+### `process.Ext.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -799,9 +689,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted_descendant`
+### `process.Ext.trusted_descendant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -812,9 +700,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.Ext.ptrace.child_pid`
+### `process.Ext.ptrace.child_pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -825,9 +711,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.Ext.ptrace.request`
+### `process.Ext.ptrace.request`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -838,9 +722,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -852,9 +734,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -866,9 +746,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -880,9 +758,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -893,9 +769,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.end`
+### `process.end`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -907,9 +781,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -921,9 +793,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -935,9 +805,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -949,9 +817,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -963,9 +829,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -976,9 +840,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -989,9 +851,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1003,9 +863,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1016,9 +874,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1029,9 +885,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1043,9 +897,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1057,9 +909,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1071,9 +921,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1085,9 +933,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1099,9 +945,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1113,9 +957,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1126,9 +968,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1139,9 +979,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1153,9 +991,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1167,9 +1003,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1181,9 +1015,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1195,9 +1027,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1208,9 +1038,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1221,9 +1049,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1235,9 +1061,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1249,9 +1073,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1263,9 +1085,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1277,9 +1097,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1291,9 +1109,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.env_vars`
+### `process.env_vars`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1305,9 +1121,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1319,9 +1133,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.exit_code`
+### `process.exit_code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1333,9 +1145,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1346,9 +1156,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1359,9 +1167,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1373,9 +1179,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1387,9 +1191,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1401,9 +1203,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1415,9 +1215,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1428,9 +1226,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1441,9 +1237,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1455,9 +1249,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1469,9 +1261,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1483,9 +1273,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1496,9 +1284,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1509,9 +1295,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1523,9 +1307,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1537,9 +1319,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1551,9 +1331,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1565,9 +1343,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1578,9 +1354,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1591,9 +1365,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1605,9 +1377,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1619,9 +1389,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1633,9 +1401,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1647,9 +1413,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1661,9 +1425,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1674,9 +1436,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1687,9 +1447,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1700,9 +1458,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1714,9 +1470,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1728,9 +1482,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1742,9 +1494,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1756,9 +1506,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1770,9 +1518,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1783,9 +1529,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1797,9 +1541,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1811,9 +1553,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1824,9 +1564,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1837,9 +1575,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1851,9 +1587,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1865,9 +1599,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1879,9 +1611,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1892,9 +1622,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1905,9 +1633,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1919,9 +1645,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1933,9 +1657,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1947,9 +1669,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1960,9 +1680,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1973,9 +1691,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1987,9 +1703,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2001,9 +1715,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2015,9 +1727,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2029,9 +1739,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2043,9 +1751,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2057,9 +1763,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2071,9 +1775,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2085,9 +1787,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2099,9 +1799,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2112,9 +1810,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2125,9 +1821,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2139,9 +1833,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2153,9 +1845,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2167,9 +1857,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2181,9 +1869,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2195,9 +1881,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2209,9 +1893,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2222,9 +1904,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2235,9 +1915,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2249,9 +1927,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2263,9 +1939,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2277,9 +1951,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2290,9 +1962,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2303,9 +1973,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2317,9 +1985,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2331,9 +1997,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2345,9 +2009,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2359,9 +2021,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2372,9 +2032,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2385,9 +2043,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2399,9 +2055,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2413,9 +2067,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2427,9 +2079,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2441,9 +2091,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2455,9 +2103,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2469,9 +2115,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2482,9 +2126,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2495,9 +2137,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2509,9 +2149,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2523,9 +2161,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2537,9 +2173,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2550,9 +2184,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2563,9 +2195,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2577,9 +2207,7 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2591,5 +2219,3 @@ This event is generated when when a process calls ptrace_attach on another proce
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md
index 5d7f8f321..e77ff310a 100644
--- a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md
@@ -24,7 +24,9 @@ This event is generated when a process's session id changes.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `cloud.account.id`
+### `cloud.account.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -174,9 +156,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -187,9 +167,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -200,9 +178,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -213,9 +189,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -227,9 +201,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -241,9 +213,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -255,9 +225,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -269,9 +237,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +249,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +261,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -311,9 +273,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -460,9 +400,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -487,9 +423,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -500,9 +434,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -513,9 +445,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -526,9 +456,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -540,9 +468,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -553,9 +479,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -567,9 +491,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -581,9 +503,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -595,9 +515,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -609,9 +527,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -623,9 +539,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -637,9 +551,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -651,9 +563,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +575,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +587,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,9 +598,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -705,9 +609,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -719,9 +621,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -732,9 +632,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -746,9 +644,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -760,9 +656,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -774,9 +668,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -787,9 +679,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -801,9 +691,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -815,9 +703,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -829,9 +715,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -842,9 +726,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -856,9 +738,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -870,9 +750,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -884,9 +762,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -898,9 +774,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -911,9 +785,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -924,9 +796,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -938,9 +808,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -951,9 +819,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -964,9 +830,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -978,9 +842,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -992,9 +854,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1006,9 +866,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1020,9 +878,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1034,9 +890,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1048,9 +902,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1061,9 +913,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1074,9 +924,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1088,9 +936,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1102,9 +948,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1116,9 +960,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1130,9 +972,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1143,9 +983,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1156,9 +994,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1170,9 +1006,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1184,9 +1018,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1198,9 +1030,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1212,9 +1042,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1226,9 +1054,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1240,9 +1066,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1253,9 +1077,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1266,9 +1088,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1280,9 +1100,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1294,9 +1112,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1308,9 +1124,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1322,9 +1136,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1335,9 +1147,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1348,9 +1158,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1362,9 +1170,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1376,9 +1182,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1390,9 +1194,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1403,9 +1205,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1416,9 +1216,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1430,9 +1228,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1444,9 +1240,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1458,9 +1252,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1472,9 +1264,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1485,9 +1275,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1498,9 +1286,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1512,9 +1298,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1526,9 +1310,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1540,9 +1322,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1554,9 +1334,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1568,9 +1346,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1581,9 +1357,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1594,9 +1368,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1607,9 +1379,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1621,9 +1391,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1635,9 +1403,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1649,9 +1415,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1663,9 +1427,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1677,9 +1439,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1691,9 +1451,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1705,9 +1463,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1718,9 +1474,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1731,9 +1485,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1745,9 +1497,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1759,9 +1509,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1773,9 +1521,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1786,9 +1532,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1799,9 +1543,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1813,9 +1555,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1827,9 +1567,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1841,9 +1579,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1854,9 +1590,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1867,9 +1601,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1881,9 +1613,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1895,9 +1625,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1909,9 +1637,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1923,9 +1649,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1937,9 +1661,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1951,9 +1673,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1965,9 +1685,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1979,9 +1697,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1993,9 +1709,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2006,9 +1720,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2019,9 +1731,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2033,9 +1743,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2047,9 +1755,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2061,9 +1767,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2075,9 +1779,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2089,9 +1791,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2103,9 +1803,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2116,9 +1814,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2129,9 +1825,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2143,9 +1837,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2157,9 +1849,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2171,9 +1861,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2184,9 +1872,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2197,9 +1883,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2211,9 +1895,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2225,9 +1907,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2239,9 +1919,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2253,9 +1931,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2266,9 +1942,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2279,9 +1953,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2293,9 +1965,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2307,9 +1977,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2321,9 +1989,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2335,9 +2001,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2349,9 +2013,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2363,9 +2025,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2376,9 +2036,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2389,9 +2047,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.effective`
+### `process.thread.capabilities.effective`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2403,9 +2059,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.permitted`
+### `process.thread.capabilities.permitted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2417,9 +2071,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.major`
+### `process.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2431,9 +2083,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.minor`
+### `process.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2445,9 +2095,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2459,9 +2107,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2473,9 +2119,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2487,9 +2131,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2500,9 +2142,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2513,9 +2153,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2527,9 +2165,7 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2541,5 +2177,3 @@ This event is generated when a process's session id changes.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md
index 5e59cc61e..b9712acf7 100644
--- a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md
@@ -23,7 +23,9 @@ This event is generated when when a process calls shmget().
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `cloud.account.id`
+### `cloud.account.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -104,9 +96,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -159,9 +143,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -186,9 +166,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -199,9 +177,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -212,9 +188,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -226,9 +200,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -240,9 +212,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -254,9 +224,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -268,9 +236,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -282,9 +248,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -296,9 +260,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -310,9 +272,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -324,9 +284,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +308,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +410,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -486,9 +422,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +433,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -512,9 +444,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -525,9 +455,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -539,9 +467,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -552,9 +478,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -566,9 +490,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -580,9 +502,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -594,9 +514,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -608,9 +526,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -622,9 +538,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -636,9 +550,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -650,9 +562,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -664,9 +574,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -678,9 +586,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -691,9 +597,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -704,9 +608,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -718,9 +620,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -731,9 +631,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -745,9 +643,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -759,9 +655,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -773,9 +667,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -786,9 +678,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted`
+### `process.Ext.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -799,9 +689,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted_descendant`
+### `process.Ext.trusted_descendant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -812,9 +700,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.Ext.shmget.size`
+### `process.Ext.shmget.size`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -825,9 +711,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.Ext.shmget.flags`
+### `process.Ext.shmget.flags`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -838,9 +722,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.Ext.shmget.key`
+### `process.Ext.shmget.key`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -851,9 +733,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -865,9 +745,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -879,9 +757,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -893,9 +769,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.end`
+### `process.end`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -907,9 +781,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -921,9 +793,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -935,9 +805,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -949,9 +817,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -963,9 +829,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -976,9 +840,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -989,9 +851,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1003,9 +863,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1016,9 +874,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1029,9 +885,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1043,9 +897,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1057,9 +909,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1071,9 +921,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1085,9 +933,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1099,9 +945,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1113,9 +957,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1126,9 +968,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1139,9 +979,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1153,9 +991,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1167,9 +1003,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1181,9 +1015,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1195,9 +1027,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1208,9 +1038,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1221,9 +1049,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1235,9 +1061,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1249,9 +1073,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1263,9 +1085,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1277,9 +1097,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1291,9 +1109,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.env_vars`
+### `process.env_vars`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1305,9 +1121,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1319,9 +1133,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.exit_code`
+### `process.exit_code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1333,9 +1145,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1346,9 +1156,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1359,9 +1167,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1373,9 +1179,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1387,9 +1191,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1401,9 +1203,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1415,9 +1215,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1428,9 +1226,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1441,9 +1237,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1455,9 +1249,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1469,9 +1261,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1483,9 +1273,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1496,9 +1284,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1509,9 +1295,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1523,9 +1307,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1537,9 +1319,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1551,9 +1331,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1565,9 +1343,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1578,9 +1354,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1591,9 +1365,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1605,9 +1377,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1619,9 +1389,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1633,9 +1401,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1647,9 +1413,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1661,9 +1425,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1674,9 +1436,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1687,9 +1447,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1700,9 +1458,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1714,9 +1470,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1728,9 +1482,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1742,9 +1494,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1756,9 +1506,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1770,9 +1518,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1783,9 +1529,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1797,9 +1541,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1811,9 +1553,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1824,9 +1564,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1837,9 +1575,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1851,9 +1587,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1865,9 +1599,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1879,9 +1611,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1892,9 +1622,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1905,9 +1633,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1919,9 +1645,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1933,9 +1657,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1947,9 +1669,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1960,9 +1680,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1973,9 +1691,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1987,9 +1703,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2001,9 +1715,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2015,9 +1727,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2029,9 +1739,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2043,9 +1751,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2057,9 +1763,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2071,9 +1775,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2085,9 +1787,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2099,9 +1799,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2112,9 +1810,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2125,9 +1821,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2139,9 +1833,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2153,9 +1845,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2167,9 +1857,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2181,9 +1869,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2195,9 +1881,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2209,9 +1893,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2222,9 +1904,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2235,9 +1915,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2249,9 +1927,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2263,9 +1939,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2277,9 +1951,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2290,9 +1962,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2303,9 +1973,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2317,9 +1985,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2331,9 +1997,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2345,9 +2009,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2359,9 +2021,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2372,9 +2032,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2385,9 +2043,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2399,9 +2055,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2413,9 +2067,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2427,9 +2079,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2441,9 +2091,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2455,9 +2103,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2469,9 +2115,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2482,9 +2126,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2495,9 +2137,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2509,9 +2149,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2523,9 +2161,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2537,9 +2173,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2550,9 +2184,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2563,9 +2195,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2577,9 +2207,7 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2591,5 +2219,3 @@ This event is generated when when a process calls shmget().
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md
index 0613a0725..6af534905 100644
--- a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md
@@ -24,7 +24,9 @@ This event is generated when a process generates text output.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -160,9 +144,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -186,9 +166,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -199,9 +177,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -213,9 +189,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -227,9 +201,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -241,9 +213,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -255,9 +225,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -269,9 +237,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -283,9 +249,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -297,9 +261,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -311,9 +273,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -367,9 +321,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -473,9 +411,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -486,9 +422,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +433,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -512,9 +444,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -526,9 +456,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -539,9 +467,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -553,9 +479,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -567,9 +491,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -581,9 +503,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -595,9 +515,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -609,9 +527,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -623,9 +539,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -637,9 +551,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -651,9 +563,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +575,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -678,9 +586,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -691,9 +597,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -705,9 +609,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -718,9 +620,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -732,9 +632,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -746,9 +644,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -760,9 +656,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -773,9 +667,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -787,9 +679,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -801,9 +691,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -815,9 +703,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -828,9 +714,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -842,9 +726,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -856,9 +738,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -870,9 +750,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -884,9 +762,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -897,9 +773,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -911,9 +785,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -924,9 +796,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -937,9 +807,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -951,9 +819,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -965,9 +831,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -979,9 +843,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -993,9 +855,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1007,9 +867,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1021,9 +879,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1034,9 +890,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1047,9 +901,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1061,9 +913,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1075,9 +925,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1089,9 +937,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1103,9 +949,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1116,9 +960,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1129,9 +971,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1143,9 +983,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1157,9 +995,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1171,9 +1007,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1185,9 +1019,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1198,9 +1030,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1211,9 +1041,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1225,9 +1053,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1239,9 +1065,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1253,9 +1077,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1267,9 +1089,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1280,9 +1100,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1293,9 +1111,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1307,9 +1123,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1321,9 +1135,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1335,9 +1147,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1348,9 +1158,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1361,9 +1169,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1375,9 +1181,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1389,9 +1193,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1403,9 +1205,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1417,9 +1217,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1430,9 +1228,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1443,9 +1239,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1457,9 +1251,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1471,9 +1263,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1485,9 +1275,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1499,9 +1287,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1513,9 +1299,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1526,9 +1310,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1539,9 +1321,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1552,9 +1332,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1566,9 +1344,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.io.bytes_skipped.length`
+### `process.io.bytes_skipped.length`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1579,9 +1355,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.io.bytes_skipped.offset`
+### `process.io.bytes_skipped.offset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1592,9 +1366,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.io.max_bytes_per_process_exceeded`
+### `process.io.max_bytes_per_process_exceeded`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1605,9 +1377,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.io.text`
+### `process.io.text`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1618,9 +1388,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.io.total_bytes_captured`
+### `process.io.total_bytes_captured`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1631,9 +1399,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.io.total_bytes_skipped`
+### `process.io.total_bytes_skipped`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1644,9 +1410,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.io.type`
+### `process.io.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1657,9 +1421,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1671,9 +1433,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1685,9 +1445,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1699,9 +1457,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1713,9 +1469,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1726,9 +1480,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1740,9 +1492,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1754,9 +1504,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1767,9 +1515,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1780,9 +1526,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1794,9 +1538,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1808,9 +1550,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1822,9 +1562,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1835,9 +1573,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1848,9 +1584,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1862,9 +1596,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1876,9 +1608,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1890,9 +1620,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1903,9 +1631,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1916,9 +1642,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1930,9 +1654,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1944,9 +1666,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1958,9 +1678,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1972,9 +1690,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1986,9 +1702,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2000,9 +1714,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2014,9 +1726,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2028,9 +1738,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2042,9 +1750,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2055,9 +1761,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2068,9 +1772,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2082,9 +1784,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2096,9 +1796,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2110,9 +1808,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2124,9 +1820,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2138,9 +1832,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2152,9 +1844,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2165,9 +1855,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2178,9 +1866,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2192,9 +1878,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2206,9 +1890,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2220,9 +1902,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2233,9 +1913,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2246,9 +1924,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2260,9 +1936,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2274,9 +1948,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2288,9 +1960,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2302,9 +1972,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2315,9 +1983,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2328,9 +1994,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2342,9 +2006,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2356,9 +2018,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2370,9 +2030,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2384,9 +2042,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2398,9 +2054,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2412,9 +2066,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2425,9 +2077,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2438,9 +2088,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.effective`
+### `process.thread.capabilities.effective`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2452,9 +2100,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.permitted`
+### `process.thread.capabilities.permitted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2466,9 +2112,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.major`
+### `process.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2480,9 +2124,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.minor`
+### `process.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2494,9 +2136,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.tty.columns`
+### `process.tty.columns`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2508,9 +2148,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.tty.rows`
+### `process.tty.rows`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2522,9 +2160,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2536,9 +2172,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2550,9 +2184,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2564,9 +2196,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2577,9 +2207,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2590,9 +2218,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2604,9 +2230,7 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2618,5 +2242,3 @@ This event is generated when a process generates text output.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md
index 563f5c52f..2839c1011 100644
--- a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md
+++ b/custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md
@@ -23,7 +23,9 @@ This event is generated when the user id changes for a process.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -35,9 +37,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.account.id`
+### `cloud.account.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.instance.name`
+### `cloud.instance.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -104,9 +96,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.project.id`
+### `cloud.project.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -118,9 +108,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.provider`
+### `cloud.provider`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -132,9 +120,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `cloud.region`
+### `cloud.region`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -146,9 +132,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.id`
+### `container.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -159,9 +143,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.image.hash.all`
+### `container.image.hash.all`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -173,9 +155,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.image.name`
+### `container.image.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -186,9 +166,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.image.tag`
+### `container.image.tag`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -199,9 +177,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `container.name`
+### `container.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -212,9 +188,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -226,9 +200,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -240,9 +212,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -254,9 +224,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -268,9 +236,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -282,9 +248,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -296,9 +260,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -310,9 +272,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -324,9 +284,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +308,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -420,9 +366,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -433,9 +377,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -459,9 +399,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -472,9 +410,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -486,9 +422,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -499,9 +433,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -512,9 +444,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -525,9 +455,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -539,9 +467,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -552,9 +478,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -566,9 +490,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -580,9 +502,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -594,9 +514,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -608,9 +526,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -622,9 +538,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -636,9 +550,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -650,9 +562,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -664,9 +574,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -678,9 +586,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.id`
+### `orchestrator.cluster.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -691,9 +597,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.cluster.name`
+### `orchestrator.cluster.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -704,9 +608,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.namespace`
+### `orchestrator.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -718,9 +620,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.ip`
+### `orchestrator.resource.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -731,9 +631,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.name`
+### `orchestrator.resource.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -745,9 +643,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.parent.type`
+### `orchestrator.resource.parent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -759,9 +655,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `orchestrator.resource.type`
+### `orchestrator.resource.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -773,9 +667,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -786,9 +678,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted`
+### `process.Ext.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -799,9 +689,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted_descendant`
+### `process.Ext.trusted_descendant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -812,9 +700,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -826,9 +712,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -840,9 +724,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -854,9 +736,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -867,9 +747,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.end`
+### `process.end`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -881,9 +759,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -895,9 +771,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args`
+### `process.entry_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -909,9 +783,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.args_count`
+### `process.entry_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -923,9 +795,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entity_id`
+### `process.entry_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -937,9 +807,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.source.ip`
+### `process.entry_leader.entry_meta.source.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -950,9 +818,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.entry_meta.type`
+### `process.entry_leader.entry_meta.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -963,9 +829,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.executable`
+### `process.entry_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -977,9 +841,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.id`
+### `process.entry_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -990,9 +852,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.group.name`
+### `process.entry_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1003,9 +863,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.interactive`
+### `process.entry_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1017,9 +875,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.name`
+### `process.entry_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1031,9 +887,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.entity_id`
+### `process.entry_leader.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1045,9 +899,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.pid`
+### `process.entry_leader.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1059,9 +911,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.parent.start`
+### `process.entry_leader.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1073,9 +923,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.pid`
+### `process.entry_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1087,9 +935,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.id`
+### `process.entry_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1100,9 +946,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_group.name`
+### `process.entry_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1113,9 +957,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.id`
+### `process.entry_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1127,9 +969,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.real_user.name`
+### `process.entry_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1141,9 +981,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.same_as_process`
+### `process.entry_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1155,9 +993,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.start`
+### `process.entry_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1169,9 +1005,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.id`
+### `process.entry_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1182,9 +1016,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.supplemental_groups.name`
+### `process.entry_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1195,9 +1027,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.major`
+### `process.entry_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1209,9 +1039,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.tty.char_device.minor`
+### `process.entry_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1223,9 +1051,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.id`
+### `process.entry_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1237,9 +1063,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.user.name`
+### `process.entry_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1251,9 +1075,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.entry_leader.working_directory`
+### `process.entry_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1265,9 +1087,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1279,9 +1099,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.exit_code`
+### `process.exit_code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1293,9 +1111,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group.id`
+### `process.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1306,9 +1122,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group.name`
+### `process.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1319,9 +1133,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args`
+### `process.group_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1333,9 +1145,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.args_count`
+### `process.group_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1347,9 +1157,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.entity_id`
+### `process.group_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1361,9 +1169,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.executable`
+### `process.group_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1375,9 +1181,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.id`
+### `process.group_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1388,9 +1192,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.group.name`
+### `process.group_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1401,9 +1203,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.interactive`
+### `process.group_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1415,9 +1215,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.name`
+### `process.group_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1429,9 +1227,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.pid`
+### `process.group_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1443,9 +1239,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.id`
+### `process.group_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1456,9 +1250,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_group.name`
+### `process.group_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1469,9 +1261,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.id`
+### `process.group_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1483,9 +1273,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.real_user.name`
+### `process.group_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1497,9 +1285,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.same_as_process`
+### `process.group_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1511,9 +1297,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.start`
+### `process.group_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1525,9 +1309,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.id`
+### `process.group_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1538,9 +1320,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.supplemental_groups.name`
+### `process.group_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1551,9 +1331,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.major`
+### `process.group_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1565,9 +1343,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.tty.char_device.minor`
+### `process.group_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1579,9 +1355,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.id`
+### `process.group_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1593,9 +1367,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.user.name`
+### `process.group_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1607,9 +1379,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.group_leader.working_directory`
+### `process.group_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1621,9 +1391,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1634,9 +1402,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1647,9 +1413,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1660,9 +1424,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.interactive`
+### `process.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1674,9 +1436,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1688,9 +1448,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1702,9 +1460,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1716,9 +1472,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1730,9 +1484,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1743,9 +1495,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1757,9 +1507,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1771,9 +1519,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.id`
+### `process.parent.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1784,9 +1530,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.group.name`
+### `process.parent.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1797,9 +1541,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.interactive`
+### `process.parent.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1811,9 +1553,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1825,9 +1565,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1839,9 +1577,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.id`
+### `process.parent.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1852,9 +1588,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_group.name`
+### `process.parent.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1865,9 +1599,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.id`
+### `process.parent.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1879,9 +1611,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.real_user.name`
+### `process.parent.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1893,9 +1623,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.start`
+### `process.parent.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1907,9 +1635,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.id`
+### `process.parent.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1920,9 +1646,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.supplemental_groups.name`
+### `process.parent.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1933,9 +1657,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.major`
+### `process.parent.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1947,9 +1669,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.tty.char_device.minor`
+### `process.parent.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1961,9 +1681,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.id`
+### `process.parent.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1975,9 +1693,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.user.name`
+### `process.parent.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1989,9 +1705,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.parent.working_directory`
+### `process.parent.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2003,9 +1717,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2017,9 +1729,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.previous.args`
+### `process.previous.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2031,9 +1741,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.previous.args_count`
+### `process.previous.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2045,9 +1753,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.previous.executable`
+### `process.previous.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2059,9 +1765,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.real_group.id`
+### `process.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2072,9 +1776,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.real_group.name`
+### `process.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2085,9 +1787,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.real_user.id`
+### `process.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2099,9 +1799,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.real_user.name`
+### `process.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2113,9 +1811,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args`
+### `process.session_leader.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2127,9 +1823,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.args_count`
+### `process.session_leader.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2141,9 +1835,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.entity_id`
+### `process.session_leader.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2155,9 +1847,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.executable`
+### `process.session_leader.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2169,9 +1859,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.id`
+### `process.session_leader.group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2182,9 +1870,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.group.name`
+### `process.session_leader.group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2195,9 +1881,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.interactive`
+### `process.session_leader.interactive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2209,9 +1893,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.name`
+### `process.session_leader.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2223,9 +1905,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.pid`
+### `process.session_leader.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2237,9 +1917,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.id`
+### `process.session_leader.real_group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2250,9 +1928,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_group.name`
+### `process.session_leader.real_group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2263,9 +1939,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.id`
+### `process.session_leader.real_user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2277,9 +1951,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.real_user.name`
+### `process.session_leader.real_user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2291,9 +1963,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.same_as_process`
+### `process.session_leader.same_as_process`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2305,9 +1975,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.start`
+### `process.session_leader.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2319,9 +1987,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.id`
+### `process.session_leader.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2332,9 +1998,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.supplemental_groups.name`
+### `process.session_leader.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2345,9 +2009,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.major`
+### `process.session_leader.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2359,9 +2021,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.tty.char_device.minor`
+### `process.session_leader.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2373,9 +2033,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.id`
+### `process.session_leader.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2387,9 +2045,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.user.name`
+### `process.session_leader.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2401,9 +2057,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.session_leader.working_directory`
+### `process.session_leader.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2415,9 +2069,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.start`
+### `process.start`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2429,9 +2081,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.id`
+### `process.supplemental_groups.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2442,9 +2092,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.supplemental_groups.name`
+### `process.supplemental_groups.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2455,9 +2103,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.effective`
+### `process.thread.capabilities.effective`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2469,9 +2115,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.thread.capabilities.permitted`
+### `process.thread.capabilities.permitted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2483,9 +2127,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.major`
+### `process.tty.char_device.major`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2497,9 +2139,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.tty.char_device.minor`
+### `process.tty.char_device.minor`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2511,9 +2151,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.user.id`
+### `process.user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2525,9 +2163,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.user.name`
+### `process.user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2539,9 +2175,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2553,9 +2187,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2566,9 +2198,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2579,9 +2209,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2593,9 +2221,7 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -2607,5 +2233,3 @@ This event is generated when the user id changes for a process.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md
index 3ab026d1c..9186b2f07 100644
--- a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md
+++ b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md
@@ -24,7 +24,9 @@ This event is generated for a process that was already running before Endpoint's
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -299,9 +263,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -312,9 +274,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -325,9 +285,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -338,9 +296,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -352,9 +308,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -365,9 +319,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -378,9 +330,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -391,9 +341,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -405,9 +353,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -418,9 +364,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -432,9 +376,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -446,9 +388,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -460,9 +400,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -474,9 +412,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -488,9 +424,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -502,9 +436,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -516,9 +448,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -557,9 +483,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.pid`
+### `process.Ext.effective_parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -571,9 +495,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -585,9 +507,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -599,9 +519,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -613,9 +531,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +555,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -655,9 +567,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -683,9 +591,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -697,9 +603,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -710,9 +614,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -724,9 +626,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.env_vars`
+### `process.env_vars`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -738,9 +638,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -752,9 +650,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -765,9 +661,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +672,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -791,9 +683,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -805,9 +695,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -819,9 +707,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -833,9 +719,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -847,9 +731,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -861,9 +743,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -874,9 +754,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -887,9 +765,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -901,9 +777,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -915,5 +789,3 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md
index daa781cf5..ff2b3c373 100644
--- a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md
+++ b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md
@@ -24,7 +24,9 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `Target.process.executable`
+### `Target.process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `Target.process.name`
+### `Target.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `Target.process.pid`
+### `Target.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -368,9 +322,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -381,9 +333,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -434,9 +378,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -447,9 +389,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -461,9 +401,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -474,9 +412,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -488,9 +424,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -502,9 +436,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -516,9 +448,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -558,9 +484,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -586,9 +508,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -600,9 +520,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -613,9 +531,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.entity_id`
+### `process.Ext.effective_parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.executable`
+### `process.Ext.effective_parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +555,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.name`
+### `process.Ext.effective_parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -655,9 +567,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.pid`
+### `process.Ext.effective_parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -669,9 +579,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted`
+### `process.Ext.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -682,9 +590,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted_descendant`
+### `process.Ext.trusted_descendant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -695,9 +601,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -709,9 +613,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -723,9 +625,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -737,9 +637,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -751,9 +649,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -765,9 +661,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -779,9 +673,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -793,9 +685,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -807,9 +697,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -821,9 +709,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +732,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.env_vars`
+### `process.env_vars`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +744,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,9 +756,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.exit_code`
+### `process.exit_code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -890,9 +768,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -903,9 +779,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -916,9 +790,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -929,9 +801,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -943,9 +813,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -957,9 +825,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -971,9 +837,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.signing_id`
+### `process.parent.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -985,9 +849,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -999,9 +861,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1013,9 +873,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.team_id`
+### `process.parent.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1027,9 +885,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1041,9 +897,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1055,9 +909,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1069,9 +921,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1083,9 +933,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1097,9 +945,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1111,9 +957,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1124,9 +968,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1137,9 +979,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1151,9 +991,7 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1165,5 +1003,3 @@ This event is generated when a process calls `fork()`, `exec()`, or exits.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md
index 25ab0fca4..7c5904ee5 100644
--- a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md
+++ b/custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md
@@ -24,7 +24,9 @@ This event is generated when a remote thread is created.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `Target.process.entity_id`
+### `Target.process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `Target.process.executable`
+### `Target.process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `Target.process.name`
+### `Target.process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `Target.process.pid`
+### `Target.process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -330,9 +290,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -343,9 +301,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -356,9 +312,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.id`
+### `group.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -369,9 +323,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `group.Ext.real.name`
+### `group.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `group.id`
+### `group.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `group.name`
+### `group.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -448,9 +390,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -461,9 +401,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -475,9 +413,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -488,9 +424,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -502,9 +436,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -516,9 +448,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -530,9 +460,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -544,9 +472,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -558,9 +484,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -572,9 +496,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -586,9 +508,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -600,9 +520,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.pid`
+### `process.Ext.effective_parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -641,9 +555,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted`
+### `process.Ext.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -654,9 +566,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -668,9 +578,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -682,9 +590,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -696,9 +602,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -710,9 +614,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -724,9 +626,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -738,9 +638,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -752,9 +650,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -766,9 +662,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -779,9 +673,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -793,9 +685,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.env_vars`
+### `process.env_vars`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -807,9 +697,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -821,9 +709,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -847,9 +731,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -860,9 +742,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -874,9 +754,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -888,9 +766,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -902,9 +778,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.signing_id`
+### `process.parent.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -916,9 +790,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -930,9 +802,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -944,9 +814,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.team_id`
+### `process.parent.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -958,9 +826,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -972,9 +838,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -986,9 +850,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1000,9 +862,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1014,9 +874,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1028,9 +886,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1042,9 +898,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.id`
+### `user.Ext.real.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1055,9 +909,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `user.Ext.real.name`
+### `user.Ext.real.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1068,9 +920,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1082,9 +932,7 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1096,5 +944,3 @@ This event is generated when a remote thread is created.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md b/custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md
index 3e253ab32..c7d85917a 100644
--- a/custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md
+++ b/custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md
@@ -24,7 +24,9 @@ This event is generated for a process that was already running before Endpoint's
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -436,9 +380,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -450,9 +392,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +416,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -492,9 +428,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.authentication_id`
+### `process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -546,9 +474,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -560,9 +486,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +498,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.mitigation_policies`
+### `process.Ext.mitigation_policies`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -600,9 +520,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.relative_file_creation_time`
+### `process.Ext.relative_file_creation_time`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -613,9 +531,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.authentication_package`
+### `process.Ext.session_info.authentication_package`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -626,9 +542,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.client_address`
+### `process.Ext.session_info.client_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -639,9 +553,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.id`
+### `process.Ext.session_info.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -652,9 +564,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.logon_type`
+### `process.Ext.session_info.logon_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -665,9 +575,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.relative_logon_time`
+### `process.Ext.session_info.relative_logon_time`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -678,9 +586,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.relative_password_age`
+### `process.Ext.session_info.relative_password_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -691,9 +597,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.user_flags`
+### `process.Ext.session_info.user_flags`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -704,9 +608,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation_level`
+### `process.Ext.token.elevation_level`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -718,9 +620,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -732,9 +632,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.security_attributes`
+### `process.Ext.token.security_attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -746,9 +644,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -760,9 +656,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -774,9 +668,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -788,9 +680,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -802,9 +692,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -816,9 +704,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -830,9 +716,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -844,9 +728,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -857,9 +739,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -871,9 +751,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -885,9 +763,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -898,9 +774,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -911,9 +785,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -924,9 +796,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -938,9 +808,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.exists`
+### `process.parent.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -952,9 +820,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.status`
+### `process.parent.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -966,9 +832,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.subject_name`
+### `process.parent.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -980,9 +844,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.trusted`
+### `process.parent.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -994,9 +856,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1008,9 +868,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1022,9 +880,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1036,9 +892,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1050,9 +904,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1064,9 +916,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1078,9 +928,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1092,9 +940,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1105,9 +951,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1119,9 +963,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1133,9 +975,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1147,9 +987,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1161,9 +999,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.pe.imphash`
+### `process.pe.imphash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1175,9 +1011,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.pe.original_file_name`
+### `process.pe.original_file_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1189,9 +1023,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1203,9 +1035,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1217,9 +1047,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1230,9 +1058,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1244,9 +1070,7 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1258,5 +1082,3 @@ This event is generated for a process that was already running before Endpoint's
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md b/custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md
index 3e3d7d918..6becb05e4 100644
--- a/custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md
+++ b/custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md
@@ -24,7 +24,9 @@ This event is generated when a process is created or exits.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -436,9 +380,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -450,9 +392,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +416,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -492,9 +428,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.authentication_id`
+### `process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -518,9 +450,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -546,9 +474,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -560,9 +486,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +498,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.created_suspended`
+### `process.Ext.created_suspended`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -588,9 +510,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.defense_evasions`
+### `process.Ext.defense_evasions`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.device.bus_type`
+### `process.Ext.device.bus_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.device.dos_name`
+### `process.Ext.device.dos_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.device.file_system_type`
+### `process.Ext.device.file_system_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -640,9 +554,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.device.nt_name`
+### `process.Ext.device.nt_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -653,9 +565,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.device.product_id`
+### `process.Ext.device.product_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -666,9 +576,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.device.vendor_id`
+### `process.Ext.device.vendor_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +587,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.device.volume_device_type`
+### `process.Ext.device.volume_device_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,9 +598,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.entity_id`
+### `process.Ext.effective_parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -706,9 +610,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.executable`
+### `process.Ext.effective_parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -720,9 +622,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.name`
+### `process.Ext.effective_parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -734,9 +634,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.effective_parent.pid`
+### `process.Ext.effective_parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -748,9 +646,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.mitigation_policies`
+### `process.Ext.mitigation_policies`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -761,9 +657,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.protection`
+### `process.Ext.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -774,9 +668,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.relative_file_creation_time`
+### `process.Ext.relative_file_creation_time`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -787,9 +679,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.relative_file_name_modify_time`
+### `process.Ext.relative_file_name_modify_time`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -800,9 +690,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.authentication_package`
+### `process.Ext.session_info.authentication_package`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -813,9 +701,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.client_address`
+### `process.Ext.session_info.client_address`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -826,9 +712,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.id`
+### `process.Ext.session_info.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -839,9 +723,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.logon_type`
+### `process.Ext.session_info.logon_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -852,9 +734,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.relative_logon_time`
+### `process.Ext.session_info.relative_logon_time`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -865,9 +745,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.relative_password_age`
+### `process.Ext.session_info.relative_password_age`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -878,9 +756,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.user_flags`
+### `process.Ext.session_info.user_flags`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -891,9 +767,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.elevation_level`
+### `process.Ext.token.elevation_level`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -905,9 +779,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.integrity_level_name`
+### `process.Ext.token.integrity_level_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -919,9 +791,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.token.security_attributes`
+### `process.Ext.token.security_attributes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -933,9 +803,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted`
+### `process.Ext.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -946,9 +814,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.trusted_descendant`
+### `process.Ext.trusted_descendant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -959,9 +825,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.args`
+### `process.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -973,9 +837,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.args_count`
+### `process.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -987,9 +849,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1001,9 +861,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1015,9 +873,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1029,9 +885,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1043,9 +897,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.command_line`
+### `process.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1057,9 +909,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.Ext.command_line_truncated`
+### `process.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1070,9 +920,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1084,9 +932,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1098,9 +944,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.exit_code`
+### `process.exit_code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1112,9 +956,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.hash.md5`
+### `process.hash.md5`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1125,9 +967,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha1`
+### `process.hash.sha1`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1138,9 +978,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.hash.sha256`
+### `process.hash.sha256`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1151,9 +989,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1165,9 +1001,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.exists`
+### `process.parent.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1179,9 +1013,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.status`
+### `process.parent.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1193,9 +1025,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.subject_name`
+### `process.parent.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1207,9 +1037,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.code_signature.trusted`
+### `process.parent.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1221,9 +1049,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.real.entity_id`
+### `process.parent.Ext.real.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1234,9 +1060,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.real.pid`
+### `process.parent.Ext.real.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1247,9 +1071,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.args`
+### `process.parent.args`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1261,9 +1083,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.args_count`
+### `process.parent.args_count`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1275,9 +1095,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.exists`
+### `process.parent.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1289,9 +1107,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.status`
+### `process.parent.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1303,9 +1119,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.subject_name`
+### `process.parent.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1317,9 +1131,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.code_signature.trusted`
+### `process.parent.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1331,9 +1143,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.command_line`
+### `process.parent.command_line`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1345,9 +1155,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.Ext.command_line_truncated`
+### `process.parent.Ext.command_line_truncated`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1358,9 +1166,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.entity_id`
+### `process.parent.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1372,9 +1178,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.executable`
+### `process.parent.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1386,9 +1190,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.name`
+### `process.parent.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1400,9 +1202,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.pid`
+### `process.parent.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1414,9 +1214,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.thread.Ext.call_stack.callsite_leading_bytes`
+### `process.parent.thread.Ext.call_stack.callsite_leading_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1427,9 +1225,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.thread.Ext.call_stack.callsite_trailing_bytes`
+### `process.parent.thread.Ext.call_stack.callsite_trailing_bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1440,9 +1236,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.thread.Ext.call_stack.protection`
+### `process.parent.thread.Ext.call_stack.protection`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1453,9 +1247,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.thread.Ext.call_stack.symbol_info`
+### `process.parent.thread.Ext.call_stack.symbol_info`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1466,9 +1258,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.thread.Ext.call_stack_contains_unbacked`
+### `process.parent.thread.Ext.call_stack_contains_unbacked`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1479,9 +1269,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.parent.thread.Ext.call_stack_summary`
+### `process.parent.thread.Ext.call_stack_summary`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1493,9 +1281,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.pe.imphash`
+### `process.pe.imphash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1507,9 +1293,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.pe.original_file_name`
+### `process.pe.original_file_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1521,9 +1305,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1535,9 +1317,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `process.working_directory`
+### `process.working_directory`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1549,9 +1329,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1562,9 +1340,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1576,9 +1352,7 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -1590,5 +1364,3 @@ This event is generated when a process is created or exits.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md b/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md
index cf88bdf4b..c53f87215 100644
--- a/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md
+++ b/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md
@@ -24,7 +24,9 @@ This event is generated when the registry is modified.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -356,9 +312,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -369,9 +323,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -409,9 +357,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -436,9 +380,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -450,9 +392,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +416,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -492,9 +428,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -506,9 +440,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -520,9 +452,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -534,9 +464,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -548,9 +476,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -561,9 +487,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -575,9 +499,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -589,9 +511,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -603,9 +523,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -617,9 +535,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -631,9 +547,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -645,9 +559,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -659,9 +571,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -673,9 +583,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -687,9 +595,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -701,9 +607,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -715,9 +619,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -729,9 +631,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `registry.data.bytes`
+### `registry.data.bytes`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -743,9 +643,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `registry.data.strings`
+### `registry.data.strings`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -757,9 +655,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `registry.data.type`
+### `registry.data.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -771,9 +667,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `registry.hive`
+### `registry.hive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -785,9 +679,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `registry.key`
+### `registry.key`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -799,9 +691,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `registry.path`
+### `registry.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -813,9 +703,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `registry.value`
+### `registry.value`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -827,9 +715,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -840,9 +726,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -854,9 +738,7 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -868,5 +750,3 @@ This event is generated when the registry is modified.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md b/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md
index 89901dcff..576c61bda 100644
--- a/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md
+++ b/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md
@@ -24,7 +24,9 @@ This event is generated when the Windows registry is queried.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `Effective_process.entity_id`
+### `Effective_process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `Effective_process.executable`
+### `Effective_process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `Effective_process.name`
+### `Effective_process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `Effective_process.pid`
+### `Effective_process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -274,9 +242,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -288,9 +254,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -302,9 +266,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -316,9 +278,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -329,9 +289,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -342,9 +300,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -356,9 +312,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -369,9 +323,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -409,9 +357,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -436,9 +380,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -450,9 +392,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +416,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -492,9 +428,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -506,9 +440,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -520,9 +452,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -534,9 +464,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -548,9 +476,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -561,9 +487,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -575,9 +499,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -589,9 +511,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -603,9 +523,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -617,9 +535,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -631,9 +547,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -645,9 +559,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -659,9 +571,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -673,9 +583,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -687,9 +595,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -701,9 +607,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -715,9 +619,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -729,9 +631,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `registry.data.type`
+### `registry.data.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -743,9 +643,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `registry.hive`
+### `registry.hive`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -757,9 +655,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `registry.key`
+### `registry.key`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -771,9 +667,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `registry.path`
+### `registry.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -785,9 +679,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `registry.value`
+### `registry.value`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -799,9 +691,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -812,9 +702,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -826,9 +714,7 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -840,5 +726,3 @@ This event is generated when the Windows registry is queried.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md
index 03d823906..629a9446a 100644
--- a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md
+++ b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md
@@ -24,7 +24,9 @@ This event is generated when a user grants a gatekeeper exception
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.authentication_id`
+### `Target.process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -287,9 +253,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `file.code_signature.signing_id`
+### `file.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -327,9 +287,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `file.code_signature.team_id`
+### `file.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -341,9 +299,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `file.path`
+### `file.path`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -355,9 +311,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -369,9 +323,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -382,9 +334,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -395,9 +345,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -463,9 +403,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +451,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -533,9 +463,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -547,9 +475,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -561,9 +487,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +498,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.Ext.authentication_id`
+### `process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -615,9 +533,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -629,9 +545,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -643,9 +557,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.logon_type`
+### `process.Ext.session_info.logon_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -670,9 +580,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -684,9 +592,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -698,9 +604,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -712,9 +616,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -726,9 +628,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -740,9 +640,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -754,9 +652,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -768,9 +664,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -782,9 +676,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -796,9 +688,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -809,9 +699,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `user.effective.domain`
+### `user.effective.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -822,9 +710,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `user.effective.email`
+### `user.effective.email`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -835,9 +721,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `user.effective.full_name`
+### `user.effective.full_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -849,9 +733,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `user.effective.hash`
+### `user.effective.hash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +744,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `user.effective.id`
+### `user.effective.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,9 +756,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `user.effective.name`
+### `user.effective.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -890,9 +768,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -904,9 +780,7 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -918,5 +792,3 @@ This event is generated when a user grants a gatekeeper exception
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md
index 9c9455a31..ae2e88ced 100644
--- a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md
+++ b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md
@@ -24,7 +24,9 @@ This event is generated when a user logs on to the computer.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.authentication_id`
+### `Target.process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -287,9 +253,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -327,9 +287,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -463,9 +403,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +451,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.authentication_id`
+### `process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -573,9 +497,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.logon_type`
+### `process.Ext.session_info.logon_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +544,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -670,9 +580,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -684,9 +592,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -698,9 +604,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -712,9 +616,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -726,9 +628,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -740,9 +640,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -754,9 +652,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.domain`
+### `user.effective.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -780,9 +674,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.email`
+### `user.effective.email`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -793,9 +685,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.full_name`
+### `user.effective.full_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -807,9 +697,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.hash`
+### `user.effective.hash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.id`
+### `user.effective.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.name`
+### `user.effective.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +732,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +744,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,5 +756,3 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md
index 3cea04fdd..d010ac2db 100644
--- a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md
+++ b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md
@@ -24,7 +24,9 @@ This event is generated when a user logs on to the computer with screensharing.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.authentication_id`
+### `Target.process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -287,9 +253,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -327,9 +287,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -463,9 +403,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +451,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.Ext.authentication_id`
+### `process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -573,9 +497,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.logon_type`
+### `process.Ext.session_info.logon_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +544,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -670,9 +580,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -684,9 +592,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -698,9 +604,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -712,9 +616,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -726,9 +628,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -740,9 +640,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -754,9 +652,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `user.effective.domain`
+### `user.effective.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -780,9 +674,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `user.effective.email`
+### `user.effective.email`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -793,9 +685,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `user.effective.full_name`
+### `user.effective.full_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -807,9 +697,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `user.effective.hash`
+### `user.effective.hash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `user.effective.id`
+### `user.effective.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `user.effective.name`
+### `user.effective.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +732,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +744,7 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,5 +756,3 @@ This event is generated when a user logs on to the computer with screensharing.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md
index b255aa33d..941bba110 100644
--- a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md
+++ b/custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md
@@ -24,7 +24,9 @@ This event is generated when a user logs on to the computer with SSH.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.authentication_id`
+### `Target.process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -287,9 +253,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -327,9 +287,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -463,9 +403,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +451,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.Ext.authentication_id`
+### `process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -573,9 +497,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.logon_type`
+### `process.Ext.session_info.logon_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +544,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.signing_id`
+### `process.code_signature.signing_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -670,9 +580,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.team_id`
+### `process.code_signature.team_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -684,9 +592,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -698,9 +604,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -712,9 +616,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -726,9 +628,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -740,9 +640,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -754,9 +652,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -767,9 +663,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `user.effective.domain`
+### `user.effective.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -780,9 +674,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `user.effective.email`
+### `user.effective.email`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -793,9 +685,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `user.effective.full_name`
+### `user.effective.full_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -807,9 +697,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `user.effective.hash`
+### `user.effective.hash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `user.effective.id`
+### `user.effective.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `user.effective.name`
+### `user.effective.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,9 +732,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -862,9 +744,7 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -876,5 +756,3 @@ This event is generated when a user logs on to the computer with SSH.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md b/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md
index 897eca2b2..5c488c5ee 100644
--- a/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md
+++ b/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md
@@ -24,7 +24,9 @@ This event is generated when a user logs off of the computer.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.authentication_id`
+### `Target.process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -287,9 +253,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -327,9 +287,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -463,9 +403,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +451,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -546,9 +474,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -560,9 +486,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +498,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -588,9 +510,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.logon_type`
+### `process.Ext.session_info.logon_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -615,9 +533,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -629,9 +545,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -643,9 +557,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -657,9 +569,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -671,9 +581,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -685,9 +593,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -698,9 +604,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.domain`
+### `user.effective.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -711,9 +615,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.email`
+### `user.effective.email`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -724,9 +626,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.full_name`
+### `user.effective.full_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -738,9 +638,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.hash`
+### `user.effective.hash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -751,9 +649,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.id`
+### `user.effective.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -765,9 +661,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.name`
+### `user.effective.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -779,9 +673,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -793,9 +685,7 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -807,5 +697,3 @@ This event is generated when a user logs off of the computer.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md b/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md
index 24059db7b..252e6ae91 100644
--- a/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md
+++ b/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md
@@ -24,7 +24,9 @@ This event is generated when a user logs on to the computer.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `Target.process.Ext.authentication_id`
+### `Target.process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -49,9 +49,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -63,9 +61,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -77,9 +73,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -91,9 +85,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -105,9 +97,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -119,9 +109,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -133,9 +121,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -147,9 +133,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -161,9 +145,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -175,9 +157,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -189,9 +169,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.code`
+### `event.code`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -203,9 +181,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -217,9 +193,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -231,9 +205,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -245,9 +217,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -259,9 +229,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -287,9 +253,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -327,9 +287,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -340,9 +298,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -393,9 +343,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -407,9 +355,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -421,9 +367,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -435,9 +379,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -449,9 +391,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -463,9 +403,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -477,9 +415,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -491,9 +427,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +451,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -532,9 +462,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.authentication_id`
+### `process.Ext.authentication_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -545,9 +473,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -559,9 +485,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -573,9 +497,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -587,9 +509,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.Ext.session_info.logon_type`
+### `process.Ext.session_info.logon_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -628,9 +544,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -642,9 +556,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -656,9 +568,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -670,9 +580,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -684,9 +592,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -698,9 +604,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -712,9 +616,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -725,9 +627,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.domain`
+### `user.effective.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -738,9 +638,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.email`
+### `user.effective.email`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -751,9 +649,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.full_name`
+### `user.effective.full_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -765,9 +661,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.hash`
+### `user.effective.hash`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -778,9 +672,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.id`
+### `user.effective.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -792,9 +684,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.effective.name`
+### `user.effective.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -806,9 +696,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -820,9 +708,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -834,9 +720,7 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
-#### `winlog.event_data.PrivilegeList`
+### `winlog.event_data.PrivilegeList`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -848,5 +732,3 @@ This event is generated when a user logs on to the computer.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md b/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md
index 535781dbf..feea63c1e 100644
--- a/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md
+++ b/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md
@@ -24,7 +24,9 @@ This event is generated when a device is mounted.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -436,9 +380,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -450,9 +392,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +416,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -492,9 +428,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.exists`
+### `process.Ext.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +451,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.status`
+### `process.Ext.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -533,9 +463,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.subject_name`
+### `process.Ext.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -547,9 +475,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.code_signature.trusted`
+### `process.Ext.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -561,9 +487,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.exists`
+### `process.code_signature.exists`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -575,9 +499,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.status`
+### `process.code_signature.status`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -589,9 +511,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.subject_name`
+### `process.code_signature.subject_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -603,9 +523,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.code_signature.trusted`
+### `process.code_signature.trusted`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -617,9 +535,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -631,9 +547,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.executable`
+### `process.executable`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -645,9 +559,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -659,9 +571,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -673,9 +583,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -686,9 +594,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -700,9 +606,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -714,9 +618,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `volume.bus_type`
+### `volume.bus_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -727,9 +629,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `volume.device_type`
+### `volume.device_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -740,9 +640,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `volume.dos_name`
+### `volume.dos_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -753,9 +651,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `volume.file_system_type`
+### `volume.file_system_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -766,9 +662,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `volume.nt_name`
+### `volume.nt_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -779,9 +673,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `volume.product_name`
+### `volume.product_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -792,9 +684,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `volume.serial_number`
+### `volume.serial_number`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -805,9 +695,7 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
-#### `volume.vendor_name`
+### `volume.vendor_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -818,5 +706,3 @@ This event is generated when a device is mounted.
 
 </div>
 
-<hr>
-
diff --git a/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md b/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md
index 26be5f672..9716cedda 100644
--- a/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md
+++ b/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md
@@ -24,7 +24,9 @@ This event is generated when a device is unmounted.
 
 ## Fields
 
-#### `@timestamp`
+<br>
+
+### `@timestamp`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -36,9 +38,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `agent.id`
+### `agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -50,9 +50,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `agent.type`
+### `agent.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -64,9 +62,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `agent.version`
+### `agent.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -78,9 +74,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `data_stream.dataset`
+### `data_stream.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -92,9 +86,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `data_stream.namespace`
+### `data_stream.namespace`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -106,9 +98,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `data_stream.type`
+### `data_stream.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -120,9 +110,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `ecs.version`
+### `ecs.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -134,9 +122,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `elastic.agent.id`
+### `elastic.agent.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -148,9 +134,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.action`
+### `event.action`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -162,9 +146,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.category`
+### `event.category`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -176,9 +158,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.created`
+### `event.created`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -190,9 +170,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.dataset`
+### `event.dataset`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -204,9 +182,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.id`
+### `event.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -218,9 +194,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.kind`
+### `event.kind`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -232,9 +206,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.module`
+### `event.module`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -246,9 +218,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.outcome`
+### `event.outcome`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -260,9 +230,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.sequence`
+### `event.sequence`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -273,9 +241,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `event.type`
+### `event.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -286,9 +252,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.architecture`
+### `host.architecture`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -300,9 +264,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.hostname`
+### `host.hostname`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -313,9 +275,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.id`
+### `host.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -326,9 +286,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.ip`
+### `host.ip`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -339,9 +297,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.mac`
+### `host.mac`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -353,9 +309,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.name`
+### `host.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -366,9 +320,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.os.Ext.variant`
+### `host.os.Ext.variant`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -380,9 +332,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.os.family`
+### `host.os.family`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -394,9 +344,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.os.full`
+### `host.os.full`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -408,9 +356,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.os.kernel`
+### `host.os.kernel`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -422,9 +368,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.os.name`
+### `host.os.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -436,9 +380,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.os.platform`
+### `host.os.platform`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -450,9 +392,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.os.type`
+### `host.os.type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -464,9 +404,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `host.os.version`
+### `host.os.version`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -478,9 +416,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `message`
+### `message`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -492,9 +428,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `process.Ext.ancestry`
+### `process.Ext.ancestry`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -505,9 +439,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `process.entity_id`
+### `process.entity_id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -519,9 +451,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `process.name`
+### `process.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -533,9 +463,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `process.pid`
+### `process.pid`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -547,9 +475,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `user.domain`
+### `user.domain`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -560,9 +486,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `user.id`
+### `user.id`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -574,9 +498,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `user.name`
+### `user.name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -588,9 +510,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `volume.bus_type`
+### `volume.bus_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -601,9 +521,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `volume.device_type`
+### `volume.device_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -614,9 +532,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `volume.dos_name`
+### `volume.dos_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -627,9 +543,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `volume.file_system_type`
+### `volume.file_system_type`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -640,9 +554,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `volume.nt_name`
+### `volume.nt_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -653,9 +565,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `volume.product_name`
+### `volume.product_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -666,9 +576,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `volume.serial_number`
+### `volume.serial_number`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -679,9 +587,7 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-
-#### `volume.vendor_name`
+### `volume.vendor_name`
 
 <div style='margin-left: 20px;'>
 <table>
@@ -692,5 +598,3 @@ This event is generated when a device is unmounted.
 
 </div>
 
-<hr>
-

From c34576f3f75c5b16907ae3008affcf631023a73d Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 28 Mar 2025 20:36:26 +0000
Subject: [PATCH 17/25] Readme, code cleanup, comments, etc

---
 .../src/documentation_overrides.yaml          |    4 +
 scripts/generate-docs/fields.txt              | 7975 -----------------
 scripts/generate-docs/pydocgen/Readme.md      |   54 +
 scripts/generate-docs/pydocgen/__main__.py    |   22 +-
 scripts/generate-docs/pydocgen/database.py    |   23 +-
 scripts/generate-docs/pydocgen/markdown.py    |  145 +-
 .../pydocgen/models/custom_documentation.py   |    4 +
 .../generate-docs/pydocgen/models/packages.py |    5 +
 scripts/requirements.txt                      |    3 +
 9 files changed, 196 insertions(+), 8039 deletions(-)
 delete mode 100644 scripts/generate-docs/fields.txt
 create mode 100644 scripts/generate-docs/pydocgen/Readme.md

diff --git a/custom_documentation/src/documentation_overrides.yaml b/custom_documentation/src/documentation_overrides.yaml
index eaf83e009..f0b67bba9 100644
--- a/custom_documentation/src/documentation_overrides.yaml
+++ b/custom_documentation/src/documentation_overrides.yaml
@@ -16,3 +16,7 @@
       linux_malicious_behavior_alert:
         description: The channel of the artifact for linux malicious behavior alert.
         example: stable
+- name: agent.type
+  overrides:
+    default:
+      example: endpoint
\ No newline at end of file
diff --git a/scripts/generate-docs/fields.txt b/scripts/generate-docs/fields.txt
deleted file mode 100644
index 06e8e27cc..000000000
--- a/scripts/generate-docs/fields.txt
+++ /dev/null
@@ -1,7975 +0,0 @@
-{
-    "@timestamp": [
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-        "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events."
-    ],
-    "Events": [
-        "events array"
-    ],
-    "message": [
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-        "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message."
-    ],
-    "Endpoint.policy": [
-        "The policy fields are used to hold information about applied policy.",
-        "The policy fields are used to hold information about applied policy.",
-        "The policy fields are used to hold information about applied policy."
-    ],
-    "Endpoint.policy.applied": [
-        "information about the policy that is applied",
-        "information about the policy that is applied",
-        "information about the policy that is applied"
-    ],
-    "Endpoint.policy.applied.artifacts": [
-        "information about protection artifacts applied.",
-        "information about protection artifacts applied."
-    ],
-    "Endpoint.policy.applied.artifacts.global": [
-        "information about global protection artifacts applied.",
-        "information about global protection artifacts applied."
-    ],
-    "Endpoint.policy.applied.artifacts.global.channel": [
-        "global artifacts rollout channel",
-        "global artifacts rollout channel"
-    ],
-    "Endpoint.policy.applied.artifacts.global.identifiers": [
-        "the identifiers of global artifacts applied.",
-        "the identifiers of global artifacts applied."
-    ],
-    "Endpoint.policy.applied.artifacts.global.identifiers.name": [
-        "the name of global artifact applied.",
-        "the name of global artifact applied."
-    ],
-    "Endpoint.policy.applied.artifacts.global.identifiers.sha256": [
-        "the sha256 of global artifacts applied.",
-        "the sha256 of global artifacts applied."
-    ],
-    "Endpoint.policy.applied.artifacts.global.snapshot": [
-        "the snapshot date of applied global artifacts or 'latest'",
-        "the snapshot date of applied global artifacts or 'latest'"
-    ],
-    "Endpoint.policy.applied.artifacts.global.update_age": [
-        "number of days since global artifacts were made up-to-date",
-        "number of days since global artifacts were made up-to-date"
-    ],
-    "Endpoint.policy.applied.artifacts.global.version": [
-        "the version of global artifacts applied.",
-        "the version of global artifacts applied."
-    ],
-    "Endpoint.policy.applied.artifacts.user": [
-        "information about user protection artifacts applied.",
-        "information about user protection artifacts applied."
-    ],
-    "Endpoint.policy.applied.artifacts.user.identifiers": [
-        "the identifiers of user artifacts applied.",
-        "the identifiers of user artifacts applied."
-    ],
-    "Endpoint.policy.applied.artifacts.user.identifiers.name": [
-        "the name of user artifact applied.",
-        "the name of user artifact applied."
-    ],
-    "Endpoint.policy.applied.artifacts.user.identifiers.sha256": [
-        "the sha256 of user artifacts applied.",
-        "the sha256 of user artifacts applied."
-    ],
-    "Endpoint.policy.applied.artifacts.user.version": [
-        "the version of user artifacts applied.",
-        "the version of user artifacts applied."
-    ],
-    "Endpoint.policy.applied.id": [
-        "the id of the applied policy",
-        "the id of the applied policy",
-        "the id of the applied policy"
-    ],
-    "Endpoint.policy.applied.name": [
-        "the name of this applied policy",
-        "the name of this applied policy",
-        "the name of this applied policy"
-    ],
-    "Endpoint.policy.applied.status": [
-        "the status of the applied policy",
-        "the status of the applied policy",
-        "the status of the applied policy"
-    ],
-    "Endpoint.policy.applied.version": [
-        "the version of this applied policy",
-        "the version of this applied policy"
-    ],
-    "Memory_protection.cross_session": [
-        "Is this process injecting across operating system sessions?"
-    ],
-    "Memory_protection.feature": [
-        "Memory Protection feature which triggered the alert."
-    ],
-    "Memory_protection.parent_to_child": [
-        "Is this process injecting into its child?"
-    ],
-    "Memory_protection.self_injection": [
-        "Is this alert about a process injecting into itself?"
-    ],
-    "Memory_protection.thread_count": [
-        "The number of threads that this alert applies to. If several alerts occur in a short period of time, they can be combined into a single alert with thread_count > 1."
-    ],
-    "Memory_protection.unique_key_v1": [
-        "A unique key created by hashing several characteristics of this alert."
-    ],
-    "Memory_protection.unique_key_v2": [
-        "A unique key created by hashing several characteristics of this alert."
-    ],
-    "Ransomware.child_processes.executable": [
-        "Absolute path to the process executable."
-    ],
-    "Ransomware.child_processes.feature": [
-        "Ransomware feature which triggered the alert."
-    ],
-    "Ransomware.child_processes.files": [
-        "Information about each file event attributed to the ransomware. Expected to be an array."
-    ],
-    "Ransomware.child_processes.files.data": [
-        "File header or MBR bytes."
-    ],
-    "Ransomware.child_processes.files.entropy": [
-        "Entropy of file contents."
-    ],
-    "Ransomware.child_processes.files.extension": [
-        "File extension, excluding the leading dot."
-    ],
-    "Ransomware.child_processes.files.metrics": [
-        "Suspicious ransomware behaviours associated with the file event."
-    ],
-    "Ransomware.child_processes.files.operation": [
-        "Operation applied to file."
-    ],
-    "Ransomware.child_processes.files.original.extension": [
-        "Original file extension prior to the file event."
-    ],
-    "Ransomware.child_processes.files.original.path": [
-        "Original file path prior to the file event."
-    ],
-    "Ransomware.child_processes.files.path": [
-        "Full path to the file, including the file name."
-    ],
-    "Ransomware.child_processes.files.score": [
-        "Ransomware score for this particular file event."
-    ],
-    "Ransomware.child_processes.pid": [
-        "Process id."
-    ],
-    "Ransomware.child_processes.score": [
-        "Total ransomware score for aggregated file events."
-    ],
-    "Ransomware.child_processes.version": [
-        "Ransomware artifact version."
-    ],
-    "Ransomware.executable": [
-        "Absolute path to the process executable."
-    ],
-    "Ransomware.feature": [
-        "Ransomware feature which triggered the alert."
-    ],
-    "Ransomware.files": [
-        "Information about each file event attributed to the ransomware. Expected to be an array."
-    ],
-    "Ransomware.files.data": [
-        "File header or MBR bytes."
-    ],
-    "Ransomware.files.entropy": [
-        "Entropy of file contents."
-    ],
-    "Ransomware.files.extension": [
-        "File extension, excluding the leading dot."
-    ],
-    "Ransomware.files.metrics": [
-        "Suspicious ransomware behaviours associated with the file event."
-    ],
-    "Ransomware.files.operation": [
-        "Operation applied to file."
-    ],
-    "Ransomware.files.original.extension": [
-        "Original file extension prior to the file event."
-    ],
-    "Ransomware.files.original.path": [
-        "Original file path prior to the file event."
-    ],
-    "Ransomware.files.path": [
-        "Full path to the file, including the file name."
-    ],
-    "Ransomware.files.score": [
-        "Ransomware score for this particular file event."
-    ],
-    "Ransomware.pid": [
-        "Process id."
-    ],
-    "Ransomware.score": [
-        "Total ransomware score for aggregated file events."
-    ],
-    "Ransomware.version": [
-        "Ransomware artifact version."
-    ],
-    "Responses.@timestamp": [
-        "Timestamp in which action was taken"
-    ],
-    "Responses.action": [
-        "Dictionary representing requested response action"
-    ],
-    "Responses.action.action": [
-        "Response action name"
-    ],
-    "Responses.action.field": [
-        "Field in the triggering event to use as input for action"
-    ],
-    "Responses.action.file.attributes": [
-        "Destination file attributes"
-    ],
-    "Responses.action.file.path": [
-        "Destination file path"
-    ],
-    "Responses.action.file.reason": [
-        "Combined USN file modification reason"
-    ],
-    "Responses.action.key.actions": [
-        "Actions taken by Registry Rollback for key"
-    ],
-    "Responses.action.key.path": [
-        "NT path of registry key recovered by Rollback"
-    ],
-    "Responses.action.key.values": [
-        "Values modified"
-    ],
-    "Responses.action.key.values.actions": [
-        "Actions taken by Registry Rollback for value"
-    ],
-    "Responses.action.key.values.name": [
-        "Value name recovered by Rollback"
-    ],
-    "Responses.action.process.message": [
-        "Status message for Process Rollback"
-    ],
-    "Responses.action.process.path": [
-        "Path of process killed by Process Rollback"
-    ],
-    "Responses.action.process.result": [
-        "Result code for Process Rollback"
-    ],
-    "Responses.action.source.attributes": [
-        "Source file attributes"
-    ],
-    "Responses.action.source.path": [
-        "Source file path"
-    ],
-    "Responses.action.state": [
-        "Index of event in events array to use for field lookup"
-    ],
-    "Responses.action.tree": [
-        "Indicates whether or not an action was taken against an entire process tree"
-    ],
-    "Responses.message": [
-        "Result message"
-    ],
-    "Responses.process": [
-        "Dictionary representing process information"
-    ],
-    "Responses.process.entity_id": [
-        "Entity id of actionable process"
-    ],
-    "Responses.process.name": [
-        "Name of actionable process"
-    ],
-    "Responses.process.pid": [
-        "pid of actionable process"
-    ],
-    "Responses.result": [
-        "Response action result code"
-    ],
-    "Target.dll.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "Target.dll.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "Target.dll.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.dll.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.dll.Ext.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.dll.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.dll.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.dll.Ext.compile_time": [
-        "Timestamp from when the module was compiled."
-    ],
-    "Target.dll.Ext.malware_classification.features": [
-        "Intermediate field included by adding option with subset"
-    ],
-    "Target.dll.Ext.malware_classification.features.data.buffer": [
-        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-    ],
-    "Target.dll.Ext.malware_classification.features.data.decompressed_size": [
-        "The decompressed size of buffer."
-    ],
-    "Target.dll.Ext.malware_classification.features.data.encoding": [
-        "The encoding of buffer (e.g. zlib)."
-    ],
-    "Target.dll.Ext.malware_classification.identifier": [
-        "The model's unique identifier."
-    ],
-    "Target.dll.Ext.malware_classification.score": [
-        "The score produced by the classification model."
-    ],
-    "Target.dll.Ext.malware_classification.threshold": [
-        "The score threshold for the model.  Files that score above this threshold are considered malicious."
-    ],
-    "Target.dll.Ext.malware_classification.upx_packed": [
-        "Whether UPX packing was detected."
-    ],
-    "Target.dll.Ext.malware_classification.version": [
-        "The version of the model used."
-    ],
-    "Target.dll.Ext.mapped_address": [
-        "The base address where this module is loaded."
-    ],
-    "Target.dll.Ext.mapped_size": [
-        "The size of this module's memory mapping, in bytes."
-    ],
-    "Target.dll.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.dll.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "Target.dll.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.dll.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.dll.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "Target.dll.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.dll.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.dll.hash.md5": [
-        "MD5 hash."
-    ],
-    "Target.dll.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "Target.dll.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "Target.dll.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "Target.dll.name": [
-        "Name of the library.\nThis generally maps to the name of the file on disk."
-    ],
-    "Target.dll.path": [
-        "Full file path of the library."
-    ],
-    "Target.dll.pe.company": [
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "Target.dll.pe.description": [
-        "Internal description of the file, provided at compile-time."
-    ],
-    "Target.dll.pe.file_version": [
-        "Internal version of the file, provided at compile-time."
-    ],
-    "Target.dll.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "Target.dll.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time."
-    ],
-    "Target.dll.pe.product": [
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "Target.process.Ext.ancestry": [
-        "An array of entity_ids indicating the ancestors for this event"
-    ],
-    "Target.process.Ext.architecture": [
-        "Process architecture.  It can differ from host architecture."
-    ],
-    "Target.process.Ext.authentication_id": [
-        "Process authentication ID",
-        "Process authentication ID"
-    ],
-    "Target.process.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "Target.process.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.process.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.process.Ext.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.process.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.process.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.process.Ext.dll.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "Target.process.Ext.dll.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "Target.process.Ext.dll.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.process.Ext.dll.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.process.Ext.dll.Ext.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.process.Ext.dll.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.process.Ext.dll.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.process.Ext.dll.Ext.compile_time": [
-        "Timestamp from when the module was compiled."
-    ],
-    "Target.process.Ext.dll.Ext.mapped_address": [
-        "The base address where this module is loaded."
-    ],
-    "Target.process.Ext.dll.Ext.mapped_size": [
-        "The size of this module's memory mapping, in bytes."
-    ],
-    "Target.process.Ext.dll.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.process.Ext.dll.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "Target.process.Ext.dll.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.process.Ext.dll.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.process.Ext.dll.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "Target.process.Ext.dll.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.process.Ext.dll.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.process.Ext.dll.hash.md5": [
-        "MD5 hash."
-    ],
-    "Target.process.Ext.dll.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "Target.process.Ext.dll.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "Target.process.Ext.dll.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "Target.process.Ext.dll.name": [
-        "Name of the library.\nThis generally maps to the name of the file on disk."
-    ],
-    "Target.process.Ext.dll.path": [
-        "Full file path of the library."
-    ],
-    "Target.process.Ext.dll.pe.company": [
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.dll.pe.description": [
-        "Internal description of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.dll.pe.file_version": [
-        "Internal version of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.dll.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "Target.process.Ext.dll.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.dll.pe.product": [
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.malware_classification.features": [
-        "Intermediate field included by adding option with subset"
-    ],
-    "Target.process.Ext.malware_classification.features.data.buffer": [
-        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-    ],
-    "Target.process.Ext.malware_classification.features.data.decompressed_size": [
-        "The decompressed size of buffer."
-    ],
-    "Target.process.Ext.malware_classification.features.data.encoding": [
-        "The encoding of buffer (e.g. zlib)."
-    ],
-    "Target.process.Ext.malware_classification.identifier": [
-        "The model's unique identifier."
-    ],
-    "Target.process.Ext.malware_classification.score": [
-        "The score produced by the classification model."
-    ],
-    "Target.process.Ext.malware_classification.threshold": [
-        "The score threshold for the model.  Files that score above this threshold are considered malicious."
-    ],
-    "Target.process.Ext.malware_classification.upx_packed": [
-        "Whether UPX packing was detected."
-    ],
-    "Target.process.Ext.malware_classification.version": [
-        "The version of the model used."
-    ],
-    "Target.process.Ext.memory_region.allocation_base": [
-        "Base address of the memory allocation containing the memory region.",
-        "Base address of the memory allocation containing the memory region."
-    ],
-    "Target.process.Ext.memory_region.allocation_protection": [
-        "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-        "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\"."
-    ],
-    "Target.process.Ext.memory_region.allocation_size": [
-        "Original memory size requested when the memory was allocated.",
-        "Original memory size requested when the memory was allocated."
-    ],
-    "Target.process.Ext.memory_region.allocation_type": [
-        "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-        "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\"."
-    ],
-    "Target.process.Ext.memory_region.bytes_address": [
-        "The address where bytes_compressed begins.",
-        "The address where bytes_compressed begins."
-    ],
-    "Target.process.Ext.memory_region.bytes_allocation_offset": [
-        "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-        "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base."
-    ],
-    "Target.process.Ext.memory_region.bytes_compressed": [
-        "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-        "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times."
-    ],
-    "Target.process.Ext.memory_region.bytes_compressed_present": [
-        "Whether bytes_compressed is present in this event.",
-        "Whether bytes_compressed is present in this event."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.all_names": [
-        "A sequence of signature names matched.",
-        "A sequence of signature names matched."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.identifier": [
-        "malware signature identifier",
-        "malware signature identifier"
-    ],
-    "Target.process.Ext.memory_region.malware_signature.primary": [
-        "The first matching details.",
-        "The first matching details."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.primary.matches": [
-        "The first matching details.",
-        "The first matching details."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.primary.signature.hash": [
-        "hash of file matching signature.",
-        "hash of file matching signature."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.primary.signature.hash.sha256": [
-        "sha256 hash of file matching signature.",
-        "sha256 hash of file matching signature."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.primary.signature.id": [
-        "The id of the first yara rule matched.",
-        "The id of the first yara rule matched."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.primary.signature.name": [
-        "The name of the first yara rule matched.",
-        "The name of the first yara rule matched."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.version": [
-        "malware signature version",
-        "malware signature version"
-    ],
-    "Target.process.Ext.memory_region.mapped_path": [
-        "If the memory corresponds to a file mapping, this is the file's path.",
-        "If the memory corresponds to a file mapping, this is the file's path."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.company": [
-        "Internal company name of the file, provided at compile-time.",
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.description": [
-        "Internal description of the file, provided at compile-time.",
-        "Internal description of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.file_version": [
-        "Internal version of the file, provided at compile-time.",
-        "Internal version of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.original_file_name": [
-        "Internal name of the file, provided at compile-time.",
-        "Internal name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.product": [
-        "Internal product name of the file, provided at compile-time.",
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe_detected": [
-        "Whether the file at mapped_path is an executable.",
-        "Whether the file at mapped_path is an executable."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.company": [
-        "Internal company name of the file, provided at compile-time.",
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.description": [
-        "Internal description of the file, provided at compile-time.",
-        "Internal description of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.file_version": [
-        "Internal version of the file, provided at compile-time.",
-        "Internal version of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.original_file_name": [
-        "Internal name of the file, provided at compile-time.",
-        "Internal name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.product": [
-        "Internal product name of the file, provided at compile-time.",
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "Target.process.Ext.memory_region.memory_pe_detected": [
-        "Whether an executable file was found in memory.",
-        "Whether an executable file was found in memory."
-    ],
-    "Target.process.Ext.memory_region.region_base": [
-        "Base address of the memory region.",
-        "Base address of the memory region."
-    ],
-    "Target.process.Ext.memory_region.region_protection": [
-        "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-        "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\"."
-    ],
-    "Target.process.Ext.memory_region.region_size": [
-        "Size of the memory region.",
-        "Size of the memory region."
-    ],
-    "Target.process.Ext.memory_region.region_start_bytes": [
-        "First 64 bytes at the region base address.",
-        "First 64 bytes at the region base address."
-    ],
-    "Target.process.Ext.memory_region.region_state": [
-        "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-        "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\"."
-    ],
-    "Target.process.Ext.memory_region.strings": [
-        "Array of strings found within the memory region.",
-        "Array of strings found within the memory region."
-    ],
-    "Target.process.Ext.protection": [
-        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
-        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-    ],
-    "Target.process.Ext.services": [
-        "Services running in this process."
-    ],
-    "Target.process.Ext.session": [
-        "Session information for the current process"
-    ],
-    "Target.process.Ext.token.domain": [
-        "Domain of token user."
-    ],
-    "Target.process.Ext.token.elevation": [
-        "Whether the token is elevated or not"
-    ],
-    "Target.process.Ext.token.elevation_type": [
-        "What level of elevation the token has"
-    ],
-    "Target.process.Ext.token.impersonation_level": [
-        "Impersonation level. Only valid for impersonation tokens."
-    ],
-    "Target.process.Ext.token.integrity_level": [
-        "Numeric integrity level."
-    ],
-    "Target.process.Ext.token.integrity_level_name": [
-        "Human readable integrity level.",
-        "Human readable integrity level."
-    ],
-    "Target.process.Ext.token.is_appcontainer": [
-        "Whether or not this is an appcontainer token."
-    ],
-    "Target.process.Ext.token.privileges": [
-        "Array describing the privileges associated with the token."
-    ],
-    "Target.process.Ext.token.privileges.description": [
-        "Description of the privilege."
-    ],
-    "Target.process.Ext.token.privileges.enabled": [
-        "Whether or not the privilege is enabled."
-    ],
-    "Target.process.Ext.token.privileges.name": [
-        "Name of the privilege."
-    ],
-    "Target.process.Ext.token.sid": [
-        "Token user's Security Identifier (SID)."
-    ],
-    "Target.process.Ext.token.type": [
-        "Type of the token, either primary or impersonation."
-    ],
-    "Target.process.Ext.token.user": [
-        "Username of token owner."
-    ],
-    "Target.process.Ext.user": [
-        "User associated with the running process."
-    ],
-    "Target.process.args": [
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
-    ],
-    "Target.process.args_count": [
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
-    ],
-    "Target.process.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.process.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "Target.process.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.process.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.process.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "Target.process.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.process.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.process.command_line": [
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
-    ],
-    "Target.process.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "Target.process.executable": [
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable."
-    ],
-    "Target.process.exit_code": [
-        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start)."
-    ],
-    "Target.process.hash.md5": [
-        "MD5 hash."
-    ],
-    "Target.process.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "Target.process.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "Target.process.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "Target.process.name": [
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar."
-    ],
-    "Target.process.parent.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "Target.process.parent.Ext.architecture": [
-        "Process architecture.  It can differ from host architecture."
-    ],
-    "Target.process.parent.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "Target.process.parent.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.process.parent.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.process.parent.Ext.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.process.parent.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.process.parent.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.process.parent.Ext.dll.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "Target.process.parent.Ext.dll.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "Target.process.parent.Ext.dll.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.process.parent.Ext.dll.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.process.parent.Ext.dll.Ext.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.process.parent.Ext.dll.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.process.parent.Ext.dll.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.process.parent.Ext.dll.Ext.compile_time": [
-        "Timestamp from when the module was compiled."
-    ],
-    "Target.process.parent.Ext.dll.Ext.mapped_address": [
-        "The base address where this module is loaded."
-    ],
-    "Target.process.parent.Ext.dll.Ext.mapped_size": [
-        "The size of this module's memory mapping, in bytes."
-    ],
-    "Target.process.parent.Ext.dll.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.process.parent.Ext.dll.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "Target.process.parent.Ext.dll.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.process.parent.Ext.dll.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.process.parent.Ext.dll.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "Target.process.parent.Ext.dll.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.process.parent.Ext.dll.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.process.parent.Ext.dll.hash.md5": [
-        "MD5 hash."
-    ],
-    "Target.process.parent.Ext.dll.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "Target.process.parent.Ext.dll.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "Target.process.parent.Ext.dll.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "Target.process.parent.Ext.dll.name": [
-        "Name of the library.\nThis generally maps to the name of the file on disk."
-    ],
-    "Target.process.parent.Ext.dll.path": [
-        "Full file path of the library."
-    ],
-    "Target.process.parent.Ext.dll.pe.company": [
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "Target.process.parent.Ext.dll.pe.description": [
-        "Internal description of the file, provided at compile-time."
-    ],
-    "Target.process.parent.Ext.dll.pe.file_version": [
-        "Internal version of the file, provided at compile-time."
-    ],
-    "Target.process.parent.Ext.dll.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "Target.process.parent.Ext.dll.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time."
-    ],
-    "Target.process.parent.Ext.dll.pe.product": [
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "Target.process.parent.Ext.protection": [
-        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-    ],
-    "Target.process.parent.Ext.real": [
-        "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
-    ],
-    "Target.process.parent.Ext.real.pid": [
-        "For process.parent this will be the ppid of the process that actually spawned the current process."
-    ],
-    "Target.process.parent.Ext.token.domain": [
-        "Domain of token user."
-    ],
-    "Target.process.parent.Ext.token.elevation": [
-        "Whether the token is elevated or not"
-    ],
-    "Target.process.parent.Ext.token.elevation_type": [
-        "What level of elevation the token has"
-    ],
-    "Target.process.parent.Ext.token.impersonation_level": [
-        "Impersonation level. Only valid for impersonation tokens."
-    ],
-    "Target.process.parent.Ext.token.integrity_level": [
-        "Numeric integrity level."
-    ],
-    "Target.process.parent.Ext.token.integrity_level_name": [
-        "Human readable integrity level."
-    ],
-    "Target.process.parent.Ext.token.is_appcontainer": [
-        "Whether or not this is an appcontainer token."
-    ],
-    "Target.process.parent.Ext.token.privileges": [
-        "Array describing the privileges associated with the token."
-    ],
-    "Target.process.parent.Ext.token.privileges.description": [
-        "Description of the privilege."
-    ],
-    "Target.process.parent.Ext.token.privileges.enabled": [
-        "Whether or not the privilege is enabled."
-    ],
-    "Target.process.parent.Ext.token.privileges.name": [
-        "Name of the privilege."
-    ],
-    "Target.process.parent.Ext.token.sid": [
-        "Token user's Security Identifier (SID)."
-    ],
-    "Target.process.parent.Ext.token.type": [
-        "Type of the token, either primary or impersonation."
-    ],
-    "Target.process.parent.Ext.token.user": [
-        "Username of token owner."
-    ],
-    "Target.process.parent.Ext.user": [
-        "User associated with the running process."
-    ],
-    "Target.process.parent.args": [
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
-    ],
-    "Target.process.parent.args_count": [
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
-    ],
-    "Target.process.parent.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.process.parent.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "Target.process.parent.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.process.parent.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.process.parent.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "Target.process.parent.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.process.parent.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.process.parent.command_line": [
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
-    ],
-    "Target.process.parent.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "Target.process.parent.executable": [
-        "Absolute path to the process executable."
-    ],
-    "Target.process.parent.exit_code": [
-        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start)."
-    ],
-    "Target.process.parent.hash.md5": [
-        "MD5 hash."
-    ],
-    "Target.process.parent.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "Target.process.parent.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "Target.process.parent.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "Target.process.parent.name": [
-        "Process name.\nSometimes called program name or similar."
-    ],
-    "Target.process.parent.pe.company": [
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "Target.process.parent.pe.description": [
-        "Internal description of the file, provided at compile-time."
-    ],
-    "Target.process.parent.pe.file_version": [
-        "Internal version of the file, provided at compile-time."
-    ],
-    "Target.process.parent.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "Target.process.parent.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time."
-    ],
-    "Target.process.parent.pe.product": [
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "Target.process.parent.pgid": [
-        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to."
-    ],
-    "Target.process.parent.pid": [
-        "Process id."
-    ],
-    "Target.process.parent.ppid": [
-        "Parent process' pid."
-    ],
-    "Target.process.parent.start": [
-        "The time the process started."
-    ],
-    "Target.process.parent.thread.id": [
-        "Thread ID."
-    ],
-    "Target.process.parent.thread.name": [
-        "Thread name."
-    ],
-    "Target.process.parent.title": [
-        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened."
-    ],
-    "Target.process.parent.uptime": [
-        "Seconds the process has been up."
-    ],
-    "Target.process.parent.working_directory": [
-        "The working directory of the process."
-    ],
-    "Target.process.pe.company": [
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "Target.process.pe.description": [
-        "Internal description of the file, provided at compile-time."
-    ],
-    "Target.process.pe.file_version": [
-        "Internal version of the file, provided at compile-time."
-    ],
-    "Target.process.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "Target.process.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time."
-    ],
-    "Target.process.pe.product": [
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "Target.process.pgid": [
-        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to."
-    ],
-    "Target.process.pid": [
-        "Process id.",
-        "Process id."
-    ],
-    "Target.process.ppid": [
-        "Parent process' pid."
-    ],
-    "Target.process.start": [
-        "The time the process started."
-    ],
-    "Target.process.thread.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "Target.process.thread.Ext.call_stack": [
-        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame."
-    ],
-    "Target.process.thread.Ext.call_stack.instruction_pointer": [
-        "The return address of this stack frame."
-    ],
-    "Target.process.thread.Ext.call_stack.memory_section.memory_address": [
-        "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`"
-    ],
-    "Target.process.thread.Ext.call_stack.memory_section.memory_size": [
-        "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`"
-    ],
-    "Target.process.thread.Ext.call_stack.memory_section.protection": [
-        "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
-    ],
-    "Target.process.thread.Ext.call_stack.module_name": [
-        "The name of the DLL/module containing `instruction_pointer`."
-    ],
-    "Target.process.thread.Ext.call_stack.module_path": [
-        "The path to the DLL/module containing `instruction_pointer`."
-    ],
-    "Target.process.thread.Ext.call_stack.rva": [
-        "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
-    ],
-    "Target.process.thread.Ext.call_stack.symbol_info": [
-        "The nearest symbol for `instruction_pointer`."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module": [
-        "The final non-win32 module in the call stack."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.code_signature": [
-        "Code signature of the call_stack_final_user_module."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.hash": [
-        "Hashes of the call_stack_final_user_module."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.hash.sha256": [
-        "The sha256 of the call_stack_final_user_module."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.name": [
-        "The file name of the call_stack_final_user_module."
-    ],
-    "Target.process.thread.Ext.call_stack_final_user_module.path": [
-        "The file path of the call_stack_final_user_module."
-    ],
-    "Target.process.thread.Ext.call_stack_summary": [
-        "Concatentation of the non-repeated modules in the call stack."
-    ],
-    "Target.process.thread.Ext.hardware_breakpoint_set": [
-        "Whether a hardware breakpoint was set for the thread. This field is omitted if false."
-    ],
-    "Target.process.thread.Ext.original_start_address": [
-        "When a trampoline was detected, this indicates the original content for the thread start address in memory."
-    ],
-    "Target.process.thread.Ext.original_start_address_allocation_offset": [
-        "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base."
-    ],
-    "Target.process.thread.Ext.original_start_address_bytes": [
-        "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address."
-    ],
-    "Target.process.thread.Ext.original_start_address_bytes_disasm": [
-        "When a trampoline was detected, this holds the disassembled code at the original thread start address."
-    ],
-    "Target.process.thread.Ext.original_start_address_bytes_disasm_hash": [
-        "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed."
-    ],
-    "Target.process.thread.Ext.original_start_address_module": [
-        "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution."
-    ],
-    "Target.process.thread.Ext.parameter": [
-        "When a thread is created, this is the raw numerical value of its parameter."
-    ],
-    "Target.process.thread.Ext.parameter_bytes_compressed": [
-        "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times."
-    ],
-    "Target.process.thread.Ext.parameter_bytes_compressed_present": [
-        "Whether parameter_bytes_compressed is present in this event."
-    ],
-    "Target.process.thread.Ext.service": [
-        "Service associated with the thread."
-    ],
-    "Target.process.thread.Ext.start": [
-        "The time the thread started."
-    ],
-    "Target.process.thread.Ext.start_address": [
-        "Memory address where the thread began execution."
-    ],
-    "Target.process.thread.Ext.start_address_allocation_offset": [
-        "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base."
-    ],
-    "Target.process.thread.Ext.start_address_bytes": [
-        "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded."
-    ],
-    "Target.process.thread.Ext.start_address_bytes_disasm": [
-        "The bytes at the thread start address, disassembled into human-readable assembly code."
-    ],
-    "Target.process.thread.Ext.start_address_bytes_disasm_hash": [
-        "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed."
-    ],
-    "Target.process.thread.Ext.start_address_module": [
-        "The dll/module where the thread began execution."
-    ],
-    "Target.process.thread.Ext.token.domain": [
-        "Domain of token user."
-    ],
-    "Target.process.thread.Ext.token.elevation": [
-        "Whether the token is elevated or not"
-    ],
-    "Target.process.thread.Ext.token.elevation_type": [
-        "What level of elevation the token has"
-    ],
-    "Target.process.thread.Ext.token.impersonation_level": [
-        "Impersonation level. Only valid for impersonation tokens."
-    ],
-    "Target.process.thread.Ext.token.integrity_level": [
-        "Numeric integrity level."
-    ],
-    "Target.process.thread.Ext.token.integrity_level_name": [
-        "Human readable integrity level."
-    ],
-    "Target.process.thread.Ext.token.is_appcontainer": [
-        "Whether or not this is an appcontainer token."
-    ],
-    "Target.process.thread.Ext.token.privileges": [
-        "Array describing the privileges associated with the token."
-    ],
-    "Target.process.thread.Ext.token.privileges.description": [
-        "Description of the privilege."
-    ],
-    "Target.process.thread.Ext.token.privileges.enabled": [
-        "Whether or not the privilege is enabled."
-    ],
-    "Target.process.thread.Ext.token.privileges.name": [
-        "Name of the privilege."
-    ],
-    "Target.process.thread.Ext.token.sid": [
-        "Token user's Security Identifier (SID)."
-    ],
-    "Target.process.thread.Ext.token.type": [
-        "Type of the token, either primary or impersonation."
-    ],
-    "Target.process.thread.Ext.token.user": [
-        "Username of token owner."
-    ],
-    "Target.process.thread.Ext.uptime": [
-        "Seconds since thread started."
-    ],
-    "Target.process.thread.id": [
-        "Thread ID."
-    ],
-    "Target.process.thread.name": [
-        "Thread name."
-    ],
-    "Target.process.title": [
-        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened."
-    ],
-    "Target.process.uptime": [
-        "Seconds the process has been up."
-    ],
-    "Target.process.working_directory": [
-        "The working directory of the process."
-    ],
-    "agent.ephemeral_id": [
-        "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
-        "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not."
-    ],
-    "agent.id": [
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-        "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id."
-    ],
-    "agent.name": [
-        "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
-        "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
-        "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from."
-    ],
-    "agent.type": [
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-        "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine."
-    ],
-    "agent.version": [
-        "Version of the agent.",
-        "Version of the agent.",
-        "Version of the agent.",
-        "Version of the agent.",
-        "Version of the agent.",
-        "Version of the agent.",
-        "Version of the agent.",
-        "Version of the agent.",
-        "Version of the agent.",
-        "Version of the agent."
-    ],
-    "cloud.account.id": [
-        "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
-        "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier."
-    ],
-    "cloud.instance.name": [
-        "Instance name of the host machine.",
-        "Instance name of the host machine."
-    ],
-    "cloud.project.id": [
-        "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
-        "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id."
-    ],
-    "cloud.provider": [
-        "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
-        "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean."
-    ],
-    "cloud.region": [
-        "Region in which this host, resource, or service is located.",
-        "Region in which this host, resource, or service is located."
-    ],
-    "container.id": [
-        "Unique container id.",
-        "Unique container id."
-    ],
-    "container.image.name": [
-        "Name of the image the container was built on.",
-        "Name of the image the container was built on."
-    ],
-    "container.image.tag": [
-        "Container image tags.",
-        "Container image tags."
-    ],
-    "container.name": [
-        "Container name.",
-        "Container name."
-    ],
-    "data_stream.dataset": [
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name.",
-        "Data stream dataset name."
-    ],
-    "data_stream.namespace": [
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace.",
-        "Data stream namespace."
-    ],
-    "data_stream.type": [
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type.",
-        "Data stream type."
-    ],
-    "destination.geo.city_name": [
-        "City name.",
-        "City name.",
-        "City name.",
-        "City name.",
-        "City name.",
-        "City name.",
-        "City name."
-    ],
-    "destination.geo.continent_code": [
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name."
-    ],
-    "destination.geo.continent_name": [
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent."
-    ],
-    "destination.geo.country_iso_code": [
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code."
-    ],
-    "destination.geo.country_name": [
-        "Country name.",
-        "Country name.",
-        "Country name.",
-        "Country name.",
-        "Country name.",
-        "Country name.",
-        "Country name."
-    ],
-    "destination.geo.location": [
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude."
-    ],
-    "destination.geo.name": [
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
-    ],
-    "destination.geo.postal_code": [
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
-    ],
-    "destination.geo.region_iso_code": [
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code."
-    ],
-    "destination.geo.region_name": [
-        "Region name.",
-        "Region name.",
-        "Region name.",
-        "Region name.",
-        "Region name.",
-        "Region name.",
-        "Region name."
-    ],
-    "destination.geo.timezone": [
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name."
-    ],
-    "destination.ip": [
-        "IP address of the destination (IPv4 or IPv6).",
-        "IP address of the destination (IPv4 or IPv6).",
-        "IP address of the destination (IPv4 or IPv6)."
-    ],
-    "dll.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "dll.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "dll.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "dll.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "dll.Ext.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "dll.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "dll.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "dll.Ext.compile_time": [
-        "Timestamp from when the module was compiled."
-    ],
-    "dll.Ext.malware_classification.features": [
-        "Intermediate field included by adding option with subset"
-    ],
-    "dll.Ext.malware_classification.features.data.buffer": [
-        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-    ],
-    "dll.Ext.malware_classification.features.data.decompressed_size": [
-        "The decompressed size of buffer."
-    ],
-    "dll.Ext.malware_classification.features.data.encoding": [
-        "The encoding of buffer (e.g. zlib)."
-    ],
-    "dll.Ext.malware_classification.identifier": [
-        "The model's unique identifier."
-    ],
-    "dll.Ext.malware_classification.score": [
-        "The score produced by the classification model."
-    ],
-    "dll.Ext.malware_classification.threshold": [
-        "The score threshold for the model.  Files that score above this threshold are considered malicious."
-    ],
-    "dll.Ext.malware_classification.upx_packed": [
-        "Whether UPX packing was detected."
-    ],
-    "dll.Ext.malware_classification.version": [
-        "The version of the model used."
-    ],
-    "dll.Ext.mapped_address": [
-        "The base address where this module is loaded."
-    ],
-    "dll.Ext.mapped_size": [
-        "The size of this module's memory mapping, in bytes."
-    ],
-    "dll.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "dll.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "dll.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "dll.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "dll.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "dll.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "dll.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "dll.hash.md5": [
-        "MD5 hash.",
-        "MD5 hash."
-    ],
-    "dll.hash.sha1": [
-        "SHA1 hash.",
-        "SHA1 hash."
-    ],
-    "dll.hash.sha256": [
-        "SHA256 hash.",
-        "SHA256 hash.",
-        "SHA256 hash."
-    ],
-    "dll.hash.sha512": [
-        "SHA512 hash.",
-        "SHA512 hash."
-    ],
-    "dll.name": [
-        "Name of the library.\nThis generally maps to the name of the file on disk.",
-        "Name of the library.\nThis generally maps to the name of the file on disk."
-    ],
-    "dll.path": [
-        "Full file path of the library.",
-        "Full file path of the library.",
-        "Full file path of the library."
-    ],
-    "dll.pe.company": [
-        "Internal company name of the file, provided at compile-time.",
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "dll.pe.description": [
-        "Internal description of the file, provided at compile-time.",
-        "Internal description of the file, provided at compile-time."
-    ],
-    "dll.pe.file_version": [
-        "Internal version of the file, provided at compile-time.",
-        "Internal version of the file, provided at compile-time."
-    ],
-    "dll.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "dll.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time.",
-        "Internal name of the file, provided at compile-time."
-    ],
-    "dll.pe.product": [
-        "Internal product name of the file, provided at compile-time.",
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "dns.question.name": [
-        "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
-        "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively."
-    ],
-    "dns.question.type": [
-        "The type of record being queried.",
-        "The type of record being queried."
-    ],
-    "ecs.version": [
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-        "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events."
-    ],
-    "elastic.agent": [
-        "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host.",
-        "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
-    ],
-    "elastic.agent.id": [
-        "Unique identifier of this elastic agent (if one exists).",
-        "Unique identifier of this elastic agent (if one exists)."
-    ],
-    "event.action": [
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-        "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer."
-    ],
-    "event.category": [
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-        "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories."
-    ],
-    "event.code": [
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-        "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID."
-    ],
-    "event.created": [
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-        "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used."
-    ],
-    "event.dataset": [
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-        "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name."
-    ],
-    "event.hash": [
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-        "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity."
-    ],
-    "event.id": [
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event.",
-        "Unique ID to describe the event."
-    ],
-    "event.ingested": [
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-        "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`."
-    ],
-    "event.kind": [
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-        "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not."
-    ],
-    "event.module": [
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-        "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module."
-    ],
-    "event.outcome": [
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-        "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense."
-    ],
-    "event.provider": [
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-        "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing)."
-    ],
-    "event.risk_score": [
-        "Risk score or priority of the event (e.g. security solutions). Use your system's original value here."
-    ],
-    "event.sequence": [
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-        "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision."
-    ],
-    "event.severity": [
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-        "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`."
-    ],
-    "event.type": [
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types.",
-        "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-    ],
-    "file.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "file.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "file.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "file.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "file.Ext.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "file.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "file.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "file.Ext.entry_modified": [
-        "Time of last status change.  See `st_ctim` member of `struct stat`."
-    ],
-    "file.Ext.macro.code_page": [
-        "Identifies the character encoding used for this macro.  https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers"
-    ],
-    "file.Ext.macro.collection": [
-        "Object containing hashes for the macro collection."
-    ],
-    "file.Ext.macro.collection.hash.md5": [
-        "MD5 hash."
-    ],
-    "file.Ext.macro.collection.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "file.Ext.macro.collection.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "file.Ext.macro.collection.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "file.Ext.macro.errors": [
-        "Errors that occurred when parsing this document file."
-    ],
-    "file.Ext.macro.errors.count": [
-        "Number of times this error that occurred."
-    ],
-    "file.Ext.macro.errors.error_type": [
-        "The type of parsing error that occurred."
-    ],
-    "file.Ext.macro.file_extension": [
-        "The extension of the file containing this macro (e.g. .docm)"
-    ],
-    "file.Ext.macro.project_file": [
-        "Metadata about the corresponding VBA project file"
-    ],
-    "file.Ext.macro.project_file.hash.md5": [
-        "MD5 hash."
-    ],
-    "file.Ext.macro.project_file.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "file.Ext.macro.project_file.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "file.Ext.macro.project_file.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "file.Ext.macro.stream": [
-        "Streams associated with the document."
-    ],
-    "file.Ext.macro.stream.hash.md5": [
-        "MD5 hash."
-    ],
-    "file.Ext.macro.stream.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "file.Ext.macro.stream.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "file.Ext.macro.stream.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "file.Ext.macro.stream.name": [
-        "Name of the stream."
-    ],
-    "file.Ext.macro.stream.raw_code": [
-        "First 100KB of raw stream binary.  Can be useful to analyze false positives and malicious payloads."
-    ],
-    "file.Ext.macro.stream.raw_code_size": [
-        "The original stream size.  Indicates whether stream.raw_code was truncated."
-    ],
-    "file.Ext.malware_classification.features": [
-        "Intermediate field included by adding option with subset"
-    ],
-    "file.Ext.malware_classification.features.data.buffer": [
-        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-    ],
-    "file.Ext.malware_classification.features.data.decompressed_size": [
-        "The decompressed size of buffer."
-    ],
-    "file.Ext.malware_classification.features.data.encoding": [
-        "The encoding of buffer (e.g. zlib)."
-    ],
-    "file.Ext.malware_classification.identifier": [
-        "The model's unique identifier."
-    ],
-    "file.Ext.malware_classification.score": [
-        "The score produced by the classification model."
-    ],
-    "file.Ext.malware_classification.threshold": [
-        "The score threshold for the model.  Files that score above this threshold are considered malicious."
-    ],
-    "file.Ext.malware_classification.upx_packed": [
-        "Whether UPX packing was detected."
-    ],
-    "file.Ext.malware_classification.version": [
-        "The version of the model used."
-    ],
-    "file.Ext.original": [
-        "Original file information during a modification event.",
-        "Original file information during a modification event."
-    ],
-    "file.Ext.original.gid": [
-        "Primary group ID (GID) of the file.",
-        "Primary group ID (GID) of the file."
-    ],
-    "file.Ext.original.group": [
-        "Primary group name of the file.",
-        "Primary group name of the file."
-    ],
-    "file.Ext.original.mode": [
-        "Original file mode prior to a modification event",
-        "Original file mode prior to a modification event"
-    ],
-    "file.Ext.original.name": [
-        "Original file name prior to a modification event",
-        "Original file name prior to a modification event"
-    ],
-    "file.Ext.original.owner": [
-        "File owner's username.",
-        "File owner's username."
-    ],
-    "file.Ext.original.path": [
-        "Original file path prior to a modification event",
-        "Original file path prior to a modification event"
-    ],
-    "file.Ext.original.uid": [
-        "The user ID (UID) or security identifier (SID) of the file owner.",
-        "The user ID (UID) or security identifier (SID) of the file owner."
-    ],
-    "file.Ext.quarantine_message": [
-        "Message describing quarantine results."
-    ],
-    "file.Ext.quarantine_path": [
-        "Path on endpoint the quarantined file was originally."
-    ],
-    "file.Ext.quarantine_result": [
-        "Boolean representing whether or not file quarantine succeeded."
-    ],
-    "file.Ext.temp_file_path": [
-        "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
-    ],
-    "file.Ext.windows": [
-        "Platform-specific Windows fields",
-        "Platform-specific Windows fields"
-    ],
-    "file.Ext.windows.zone_identifier": [
-        "Windows zone identifier for a file",
-        "Windows zone identifier for a file"
-    ],
-    "file.accessed": [
-        "Last time the file was accessed.\nNote that not all filesystems keep track of access time.",
-        "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-    ],
-    "file.attributes": [
-        "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
-        "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write."
-    ],
-    "file.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "file.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "file.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "file.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "file.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "file.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "file.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "file.created": [
-        "File creation time.\nNote that not all filesystems store the creation time.",
-        "File creation time.\nNote that not all filesystems store the creation time."
-    ],
-    "file.ctime": [
-        "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file.",
-        "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-    ],
-    "file.device": [
-        "Device that is the source of the file.",
-        "Device that is the source of the file."
-    ],
-    "file.directory": [
-        "Directory where the file is located. It should include the drive letter, when appropriate.",
-        "Directory where the file is located. It should include the drive letter, when appropriate."
-    ],
-    "file.drive_letter": [
-        "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
-        "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon."
-    ],
-    "file.extension": [
-        "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-        "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
-    ],
-    "file.gid": [
-        "Primary group ID (GID) of the file.",
-        "Primary group ID (GID) of the file."
-    ],
-    "file.group": [
-        "Primary group name of the file.",
-        "Primary group name of the file."
-    ],
-    "file.hash.md5": [
-        "MD5 hash.",
-        "MD5 hash.",
-        "MD5 hash."
-    ],
-    "file.hash.sha1": [
-        "SHA1 hash.",
-        "SHA1 hash.",
-        "SHA1 hash."
-    ],
-    "file.hash.sha256": [
-        "SHA256 hash.",
-        "SHA256 hash.",
-        "SHA256 hash."
-    ],
-    "file.hash.sha512": [
-        "SHA512 hash.",
-        "SHA512 hash.",
-        "SHA512 hash."
-    ],
-    "file.inode": [
-        "Inode representing the file in the filesystem.",
-        "Inode representing the file in the filesystem."
-    ],
-    "file.mime_type": [
-        "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used.",
-        "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-    ],
-    "file.mode": [
-        "Mode of the file in octal representation.",
-        "Mode of the file in octal representation."
-    ],
-    "file.mtime": [
-        "Last time the file content was modified.",
-        "Last time the file content was modified."
-    ],
-    "file.name": [
-        "Name of the file including the extension, without the directory.",
-        "Name of the file including the extension, without the directory.",
-        "Name of the file including the extension, without the directory."
-    ],
-    "file.owner": [
-        "File owner's username.",
-        "File owner's username."
-    ],
-    "file.path": [
-        "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-        "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-        "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-        "Full path to the file, including the file name. It should include the drive letter, when appropriate."
-    ],
-    "file.pe.Ext.dotnet": [
-        "Whether this file is a .NET PE"
-    ],
-    "file.pe.Ext.sections": [
-        "The file's relevant sections, if it is a PE"
-    ],
-    "file.pe.Ext.sections.hash.md5": [
-        "MD5 hash."
-    ],
-    "file.pe.Ext.sections.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "file.pe.Ext.sections.name": [
-        "The section's name"
-    ],
-    "file.pe.Ext.streams": [
-        "The file's streams, if it is a PE"
-    ],
-    "file.pe.Ext.streams.hash.md5": [
-        "MD5 hash."
-    ],
-    "file.pe.Ext.streams.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "file.pe.Ext.streams.name": [
-        "The stream's name"
-    ],
-    "file.pe.company": [
-        "Internal company name of the file, provided at compile-time.",
-        "Internal company name of the file, provided at compile-time.",
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "file.pe.description": [
-        "Internal description of the file, provided at compile-time.",
-        "Internal description of the file, provided at compile-time.",
-        "Internal description of the file, provided at compile-time."
-    ],
-    "file.pe.file_version": [
-        "Internal version of the file, provided at compile-time.",
-        "Internal version of the file, provided at compile-time.",
-        "Internal version of the file, provided at compile-time."
-    ],
-    "file.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "file.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time.",
-        "Internal name of the file, provided at compile-time.",
-        "Internal name of the file, provided at compile-time."
-    ],
-    "file.pe.product": [
-        "Internal product name of the file, provided at compile-time.",
-        "Internal product name of the file, provided at compile-time.",
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "file.size": [
-        "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
-        "File size in bytes.\nOnly relevant when `file.type` is \"file\"."
-    ],
-    "file.target_path": [
-        "Target path for symlinks.",
-        "Target path for symlinks."
-    ],
-    "file.type": [
-        "File type (file, dir, or symlink).",
-        "File type (file, dir, or symlink)."
-    ],
-    "file.uid": [
-        "The user ID (UID) or security identifier (SID) of the file owner.",
-        "The user ID (UID) or security identifier (SID) of the file owner."
-    ],
-    "group.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "group.Ext.real": [
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations."
-    ],
-    "group.Ext.real.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "group.Ext.real.name": [
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "group.domain": [
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-    ],
-    "group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "group.name": [
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "host.architecture": [
-        "Operating system architecture.",
-        "Operating system architecture.",
-        "Operating system architecture.",
-        "Operating system architecture.",
-        "Operating system architecture.",
-        "Operating system architecture.",
-        "Operating system architecture.",
-        "Operating system architecture.",
-        "Operating system architecture.",
-        "Operating system architecture.",
-        "Operating system architecture."
-    ],
-    "host.boot.id": [
-        "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
-        "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container."
-    ],
-    "host.domain": [
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-        "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider."
-    ],
-    "host.geo.city_name": [
-        "City name."
-    ],
-    "host.geo.continent_code": [
-        "Two-letter code representing continent's name."
-    ],
-    "host.geo.continent_name": [
-        "Name of the continent."
-    ],
-    "host.geo.country_iso_code": [
-        "Country ISO code."
-    ],
-    "host.geo.country_name": [
-        "Country name."
-    ],
-    "host.geo.location": [
-        "Longitude and latitude."
-    ],
-    "host.geo.name": [
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
-    ],
-    "host.geo.postal_code": [
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
-    ],
-    "host.geo.region_iso_code": [
-        "Region ISO code."
-    ],
-    "host.geo.region_name": [
-        "Region name."
-    ],
-    "host.geo.timezone": [
-        "The time zone of the location, such as IANA time zone name."
-    ],
-    "host.hostname": [
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine.",
-        "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-    ],
-    "host.id": [
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`.",
-        "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-    ],
-    "host.ip": [
-        "Host ip addresses.",
-        "Host ip addresses.",
-        "Host ip addresses.",
-        "Host ip addresses.",
-        "Host ip addresses.",
-        "Host ip addresses.",
-        "Host ip addresses.",
-        "Host ip addresses.",
-        "Host ip addresses.",
-        "Host ip addresses.",
-        "Host ip addresses."
-    ],
-    "host.mac": [
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-        "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen."
-    ],
-    "host.name": [
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.",
-        "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-    ],
-    "host.os.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "host.os.Ext.variant": [
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-        "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field."
-    ],
-    "host.os.family": [
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows).",
-        "OS family (such as redhat, debian, freebsd, windows)."
-    ],
-    "host.os.full": [
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name.",
-        "Operating system name, including the version or code name."
-    ],
-    "host.os.kernel": [
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string.",
-        "Operating system kernel version as a raw string."
-    ],
-    "host.os.name": [
-        "Operating system name, without the version.",
-        "Operating system name, without the version.",
-        "Operating system name, without the version.",
-        "Operating system name, without the version.",
-        "Operating system name, without the version.",
-        "Operating system name, without the version.",
-        "Operating system name, without the version.",
-        "Operating system name, without the version.",
-        "Operating system name, without the version.",
-        "Operating system name, without the version.",
-        "Operating system name, without the version."
-    ],
-    "host.os.platform": [
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows).",
-        "Operating system platform (such centos, ubuntu, windows)."
-    ],
-    "host.os.type": [
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-        "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition."
-    ],
-    "host.os.version": [
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string.",
-        "Operating system version as a raw string."
-    ],
-    "host.pid_ns_ino": [
-        "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
-        "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h."
-    ],
-    "host.type": [
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.",
-        "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-    ],
-    "host.uptime": [
-        "Seconds the host has been up.",
-        "Seconds the host has been up.",
-        "Seconds the host has been up.",
-        "Seconds the host has been up.",
-        "Seconds the host has been up.",
-        "Seconds the host has been up.",
-        "Seconds the host has been up.",
-        "Seconds the host has been up.",
-        "Seconds the host has been up.",
-        "Seconds the host has been up."
-    ],
-    "host.user.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "host.user.Ext.real": [
-        "User info prior to any setuid operations."
-    ],
-    "host.user.Ext.real.id": [
-        "One or multiple unique identifiers of the user."
-    ],
-    "host.user.Ext.real.name": [
-        "Short name or login of the user."
-    ],
-    "host.user.domain": [
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-    ],
-    "host.user.email": [
-        "User email address."
-    ],
-    "host.user.full_name": [
-        "User's full name, if available."
-    ],
-    "host.user.group.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "host.user.group.Ext.real": [
-        "Group info prior to any setgid operations."
-    ],
-    "host.user.group.Ext.real.id": [
-        "Unique identifier for the group on the system/platform."
-    ],
-    "host.user.group.Ext.real.name": [
-        "Name of the group."
-    ],
-    "host.user.group.domain": [
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-    ],
-    "host.user.group.id": [
-        "Unique identifier for the group on the system/platform."
-    ],
-    "host.user.group.name": [
-        "Name of the group."
-    ],
-    "host.user.hash": [
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-    ],
-    "host.user.id": [
-        "Unique identifier of the user."
-    ],
-    "host.user.name": [
-        "Short name or login of the user."
-    ],
-    "orchestrator.cluster.name": [
-        "Name of the cluster.",
-        "Name of the cluster."
-    ],
-    "orchestrator.namespace": [
-        "Namespace in which the action is taking place.",
-        "Namespace in which the action is taking place."
-    ],
-    "orchestrator.resource.name": [
-        "Name of the resource being acted upon.",
-        "Name of the resource being acted upon."
-    ],
-    "orchestrator.resource.type": [
-        "Type of resource being acted upon.",
-        "Type of resource being acted upon."
-    ],
-    "process.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "process.Ext.ancestry": [
-        "An array of entity_ids indicating the ancestors for this event",
-        "An array of entity_ids indicating the ancestors for this event",
-        "An array of entity_ids indicating the ancestors for this event",
-        "An array of entity_ids indicating the ancestors for this event",
-        "An array of entity_ids indicating the ancestors for this event",
-        "An array of entity_ids indicating the ancestors for this event",
-        "An array of entity_ids indicating the ancestors for this event",
-        "An array of entity_ids indicating the ancestors for this event"
-    ],
-    "process.Ext.api.behaviors": [
-        "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
-        "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called"
-    ],
-    "process.Ext.api.name": [
-        "The name of the API, usually the name of the function or system call.",
-        "The name of the API, usually the name of the function or system call."
-    ],
-    "process.Ext.api.summary": [
-        "The summary of the API call and its parameters.",
-        "The summary of the API call and its parameters."
-    ],
-    "process.Ext.architecture": [
-        "Process architecture.  It can differ from host architecture.",
-        "Process architecture.  It can differ from host architecture."
-    ],
-    "process.Ext.authentication_id": [
-        "Process authentication ID",
-        "Process authentication ID",
-        "Process authentication ID"
-    ],
-    "process.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "process.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "process.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.Ext.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "process.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "process.Ext.created_suspended": [
-        "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-        "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-        "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls."
-    ],
-    "process.Ext.dll.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "process.Ext.dll.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "process.Ext.dll.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "process.Ext.dll.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.Ext.dll.Ext.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "process.Ext.dll.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.Ext.dll.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "process.Ext.dll.Ext.compile_time": [
-        "Timestamp from when the module was compiled."
-    ],
-    "process.Ext.dll.Ext.mapped_address": [
-        "The base address where this module is loaded.",
-        "The base address where this module is loaded."
-    ],
-    "process.Ext.dll.Ext.mapped_size": [
-        "The size of this module's memory mapping, in bytes.",
-        "The size of this module's memory mapping, in bytes."
-    ],
-    "process.Ext.dll.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "process.Ext.dll.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "process.Ext.dll.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.Ext.dll.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "process.Ext.dll.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "process.Ext.dll.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.Ext.dll.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "process.Ext.dll.hash.md5": [
-        "MD5 hash."
-    ],
-    "process.Ext.dll.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "process.Ext.dll.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "process.Ext.dll.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "process.Ext.dll.name": [
-        "Name of the library.\nThis generally maps to the name of the file on disk.",
-        "Name of the library.\nThis generally maps to the name of the file on disk."
-    ],
-    "process.Ext.dll.path": [
-        "Full file path of the library.",
-        "Full file path of the library."
-    ],
-    "process.Ext.dll.pe.company": [
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "process.Ext.dll.pe.description": [
-        "Internal description of the file, provided at compile-time."
-    ],
-    "process.Ext.dll.pe.file_version": [
-        "Internal version of the file, provided at compile-time."
-    ],
-    "process.Ext.dll.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "process.Ext.dll.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time."
-    ],
-    "process.Ext.dll.pe.product": [
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "process.Ext.malware_classification.features": [
-        "Intermediate field included by adding option with subset"
-    ],
-    "process.Ext.malware_classification.features.data.buffer": [
-        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-    ],
-    "process.Ext.malware_classification.features.data.decompressed_size": [
-        "The decompressed size of buffer."
-    ],
-    "process.Ext.malware_classification.features.data.encoding": [
-        "The encoding of buffer (e.g. zlib)."
-    ],
-    "process.Ext.malware_classification.identifier": [
-        "The model's unique identifier."
-    ],
-    "process.Ext.malware_classification.score": [
-        "The score produced by the classification model."
-    ],
-    "process.Ext.malware_classification.threshold": [
-        "The score threshold for the model.  Files that score above this threshold are considered malicious."
-    ],
-    "process.Ext.malware_classification.upx_packed": [
-        "Whether UPX packing was detected."
-    ],
-    "process.Ext.malware_classification.version": [
-        "The version of the model used."
-    ],
-    "process.Ext.memory_region.allocation_base": [
-        "Base address of the memory allocation containing the memory region.",
-        "Base address of the memory allocation containing the memory region."
-    ],
-    "process.Ext.memory_region.allocation_protection": [
-        "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-        "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\"."
-    ],
-    "process.Ext.memory_region.allocation_size": [
-        "Original memory size requested when the memory was allocated.",
-        "Original memory size requested when the memory was allocated."
-    ],
-    "process.Ext.memory_region.allocation_type": [
-        "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-        "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\"."
-    ],
-    "process.Ext.memory_region.bytes_address": [
-        "The address where bytes_compressed begins.",
-        "The address where bytes_compressed begins."
-    ],
-    "process.Ext.memory_region.bytes_allocation_offset": [
-        "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-        "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base."
-    ],
-    "process.Ext.memory_region.bytes_compressed": [
-        "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-        "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times."
-    ],
-    "process.Ext.memory_region.bytes_compressed_present": [
-        "Whether bytes_compressed is present in this event.",
-        "Whether bytes_compressed is present in this event."
-    ],
-    "process.Ext.memory_region.malware_signature.all_names": [
-        "A sequence of signature names matched.",
-        "A sequence of signature names matched."
-    ],
-    "process.Ext.memory_region.malware_signature.identifier": [
-        "malware signature identifier",
-        "malware signature identifier"
-    ],
-    "process.Ext.memory_region.malware_signature.primary": [
-        "The first matching details.",
-        "The first matching details."
-    ],
-    "process.Ext.memory_region.malware_signature.primary.matches": [
-        "The first matching details.",
-        "The first matching details."
-    ],
-    "process.Ext.memory_region.malware_signature.primary.signature.hash": [
-        "hash of file matching signature.",
-        "hash of file matching signature."
-    ],
-    "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256": [
-        "sha256 hash of file matching signature.",
-        "sha256 hash of file matching signature."
-    ],
-    "process.Ext.memory_region.malware_signature.primary.signature.id": [
-        "The id of the first yara rule matched.",
-        "The id of the first yara rule matched."
-    ],
-    "process.Ext.memory_region.malware_signature.primary.signature.name": [
-        "The name of the first yara rule matched.",
-        "The name of the first yara rule matched."
-    ],
-    "process.Ext.memory_region.malware_signature.version": [
-        "malware signature version",
-        "malware signature version"
-    ],
-    "process.Ext.memory_region.mapped_path": [
-        "If the memory corresponds to a file mapping, this is the file's path.",
-        "If the memory corresponds to a file mapping, this is the file's path."
-    ],
-    "process.Ext.memory_region.mapped_pe.company": [
-        "Internal company name of the file, provided at compile-time.",
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.mapped_pe.description": [
-        "Internal description of the file, provided at compile-time.",
-        "Internal description of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.mapped_pe.file_version": [
-        "Internal version of the file, provided at compile-time.",
-        "Internal version of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.mapped_pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "process.Ext.memory_region.mapped_pe.original_file_name": [
-        "Internal name of the file, provided at compile-time.",
-        "Internal name of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.mapped_pe.product": [
-        "Internal product name of the file, provided at compile-time.",
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.mapped_pe_detected": [
-        "Whether the file at mapped_path is an executable.",
-        "Whether the file at mapped_path is an executable."
-    ],
-    "process.Ext.memory_region.memory_pe.company": [
-        "Internal company name of the file, provided at compile-time.",
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.memory_pe.description": [
-        "Internal description of the file, provided at compile-time.",
-        "Internal description of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.memory_pe.file_version": [
-        "Internal version of the file, provided at compile-time.",
-        "Internal version of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.memory_pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "process.Ext.memory_region.memory_pe.original_file_name": [
-        "Internal name of the file, provided at compile-time.",
-        "Internal name of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.memory_pe.product": [
-        "Internal product name of the file, provided at compile-time.",
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "process.Ext.memory_region.memory_pe_detected": [
-        "Whether an executable file was found in memory.",
-        "Whether an executable file was found in memory."
-    ],
-    "process.Ext.memory_region.region_base": [
-        "Base address of the memory region.",
-        "Base address of the memory region."
-    ],
-    "process.Ext.memory_region.region_protection": [
-        "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-        "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\"."
-    ],
-    "process.Ext.memory_region.region_size": [
-        "Size of the memory region.",
-        "Size of the memory region."
-    ],
-    "process.Ext.memory_region.region_start_bytes": [
-        "First 64 bytes at the region base address.",
-        "First 64 bytes at the region base address."
-    ],
-    "process.Ext.memory_region.region_state": [
-        "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-        "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\"."
-    ],
-    "process.Ext.memory_region.strings": [
-        "Array of strings found within the memory region.",
-        "Array of strings found within the memory region."
-    ],
-    "process.Ext.protection": [
-        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
-        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
-        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
-        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-    ],
-    "process.Ext.services": [
-        "Services running in this process."
-    ],
-    "process.Ext.session": [
-        "Session information for the current process",
-        "Session information for the current process"
-    ],
-    "process.Ext.token.domain": [
-        "Domain of token user."
-    ],
-    "process.Ext.token.elevation": [
-        "Whether the token is elevated or not",
-        "Whether the token is elevated or not"
-    ],
-    "process.Ext.token.elevation_type": [
-        "What level of elevation the token has",
-        "What level of elevation the token has"
-    ],
-    "process.Ext.token.impersonation_level": [
-        "Impersonation level. Only valid for impersonation tokens."
-    ],
-    "process.Ext.token.integrity_level": [
-        "Numeric integrity level."
-    ],
-    "process.Ext.token.integrity_level_name": [
-        "Human readable integrity level.",
-        "Human readable integrity level.",
-        "Human readable integrity level."
-    ],
-    "process.Ext.token.is_appcontainer": [
-        "Whether or not this is an appcontainer token."
-    ],
-    "process.Ext.token.privileges": [
-        "Array describing the privileges associated with the token."
-    ],
-    "process.Ext.token.privileges.description": [
-        "Description of the privilege."
-    ],
-    "process.Ext.token.privileges.enabled": [
-        "Whether or not the privilege is enabled."
-    ],
-    "process.Ext.token.privileges.name": [
-        "Name of the privilege."
-    ],
-    "process.Ext.token.sid": [
-        "Token user's Security Identifier (SID)."
-    ],
-    "process.Ext.token.type": [
-        "Type of the token, either primary or impersonation."
-    ],
-    "process.Ext.token.user": [
-        "Username of token owner."
-    ],
-    "process.Ext.user": [
-        "User associated with the running process."
-    ],
-    "process.args": [
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
-    ],
-    "process.args_count": [
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
-    ],
-    "process.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "process.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "process.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "process.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "process.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "process.command_line": [
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
-    ],
-    "process.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.entry_leader.args": [
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
-    ],
-    "process.entry_leader.args_count": [
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
-    ],
-    "process.entry_leader.command_line": [
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
-    ],
-    "process.entry_leader.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.entry_leader.entry_meta.source.ip": [
-        "IP address of the source (IPv4 or IPv6).",
-        "IP address of the source (IPv4 or IPv6)."
-    ],
-    "process.entry_leader.entry_meta.type": [
-        "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader.",
-        "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
-    ],
-    "process.entry_leader.executable": [
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable."
-    ],
-    "process.entry_leader.group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.entry_leader.group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.entry_leader.interactive": [
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
-    ],
-    "process.entry_leader.name": [
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar."
-    ],
-    "process.entry_leader.parent.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.entry_leader.parent.pid": [
-        "Process id.",
-        "Process id."
-    ],
-    "process.entry_leader.parent.session_leader.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.entry_leader.parent.session_leader.pid": [
-        "Process id.",
-        "Process id."
-    ],
-    "process.entry_leader.parent.session_leader.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.entry_leader.parent.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.entry_leader.pid": [
-        "Process id.",
-        "Process id."
-    ],
-    "process.entry_leader.real_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.entry_leader.real_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.entry_leader.real_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.entry_leader.real_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.entry_leader.same_as_process": [
-        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`."
-    ],
-    "process.entry_leader.saved_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.entry_leader.saved_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.entry_leader.saved_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.entry_leader.saved_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.entry_leader.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.entry_leader.supplemental_groups.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.entry_leader.supplemental_groups.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.entry_leader.tty": [
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-    ],
-    "process.entry_leader.tty.char_device.major": [
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
-    ],
-    "process.entry_leader.tty.char_device.minor": [
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
-    ],
-    "process.entry_leader.user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.entry_leader.user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.entry_leader.working_directory": [
-        "The working directory of the process.",
-        "The working directory of the process."
-    ],
-    "process.env_vars": [
-        "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
-        "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information."
-    ],
-    "process.executable": [
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable."
-    ],
-    "process.exit_code": [
-        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start)."
-    ],
-    "process.group_leader.args": [
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
-    ],
-    "process.group_leader.args_count": [
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
-    ],
-    "process.group_leader.command_line": [
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
-    ],
-    "process.group_leader.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.group_leader.executable": [
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable."
-    ],
-    "process.group_leader.group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.group_leader.group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.group_leader.interactive": [
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
-    ],
-    "process.group_leader.name": [
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar."
-    ],
-    "process.group_leader.pid": [
-        "Process id.",
-        "Process id."
-    ],
-    "process.group_leader.real_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.group_leader.real_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.group_leader.real_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.group_leader.real_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.group_leader.same_as_process": [
-        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`."
-    ],
-    "process.group_leader.saved_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.group_leader.saved_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.group_leader.saved_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.group_leader.saved_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.group_leader.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.group_leader.supplemental_groups.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.group_leader.supplemental_groups.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.group_leader.tty": [
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-    ],
-    "process.group_leader.tty.char_device.major": [
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
-    ],
-    "process.group_leader.tty.char_device.minor": [
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
-    ],
-    "process.group_leader.user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.group_leader.user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.group_leader.working_directory": [
-        "The working directory of the process.",
-        "The working directory of the process."
-    ],
-    "process.hash.md5": [
-        "MD5 hash.",
-        "MD5 hash."
-    ],
-    "process.hash.sha1": [
-        "SHA1 hash.",
-        "SHA1 hash."
-    ],
-    "process.hash.sha256": [
-        "SHA256 hash.",
-        "SHA256 hash."
-    ],
-    "process.hash.sha512": [
-        "SHA512 hash.",
-        "SHA512 hash."
-    ],
-    "process.interactive": [
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
-    ],
-    "process.name": [
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar."
-    ],
-    "process.parent.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "process.parent.Ext.architecture": [
-        "Process architecture.  It can differ from host architecture.",
-        "Process architecture.  It can differ from host architecture."
-    ],
-    "process.parent.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset.",
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "process.parent.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "process.parent.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.parent.Ext.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "process.parent.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.parent.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "process.parent.Ext.dll.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "process.parent.Ext.dll.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "process.parent.Ext.dll.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "process.parent.Ext.dll.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.parent.Ext.dll.Ext.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "process.parent.Ext.dll.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.parent.Ext.dll.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "process.parent.Ext.dll.Ext.compile_time": [
-        "Timestamp from when the module was compiled."
-    ],
-    "process.parent.Ext.dll.Ext.mapped_address": [
-        "The base address where this module is loaded."
-    ],
-    "process.parent.Ext.dll.Ext.mapped_size": [
-        "The size of this module's memory mapping, in bytes."
-    ],
-    "process.parent.Ext.dll.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "process.parent.Ext.dll.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "process.parent.Ext.dll.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.parent.Ext.dll.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "process.parent.Ext.dll.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "process.parent.Ext.dll.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.parent.Ext.dll.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "process.parent.Ext.dll.hash.md5": [
-        "MD5 hash."
-    ],
-    "process.parent.Ext.dll.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "process.parent.Ext.dll.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "process.parent.Ext.dll.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "process.parent.Ext.dll.name": [
-        "Name of the library.\nThis generally maps to the name of the file on disk."
-    ],
-    "process.parent.Ext.dll.path": [
-        "Full file path of the library."
-    ],
-    "process.parent.Ext.dll.pe.company": [
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "process.parent.Ext.dll.pe.description": [
-        "Internal description of the file, provided at compile-time."
-    ],
-    "process.parent.Ext.dll.pe.file_version": [
-        "Internal version of the file, provided at compile-time."
-    ],
-    "process.parent.Ext.dll.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "process.parent.Ext.dll.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time."
-    ],
-    "process.parent.Ext.dll.pe.product": [
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "process.parent.Ext.protection": [
-        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.",
-        "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-    ],
-    "process.parent.Ext.real": [
-        "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent.",
-        "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
-    ],
-    "process.parent.Ext.real.pid": [
-        "For process.parent this will be the ppid of the process that actually spawned the current process.",
-        "For process.parent this will be the ppid of the process that actually spawned the current process."
-    ],
-    "process.parent.Ext.token.domain": [
-        "Domain of token user."
-    ],
-    "process.parent.Ext.token.elevation": [
-        "Whether the token is elevated or not"
-    ],
-    "process.parent.Ext.token.elevation_type": [
-        "What level of elevation the token has"
-    ],
-    "process.parent.Ext.token.impersonation_level": [
-        "Impersonation level. Only valid for impersonation tokens."
-    ],
-    "process.parent.Ext.token.integrity_level": [
-        "Numeric integrity level."
-    ],
-    "process.parent.Ext.token.integrity_level_name": [
-        "Human readable integrity level."
-    ],
-    "process.parent.Ext.token.is_appcontainer": [
-        "Whether or not this is an appcontainer token."
-    ],
-    "process.parent.Ext.token.privileges": [
-        "Array describing the privileges associated with the token."
-    ],
-    "process.parent.Ext.token.privileges.description": [
-        "Description of the privilege."
-    ],
-    "process.parent.Ext.token.privileges.enabled": [
-        "Whether or not the privilege is enabled."
-    ],
-    "process.parent.Ext.token.privileges.name": [
-        "Name of the privilege."
-    ],
-    "process.parent.Ext.token.sid": [
-        "Token user's Security Identifier (SID)."
-    ],
-    "process.parent.Ext.token.type": [
-        "Type of the token, either primary or impersonation."
-    ],
-    "process.parent.Ext.token.user": [
-        "Username of token owner."
-    ],
-    "process.parent.Ext.user": [
-        "User associated with the running process.",
-        "User associated with the running process."
-    ],
-    "process.parent.args": [
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
-    ],
-    "process.parent.args_count": [
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
-    ],
-    "process.parent.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "process.parent.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "process.parent.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.parent.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "process.parent.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "process.parent.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.parent.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "process.parent.command_line": [
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
-    ],
-    "process.parent.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.parent.executable": [
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable."
-    ],
-    "process.parent.exit_code": [
-        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-        "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start)."
-    ],
-    "process.parent.group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.parent.group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.parent.group_leader.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.parent.group_leader.pid": [
-        "Process id.",
-        "Process id."
-    ],
-    "process.parent.group_leader.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.parent.hash.md5": [
-        "MD5 hash.",
-        "MD5 hash."
-    ],
-    "process.parent.hash.sha1": [
-        "SHA1 hash.",
-        "SHA1 hash."
-    ],
-    "process.parent.hash.sha256": [
-        "SHA256 hash.",
-        "SHA256 hash."
-    ],
-    "process.parent.hash.sha512": [
-        "SHA512 hash.",
-        "SHA512 hash."
-    ],
-    "process.parent.interactive": [
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
-    ],
-    "process.parent.name": [
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar."
-    ],
-    "process.parent.pe.company": [
-        "Internal company name of the file, provided at compile-time.",
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "process.parent.pe.description": [
-        "Internal description of the file, provided at compile-time.",
-        "Internal description of the file, provided at compile-time."
-    ],
-    "process.parent.pe.file_version": [
-        "Internal version of the file, provided at compile-time.",
-        "Internal version of the file, provided at compile-time."
-    ],
-    "process.parent.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "process.parent.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time.",
-        "Internal name of the file, provided at compile-time."
-    ],
-    "process.parent.pe.product": [
-        "Internal product name of the file, provided at compile-time.",
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "process.parent.pgid": [
-        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to."
-    ],
-    "process.parent.pid": [
-        "Process id.",
-        "Process id.",
-        "Process id."
-    ],
-    "process.parent.ppid": [
-        "Parent process' pid.",
-        "Parent process' pid."
-    ],
-    "process.parent.real_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.parent.real_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.parent.real_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.parent.real_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.parent.saved_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.parent.saved_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.parent.saved_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.parent.saved_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.parent.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.parent.supplemental_groups.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.parent.supplemental_groups.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.parent.thread.id": [
-        "Thread ID.",
-        "Thread ID."
-    ],
-    "process.parent.thread.name": [
-        "Thread name.",
-        "Thread name."
-    ],
-    "process.parent.title": [
-        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened."
-    ],
-    "process.parent.tty": [
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-    ],
-    "process.parent.tty.char_device.major": [
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
-    ],
-    "process.parent.tty.char_device.minor": [
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
-    ],
-    "process.parent.uptime": [
-        "Seconds the process has been up.",
-        "Seconds the process has been up."
-    ],
-    "process.parent.user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.parent.user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.parent.working_directory": [
-        "The working directory of the process.",
-        "The working directory of the process."
-    ],
-    "process.pe.company": [
-        "Internal company name of the file, provided at compile-time.",
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "process.pe.description": [
-        "Internal description of the file, provided at compile-time.",
-        "Internal description of the file, provided at compile-time."
-    ],
-    "process.pe.file_version": [
-        "Internal version of the file, provided at compile-time.",
-        "Internal version of the file, provided at compile-time."
-    ],
-    "process.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "process.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time.",
-        "Internal name of the file, provided at compile-time."
-    ],
-    "process.pe.product": [
-        "Internal product name of the file, provided at compile-time.",
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "process.pgid": [
-        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-        "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to."
-    ],
-    "process.pid": [
-        "Process id.",
-        "Process id.",
-        "Process id.",
-        "Process id.",
-        "Process id.",
-        "Process id.",
-        "Process id.",
-        "Process id."
-    ],
-    "process.ppid": [
-        "Parent process' pid.",
-        "Parent process' pid.",
-        "Parent process' pid."
-    ],
-    "process.previous.args": [
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
-    ],
-    "process.previous.args_count": [
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
-    ],
-    "process.previous.executable": [
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable."
-    ],
-    "process.real_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.real_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.real_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.real_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.saved_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.saved_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.saved_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.saved_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.session_leader.args": [
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-        "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information."
-    ],
-    "process.session_leader.args_count": [
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-        "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity."
-    ],
-    "process.session_leader.command_line": [
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-        "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information."
-    ],
-    "process.session_leader.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.session_leader.executable": [
-        "Absolute path to the process executable.",
-        "Absolute path to the process executable."
-    ],
-    "process.session_leader.group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.session_leader.group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.session_leader.interactive": [
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-        "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY."
-    ],
-    "process.session_leader.name": [
-        "Process name.\nSometimes called program name or similar.",
-        "Process name.\nSometimes called program name or similar."
-    ],
-    "process.session_leader.parent.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.session_leader.parent.pid": [
-        "Process id.",
-        "Process id."
-    ],
-    "process.session_leader.parent.session_leader.entity_id": [
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-        "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts."
-    ],
-    "process.session_leader.parent.session_leader.pid": [
-        "Process id.",
-        "Process id."
-    ],
-    "process.session_leader.parent.session_leader.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.session_leader.parent.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.session_leader.pid": [
-        "Process id.",
-        "Process id."
-    ],
-    "process.session_leader.real_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.session_leader.real_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.session_leader.real_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.session_leader.real_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.session_leader.same_as_process": [
-        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-        "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`."
-    ],
-    "process.session_leader.saved_group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.session_leader.saved_group.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.session_leader.saved_user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.session_leader.saved_user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.session_leader.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.session_leader.supplemental_groups.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.session_leader.supplemental_groups.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.session_leader.tty": [
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-    ],
-    "process.session_leader.tty.char_device.major": [
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
-    ],
-    "process.session_leader.tty.char_device.minor": [
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
-    ],
-    "process.session_leader.user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.session_leader.user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.session_leader.working_directory": [
-        "The working directory of the process.",
-        "The working directory of the process."
-    ],
-    "process.start": [
-        "The time the process started.",
-        "The time the process started."
-    ],
-    "process.supplemental_groups.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.supplemental_groups.name": [
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "process.thread.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "process.thread.Ext.call_stack": [
-        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame."
-    ],
-    "process.thread.Ext.call_stack.instruction_pointer": [
-        "The return address of this stack frame.",
-        "The return address of this stack frame."
-    ],
-    "process.thread.Ext.call_stack.memory_section.memory_address": [
-        "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`"
-    ],
-    "process.thread.Ext.call_stack.memory_section.memory_size": [
-        "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`"
-    ],
-    "process.thread.Ext.call_stack.memory_section.protection": [
-        "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
-    ],
-    "process.thread.Ext.call_stack.module_name": [
-        "The name of the DLL/module containing `instruction_pointer`."
-    ],
-    "process.thread.Ext.call_stack.module_path": [
-        "The path to the DLL/module containing `instruction_pointer`.",
-        "The path to the DLL/module containing `instruction_pointer`."
-    ],
-    "process.thread.Ext.call_stack.rva": [
-        "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
-    ],
-    "process.thread.Ext.call_stack.symbol_info": [
-        "The nearest symbol for `instruction_pointer`.",
-        "The nearest symbol for `instruction_pointer`.",
-        "The nearest symbol for `instruction_pointer`.",
-        "The nearest symbol for `instruction_pointer`.",
-        "The nearest symbol for `instruction_pointer`."
-    ],
-    "process.thread.Ext.call_stack_final_hook_module": [
-        "The module that installed the final API hook in the call stack.",
-        "The module that installed the final API hook in the call stack."
-    ],
-    "process.thread.Ext.call_stack_final_hook_module.code_signature": [
-        "Code signature of the call_stack_final_hook_module.",
-        "Code signature of the call_stack_final_hook_module."
-    ],
-    "process.thread.Ext.call_stack_final_hook_module.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "process.thread.Ext.call_stack_final_hook_module.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.thread.Ext.call_stack_final_hook_module.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "process.thread.Ext.call_stack_final_hook_module.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.thread.Ext.call_stack_final_hook_module.hash": [
-        "Hashes of the call_stack_final_hook_module.",
-        "Hashes of the call_stack_final_hook_module."
-    ],
-    "process.thread.Ext.call_stack_final_hook_module.hash.sha256": [
-        "The sha256 of the call_stack_final_hook_module.",
-        "The sha256 of the call_stack_final_hook_module."
-    ],
-    "process.thread.Ext.call_stack_final_hook_module.path": [
-        "The file path of the call_stack_final_hook_module.",
-        "The file path of the call_stack_final_hook_module."
-    ],
-    "process.thread.Ext.call_stack_final_user_module": [
-        "The final non-win32 module in the call stack.",
-        "The final non-win32 module in the call stack."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.code_signature": [
-        "Code signature of the call_stack_final_user_module.",
-        "Code signature of the call_stack_final_user_module."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.code_signature.exists": [
-        "Boolean to capture if a signature is present.",
-        "Boolean to capture if a signature is present."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.code_signature.subject_name": [
-        "Subject name of the code signer",
-        "Subject name of the code signer"
-    ],
-    "process.thread.Ext.call_stack_final_user_module.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.hash": [
-        "Hashes of the call_stack_final_user_module.",
-        "Hashes of the call_stack_final_user_module."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.hash.sha256": [
-        "The sha256 of the call_stack_final_user_module.",
-        "The sha256 of the call_stack_final_user_module."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.name": [
-        "The file name of the call_stack_final_user_module.",
-        "The file name of the call_stack_final_user_module."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.path": [
-        "The file path of the call_stack_final_user_module.",
-        "The file path of the call_stack_final_user_module."
-    ],
-    "process.thread.Ext.call_stack_summary": [
-        "Concatentation of the non-repeated modules in the call stack.",
-        "Concatentation of the non-repeated modules in the call stack.",
-        "Concatentation of the non-repeated modules in the call stack.",
-        "Concatentation of the non-repeated modules in the call stack.",
-        "Concatentation of the non-repeated modules in the call stack."
-    ],
-    "process.thread.Ext.hardware_breakpoint_set": [
-        "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-        "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-        "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-        "Whether a hardware breakpoint was set for the thread. This field is omitted if false."
-    ],
-    "process.thread.Ext.original_start_address": [
-        "When a trampoline was detected, this indicates the original content for the thread start address in memory."
-    ],
-    "process.thread.Ext.original_start_address_allocation_offset": [
-        "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base."
-    ],
-    "process.thread.Ext.original_start_address_bytes": [
-        "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address."
-    ],
-    "process.thread.Ext.original_start_address_bytes_disasm": [
-        "When a trampoline was detected, this holds the disassembled code at the original thread start address."
-    ],
-    "process.thread.Ext.original_start_address_bytes_disasm_hash": [
-        "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed."
-    ],
-    "process.thread.Ext.original_start_address_module": [
-        "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution."
-    ],
-    "process.thread.Ext.parameter": [
-        "When a thread is created, this is the raw numerical value of its parameter."
-    ],
-    "process.thread.Ext.parameter_bytes_compressed": [
-        "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times."
-    ],
-    "process.thread.Ext.parameter_bytes_compressed_present": [
-        "Whether parameter_bytes_compressed is present in this event."
-    ],
-    "process.thread.Ext.service": [
-        "Service associated with the thread."
-    ],
-    "process.thread.Ext.start": [
-        "The time the thread started."
-    ],
-    "process.thread.Ext.start_address": [
-        "Memory address where the thread began execution."
-    ],
-    "process.thread.Ext.start_address_allocation_offset": [
-        "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base."
-    ],
-    "process.thread.Ext.start_address_bytes": [
-        "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded."
-    ],
-    "process.thread.Ext.start_address_bytes_disasm": [
-        "The bytes at the thread start address, disassembled into human-readable assembly code."
-    ],
-    "process.thread.Ext.start_address_bytes_disasm_hash": [
-        "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed."
-    ],
-    "process.thread.Ext.start_address_module": [
-        "The dll/module where the thread began execution."
-    ],
-    "process.thread.Ext.token.domain": [
-        "Domain of token user."
-    ],
-    "process.thread.Ext.token.elevation": [
-        "Whether the token is elevated or not"
-    ],
-    "process.thread.Ext.token.elevation_type": [
-        "What level of elevation the token has"
-    ],
-    "process.thread.Ext.token.impersonation_level": [
-        "Impersonation level. Only valid for impersonation tokens."
-    ],
-    "process.thread.Ext.token.integrity_level": [
-        "Numeric integrity level."
-    ],
-    "process.thread.Ext.token.integrity_level_name": [
-        "Human readable integrity level."
-    ],
-    "process.thread.Ext.token.is_appcontainer": [
-        "Whether or not this is an appcontainer token."
-    ],
-    "process.thread.Ext.token.privileges": [
-        "Array describing the privileges associated with the token."
-    ],
-    "process.thread.Ext.token.privileges.description": [
-        "Description of the privilege."
-    ],
-    "process.thread.Ext.token.privileges.enabled": [
-        "Whether or not the privilege is enabled."
-    ],
-    "process.thread.Ext.token.privileges.name": [
-        "Name of the privilege."
-    ],
-    "process.thread.Ext.token.sid": [
-        "Token user's Security Identifier (SID)."
-    ],
-    "process.thread.Ext.token.type": [
-        "Type of the token, either primary or impersonation."
-    ],
-    "process.thread.Ext.token.user": [
-        "Username of token owner."
-    ],
-    "process.thread.Ext.uptime": [
-        "Seconds since thread started."
-    ],
-    "process.thread.id": [
-        "Thread ID.",
-        "Thread ID.",
-        "Thread ID.",
-        "Thread ID.",
-        "Thread ID.",
-        "Thread ID.",
-        "Thread ID.",
-        "Thread ID."
-    ],
-    "process.thread.name": [
-        "Thread name.",
-        "Thread name."
-    ],
-    "process.title": [
-        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-        "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened."
-    ],
-    "process.tty": [
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session.",
-        "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-    ],
-    "process.tty.char_device.major": [
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-        "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation."
-    ],
-    "process.tty.char_device.minor": [
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-        "The minor number is used only by the driver specified by the major number; other parts of the kernel don\u2019t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them."
-    ],
-    "process.uptime": [
-        "Seconds the process has been up.",
-        "Seconds the process has been up."
-    ],
-    "process.user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "process.user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "process.working_directory": [
-        "The working directory of the process.",
-        "The working directory of the process."
-    ],
-    "registry.data.strings": [
-        "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
-        "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`)."
-    ],
-    "registry.path": [
-        "Full path, including hive, key and value",
-        "Full path, including hive, key and value"
-    ],
-    "registry.value": [
-        "Name of the value written.",
-        "Name of the value written."
-    ],
-    "rule.author": [
-        "Name, organization, or pseudonym of the author or authors who created the rule used to generate this event."
-    ],
-    "rule.category": [
-        "A categorization value keyword used by the entity using the rule for detection of this event."
-    ],
-    "rule.description": [
-        "The description of the rule generating the event."
-    ],
-    "rule.id": [
-        "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
-        "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event."
-    ],
-    "rule.license": [
-        "Name of the license under which the rule used to generate this event is made available."
-    ],
-    "rule.name": [
-        "The name of the rule or signature generating the event.",
-        "The name of the rule or signature generating the event."
-    ],
-    "rule.reference": [
-        "Reference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert."
-    ],
-    "rule.ruleset": [
-        "Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member."
-    ],
-    "rule.uuid": [
-        "A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event."
-    ],
-    "rule.version": [
-        "The version / revision of the rule being used for analysis."
-    ],
-    "source.geo.city_name": [
-        "City name.",
-        "City name.",
-        "City name.",
-        "City name.",
-        "City name.",
-        "City name.",
-        "City name."
-    ],
-    "source.geo.continent_code": [
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name.",
-        "Two-letter code representing continent's name."
-    ],
-    "source.geo.continent_name": [
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent.",
-        "Name of the continent."
-    ],
-    "source.geo.country_iso_code": [
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code.",
-        "Country ISO code."
-    ],
-    "source.geo.country_name": [
-        "Country name.",
-        "Country name.",
-        "Country name.",
-        "Country name.",
-        "Country name.",
-        "Country name.",
-        "Country name."
-    ],
-    "source.geo.location": [
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude.",
-        "Longitude and latitude."
-    ],
-    "source.geo.name": [
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
-    ],
-    "source.geo.postal_code": [
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
-    ],
-    "source.geo.region_iso_code": [
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code.",
-        "Region ISO code."
-    ],
-    "source.geo.region_name": [
-        "Region name.",
-        "Region name.",
-        "Region name.",
-        "Region name.",
-        "Region name.",
-        "Region name.",
-        "Region name."
-    ],
-    "source.geo.timezone": [
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name.",
-        "The time zone of the location, such as IANA time zone name."
-    ],
-    "source.ip": [
-        "IP address of the source (IPv4 or IPv6).",
-        "IP address of the source (IPv4 or IPv6)."
-    ],
-    "threat.enrichments": [
-        "A list of associated indicators objects enriching the event, and the context of that association/enrichment."
-    ],
-    "threat.enrichments.indicator": [
-        "Object containing associated indicators enriching the event."
-    ],
-    "threat.enrichments.indicator.file.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "threat.enrichments.indicator.file.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "threat.enrichments.indicator.file.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "threat.enrichments.indicator.file.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "threat.enrichments.indicator.file.Ext.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "threat.enrichments.indicator.file.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "threat.enrichments.indicator.file.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "threat.enrichments.indicator.file.Ext.device.bus_type": [
-        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-    ],
-    "threat.enrichments.indicator.file.Ext.device.dos_name": [
-        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-    ],
-    "threat.enrichments.indicator.file.Ext.device.file_system_type": [
-        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-    ],
-    "threat.enrichments.indicator.file.Ext.device.nt_name": [
-        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-    ],
-    "threat.enrichments.indicator.file.Ext.device.product_id": [
-        "ProductID of the device. It is provided by the vendor of the device if any."
-    ],
-    "threat.enrichments.indicator.file.Ext.device.serial_number": [
-        "Serial Number of the device. It is provided by the vendor of the device if any."
-    ],
-    "threat.enrichments.indicator.file.Ext.device.vendor_id": [
-        "VendorID of the device. It is provided by the vendor of the device."
-    ],
-    "threat.enrichments.indicator.file.Ext.device.volume_device_type": [
-        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-    ],
-    "threat.enrichments.indicator.file.Ext.entropy": [
-        "Entropy calculation of file's header and footer used to check file integrity."
-    ],
-    "threat.enrichments.indicator.file.Ext.entry_modified": [
-        "Time of last status change.  See `st_ctim` member of `struct stat`."
-    ],
-    "threat.enrichments.indicator.file.Ext.header_bytes": [
-        "First 16 bytes of file used to check file integrity."
-    ],
-    "threat.enrichments.indicator.file.Ext.header_data": [
-        "First 16 bytes of file used to check file integrity."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_classification.features.data.buffer": [
-        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_classification.features.data.decompressed_size": [
-        "The decompressed size of buffer."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_classification.features.data.encoding": [
-        "The encoding of buffer (e.g. zlib)."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_classification.identifier": [
-        "The model's unique identifier."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_classification.score": [
-        "The score produced by the classification model."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_classification.threshold": [
-        "The score threshold for the model.  Files that score above this threshold are considered malicious."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_classification.upx_packed": [
-        "Whether UPX packing was detected."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_classification.version": [
-        "The version of the model used."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature": [
-        "Nested version of malware_signature fieldset."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.all_names": [
-        "The concatenated names of all yara signatures"
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.identifier": [
-        "Malware artifact identifier."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.primary": [
-        "Primary malware signature match."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.primary.matches": [
-        "An array of bytes representing yara signature matches"
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature": [
-        "Primary malware signature match."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature.hash": [
-        "Primary malware signature hash."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature.hash.sha256": [
-        "Primary malware signature sha256."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature.id": [
-        "Primary malware signature id."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.primary.signature.name": [
-        "Primary malware signature name."
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.secondary": [
-        "An array of malware signature matches"
-    ],
-    "threat.enrichments.indicator.file.Ext.malware_signature.version": [
-        "Primary malware signature version."
-    ],
-    "threat.enrichments.indicator.file.Ext.monotonic_id": [
-        "File event monotonic ID."
-    ],
-    "threat.enrichments.indicator.file.Ext.original": [
-        "Original file information during a modification event."
-    ],
-    "threat.enrichments.indicator.file.Ext.original.gid": [
-        "Primary group ID (GID) of the file."
-    ],
-    "threat.enrichments.indicator.file.Ext.original.group": [
-        "Primary group name of the file."
-    ],
-    "threat.enrichments.indicator.file.Ext.original.mode": [
-        "Original file mode prior to a modification event"
-    ],
-    "threat.enrichments.indicator.file.Ext.original.name": [
-        "Original file name prior to a modification event"
-    ],
-    "threat.enrichments.indicator.file.Ext.original.owner": [
-        "File owner's username."
-    ],
-    "threat.enrichments.indicator.file.Ext.original.path": [
-        "Original file path prior to a modification event"
-    ],
-    "threat.enrichments.indicator.file.Ext.original.uid": [
-        "The user ID (UID) or security identifier (SID) of the file owner."
-    ],
-    "threat.enrichments.indicator.file.Ext.quarantine_message": [
-        "Message describing quarantine results."
-    ],
-    "threat.enrichments.indicator.file.Ext.quarantine_path": [
-        "Path on endpoint the quarantined file was originally."
-    ],
-    "threat.enrichments.indicator.file.Ext.quarantine_result": [
-        "Boolean representing whether or not file quarantine succeeded."
-    ],
-    "threat.enrichments.indicator.file.Ext.temp_file_path": [
-        "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
-    ],
-    "threat.enrichments.indicator.file.Ext.windows": [
-        "Platform-specific Windows fields"
-    ],
-    "threat.enrichments.indicator.file.Ext.windows.zone_identifier": [
-        "Windows zone identifier for a file"
-    ],
-    "threat.enrichments.indicator.file.accessed": [
-        "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-    ],
-    "threat.enrichments.indicator.file.attributes": [
-        "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write."
-    ],
-    "threat.enrichments.indicator.file.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "threat.enrichments.indicator.file.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "threat.enrichments.indicator.file.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "threat.enrichments.indicator.file.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "threat.enrichments.indicator.file.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "threat.enrichments.indicator.file.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "threat.enrichments.indicator.file.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "threat.enrichments.indicator.file.created": [
-        "File creation time.\nNote that not all filesystems store the creation time."
-    ],
-    "threat.enrichments.indicator.file.ctime": [
-        "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-    ],
-    "threat.enrichments.indicator.file.device": [
-        "Device that is the source of the file."
-    ],
-    "threat.enrichments.indicator.file.directory": [
-        "Directory where the file is located. It should include the drive letter, when appropriate."
-    ],
-    "threat.enrichments.indicator.file.drive_letter": [
-        "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon."
-    ],
-    "threat.enrichments.indicator.file.elf.architecture": [
-        "Machine architecture of the ELF file."
-    ],
-    "threat.enrichments.indicator.file.elf.byte_order": [
-        "Byte sequence of ELF file."
-    ],
-    "threat.enrichments.indicator.file.elf.cpu_type": [
-        "CPU type of the ELF file."
-    ],
-    "threat.enrichments.indicator.file.elf.creation_date": [
-        "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
-    ],
-    "threat.enrichments.indicator.file.elf.exports": [
-        "List of exported element names and types."
-    ],
-    "threat.enrichments.indicator.file.elf.go_import_hash": [
-        "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
-    ],
-    "threat.enrichments.indicator.file.elf.go_imports": [
-        "List of imported Go language element names and types."
-    ],
-    "threat.enrichments.indicator.file.elf.go_imports_names_entropy": [
-        "Shannon entropy calculation from the list of Go imports."
-    ],
-    "threat.enrichments.indicator.file.elf.go_imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of Go imports."
-    ],
-    "threat.enrichments.indicator.file.elf.go_stripped": [
-        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-    ],
-    "threat.enrichments.indicator.file.elf.header.abi_version": [
-        "Version of the ELF Application Binary Interface (ABI)."
-    ],
-    "threat.enrichments.indicator.file.elf.header.class": [
-        "Header class of the ELF file."
-    ],
-    "threat.enrichments.indicator.file.elf.header.data": [
-        "Data table of the ELF header."
-    ],
-    "threat.enrichments.indicator.file.elf.header.entrypoint": [
-        "Header entrypoint of the ELF file."
-    ],
-    "threat.enrichments.indicator.file.elf.header.object_version": [
-        "\"0x1\" for original ELF files."
-    ],
-    "threat.enrichments.indicator.file.elf.header.os_abi": [
-        "Application Binary Interface (ABI) of the Linux OS."
-    ],
-    "threat.enrichments.indicator.file.elf.header.type": [
-        "Header type of the ELF file."
-    ],
-    "threat.enrichments.indicator.file.elf.header.version": [
-        "Version of the ELF header."
-    ],
-    "threat.enrichments.indicator.file.elf.import_hash": [
-        "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash."
-    ],
-    "threat.enrichments.indicator.file.elf.imports": [
-        "List of imported element names and types."
-    ],
-    "threat.enrichments.indicator.file.elf.imports_names_entropy": [
-        "Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "threat.enrichments.indicator.file.elf.imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "threat.enrichments.indicator.file.elf.sections": [
-        "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.chi2": [
-        "Chi-square probability distribution of the section."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.entropy": [
-        "Shannon entropy calculation from the section."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.flags": [
-        "ELF Section List flags."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.name": [
-        "ELF Section List name."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.physical_offset": [
-        "ELF Section List offset."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.physical_size": [
-        "ELF Section List physical size."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.type": [
-        "ELF Section List type."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.var_entropy": [
-        "Variance for Shannon entropy calculation from the section."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.virtual_address": [
-        "ELF Section List virtual address."
-    ],
-    "threat.enrichments.indicator.file.elf.sections.virtual_size": [
-        "ELF Section List virtual size."
-    ],
-    "threat.enrichments.indicator.file.elf.segments": [
-        "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
-    ],
-    "threat.enrichments.indicator.file.elf.segments.sections": [
-        "ELF object segment sections."
-    ],
-    "threat.enrichments.indicator.file.elf.segments.type": [
-        "ELF object segment type."
-    ],
-    "threat.enrichments.indicator.file.elf.shared_libraries": [
-        "List of shared libraries used by this ELF object."
-    ],
-    "threat.enrichments.indicator.file.elf.telfhash": [
-        "telfhash symbol hash for ELF file."
-    ],
-    "threat.enrichments.indicator.file.extension": [
-        "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
-    ],
-    "threat.enrichments.indicator.file.gid": [
-        "Primary group ID (GID) of the file."
-    ],
-    "threat.enrichments.indicator.file.group": [
-        "Primary group name of the file."
-    ],
-    "threat.enrichments.indicator.file.hash.md5": [
-        "MD5 hash."
-    ],
-    "threat.enrichments.indicator.file.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "threat.enrichments.indicator.file.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "threat.enrichments.indicator.file.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "threat.enrichments.indicator.file.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "threat.enrichments.indicator.file.inode": [
-        "Inode representing the file in the filesystem."
-    ],
-    "threat.enrichments.indicator.file.mime_type": [
-        "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-    ],
-    "threat.enrichments.indicator.file.mode": [
-        "Mode of the file in octal representation."
-    ],
-    "threat.enrichments.indicator.file.mtime": [
-        "Last time the file content was modified."
-    ],
-    "threat.enrichments.indicator.file.name": [
-        "Name of the file including the extension, without the directory."
-    ],
-    "threat.enrichments.indicator.file.owner": [
-        "File owner's username."
-    ],
-    "threat.enrichments.indicator.file.path": [
-        "Full path to the file, including the file name. It should include the drive letter, when appropriate."
-    ],
-    "threat.enrichments.indicator.file.pe.architecture": [
-        "CPU architecture target for the file."
-    ],
-    "threat.enrichments.indicator.file.pe.company": [
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "threat.enrichments.indicator.file.pe.description": [
-        "Internal description of the file, provided at compile-time."
-    ],
-    "threat.enrichments.indicator.file.pe.file_version": [
-        "Internal version of the file, provided at compile-time."
-    ],
-    "threat.enrichments.indicator.file.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "threat.enrichments.indicator.file.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time."
-    ],
-    "threat.enrichments.indicator.file.pe.product": [
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "threat.enrichments.indicator.file.size": [
-        "File size in bytes.\nOnly relevant when `file.type` is \"file\"."
-    ],
-    "threat.enrichments.indicator.file.target_path": [
-        "Target path for symlinks."
-    ],
-    "threat.enrichments.indicator.file.type": [
-        "File type (file, dir, or symlink)."
-    ],
-    "threat.enrichments.indicator.file.uid": [
-        "The user ID (UID) or security identifier (SID) of the file owner."
-    ],
-    "threat.enrichments.indicator.first_seen": [
-        "The date and time when intelligence source first reported sighting this indicator."
-    ],
-    "threat.enrichments.indicator.geo.city_name": [
-        "City name."
-    ],
-    "threat.enrichments.indicator.geo.continent_code": [
-        "Two-letter code representing continent's name."
-    ],
-    "threat.enrichments.indicator.geo.continent_name": [
-        "Name of the continent."
-    ],
-    "threat.enrichments.indicator.geo.country_iso_code": [
-        "Country ISO code."
-    ],
-    "threat.enrichments.indicator.geo.country_name": [
-        "Country name."
-    ],
-    "threat.enrichments.indicator.geo.location": [
-        "Longitude and latitude."
-    ],
-    "threat.enrichments.indicator.geo.name": [
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
-    ],
-    "threat.enrichments.indicator.geo.postal_code": [
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
-    ],
-    "threat.enrichments.indicator.geo.region_iso_code": [
-        "Region ISO code."
-    ],
-    "threat.enrichments.indicator.geo.region_name": [
-        "Region name."
-    ],
-    "threat.enrichments.indicator.geo.timezone": [
-        "The time zone of the location, such as IANA time zone name."
-    ],
-    "threat.enrichments.indicator.ip": [
-        "Identifies a threat indicator as an IP address (irrespective of direction)."
-    ],
-    "threat.enrichments.indicator.last_seen": [
-        "The date and time when intelligence source last reported sighting this indicator."
-    ],
-    "threat.enrichments.indicator.marking.tlp": [
-        "Traffic Light Protocol sharing markings."
-    ],
-    "threat.enrichments.indicator.modified_at": [
-        "The date and time when intelligence source last modified information for this indicator."
-    ],
-    "threat.enrichments.indicator.port": [
-        "Identifies a threat indicator as a port number (irrespective of direction)."
-    ],
-    "threat.enrichments.indicator.provider": [
-        "The name of the indicator's provider."
-    ],
-    "threat.enrichments.indicator.reference": [
-        "Reference URL linking to additional information about this indicator."
-    ],
-    "threat.enrichments.indicator.registry.data.bytes": [
-        "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values."
-    ],
-    "threat.enrichments.indicator.registry.data.strings": [
-        "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`)."
-    ],
-    "threat.enrichments.indicator.registry.data.type": [
-        "Standard registry type for encoding contents"
-    ],
-    "threat.enrichments.indicator.registry.hive": [
-        "Abbreviated name for the hive."
-    ],
-    "threat.enrichments.indicator.registry.key": [
-        "Hive-relative path of keys."
-    ],
-    "threat.enrichments.indicator.registry.path": [
-        "Full path, including hive, key and value"
-    ],
-    "threat.enrichments.indicator.registry.value": [
-        "Name of the value written."
-    ],
-    "threat.enrichments.indicator.scanner_stats": [
-        "Count of AV/EDR vendors that successfully detected malicious file or URL."
-    ],
-    "threat.enrichments.indicator.sightings": [
-        "Number of times this indicator was observed conducting threat activity."
-    ],
-    "threat.enrichments.indicator.type": [
-        "Type of indicator as represented by Cyber Observable in STIX 2.0."
-    ],
-    "threat.enrichments.indicator.url.domain": [
-        "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field."
-    ],
-    "threat.enrichments.indicator.url.extension": [
-        "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
-    ],
-    "threat.enrichments.indicator.url.fragment": [
-        "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
-    ],
-    "threat.enrichments.indicator.url.full": [
-        "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source."
-    ],
-    "threat.enrichments.indicator.url.original": [
-        "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not."
-    ],
-    "threat.enrichments.indicator.url.password": [
-        "Password of the request."
-    ],
-    "threat.enrichments.indicator.url.path": [
-        "Path of the request, such as \"/search\"."
-    ],
-    "threat.enrichments.indicator.url.port": [
-        "Port of the request, such as 443."
-    ],
-    "threat.enrichments.indicator.url.query": [
-        "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
-    ],
-    "threat.enrichments.indicator.url.registered_domain": [
-        "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
-    ],
-    "threat.enrichments.indicator.url.scheme": [
-        "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme."
-    ],
-    "threat.enrichments.indicator.url.subdomain": [
-        "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period."
-    ],
-    "threat.enrichments.indicator.url.top_level_domain": [
-        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
-    ],
-    "threat.enrichments.indicator.url.username": [
-        "Username of the request."
-    ],
-    "threat.enrichments.indicator.x509.alternative_names": [
-        "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses."
-    ],
-    "threat.enrichments.indicator.x509.issuer.common_name": [
-        "List of common name (CN) of issuing certificate authority."
-    ],
-    "threat.enrichments.indicator.x509.issuer.country": [
-        "List of country \\(C) codes"
-    ],
-    "threat.enrichments.indicator.x509.issuer.distinguished_name": [
-        "Distinguished name (DN) of issuing certificate authority."
-    ],
-    "threat.enrichments.indicator.x509.issuer.locality": [
-        "List of locality names (L)"
-    ],
-    "threat.enrichments.indicator.x509.issuer.organization": [
-        "List of organizations (O) of issuing certificate authority."
-    ],
-    "threat.enrichments.indicator.x509.issuer.organizational_unit": [
-        "List of organizational units (OU) of issuing certificate authority."
-    ],
-    "threat.enrichments.indicator.x509.issuer.state_or_province": [
-        "List of state or province names (ST, S, or P)"
-    ],
-    "threat.enrichments.indicator.x509.not_after": [
-        "Time at which the certificate is no longer considered valid."
-    ],
-    "threat.enrichments.indicator.x509.not_before": [
-        "Time at which the certificate is first considered valid."
-    ],
-    "threat.enrichments.indicator.x509.public_key_algorithm": [
-        "Algorithm used to generate the public key."
-    ],
-    "threat.enrichments.indicator.x509.public_key_curve": [
-        "The curve used by the elliptic curve public key algorithm. This is algorithm specific."
-    ],
-    "threat.enrichments.indicator.x509.public_key_exponent": [
-        "Exponent used to derive the public key. This is algorithm specific."
-    ],
-    "threat.enrichments.indicator.x509.public_key_size": [
-        "The size of the public key space in bits."
-    ],
-    "threat.enrichments.indicator.x509.serial_number": [
-        "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters."
-    ],
-    "threat.enrichments.indicator.x509.signature_algorithm": [
-        "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353."
-    ],
-    "threat.enrichments.indicator.x509.subject.common_name": [
-        "List of common names (CN) of subject."
-    ],
-    "threat.enrichments.indicator.x509.subject.country": [
-        "List of country \\(C) code"
-    ],
-    "threat.enrichments.indicator.x509.subject.distinguished_name": [
-        "Distinguished name (DN) of the certificate subject entity."
-    ],
-    "threat.enrichments.indicator.x509.subject.locality": [
-        "List of locality names (L)"
-    ],
-    "threat.enrichments.indicator.x509.subject.organization": [
-        "List of organizations (O) of subject."
-    ],
-    "threat.enrichments.indicator.x509.subject.organizational_unit": [
-        "List of organizational units (OU) of subject."
-    ],
-    "threat.enrichments.indicator.x509.subject.state_or_province": [
-        "List of state or province names (ST, S, or P)"
-    ],
-    "threat.enrichments.indicator.x509.version_number": [
-        "Version of x509 format."
-    ],
-    "threat.enrichments.matched.atomic": [
-        "Identifies the atomic indicator value that matched a local environment endpoint or network event."
-    ],
-    "threat.enrichments.matched.field": [
-        "Identifies the field of the atomic indicator that matched a local environment endpoint or network event."
-    ],
-    "threat.enrichments.matched.id": [
-        "Identifies the _id of the indicator document enriching the event."
-    ],
-    "threat.enrichments.matched.index": [
-        "Identifies the _index of the indicator document enriching the event."
-    ],
-    "threat.enrichments.matched.type": [
-        "Identifies the type of match that caused the event to be enriched with the given indicator"
-    ],
-    "threat.framework": [
-        "Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events."
-    ],
-    "threat.group.alias": [
-        "The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK\u00ae group alias(es)."
-    ],
-    "threat.group.id": [
-        "The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK\u00ae group id."
-    ],
-    "threat.group.name": [
-        "The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK\u00ae group name."
-    ],
-    "threat.group.reference": [
-        "The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK\u00ae group reference URL."
-    ],
-    "threat.indicator.as.number": [
-        "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet."
-    ],
-    "threat.indicator.as.organization.name": [
-        "Organization name."
-    ],
-    "threat.indicator.confidence": [
-        "Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields."
-    ],
-    "threat.indicator.description": [
-        "Describes the type of action conducted by the threat."
-    ],
-    "threat.indicator.email.address": [
-        "Identifies a threat indicator as an email address (irrespective of direction)."
-    ],
-    "threat.indicator.file.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "threat.indicator.file.Ext.code_signature": [
-        "Nested version of ECS code_signature fieldset."
-    ],
-    "threat.indicator.file.Ext.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "threat.indicator.file.Ext.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "threat.indicator.file.Ext.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "threat.indicator.file.Ext.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "threat.indicator.file.Ext.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "threat.indicator.file.Ext.device.bus_type": [
-        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-    ],
-    "threat.indicator.file.Ext.device.dos_name": [
-        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-    ],
-    "threat.indicator.file.Ext.device.file_system_type": [
-        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-    ],
-    "threat.indicator.file.Ext.device.nt_name": [
-        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-    ],
-    "threat.indicator.file.Ext.device.product_id": [
-        "ProductID of the device. It is provided by the vendor of the device if any."
-    ],
-    "threat.indicator.file.Ext.device.serial_number": [
-        "Serial Number of the device. It is provided by the vendor of the device if any."
-    ],
-    "threat.indicator.file.Ext.device.vendor_id": [
-        "VendorID of the device. It is provided by the vendor of the device."
-    ],
-    "threat.indicator.file.Ext.device.volume_device_type": [
-        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-    ],
-    "threat.indicator.file.Ext.entropy": [
-        "Entropy calculation of file's header and footer used to check file integrity."
-    ],
-    "threat.indicator.file.Ext.entry_modified": [
-        "Time of last status change.  See `st_ctim` member of `struct stat`."
-    ],
-    "threat.indicator.file.Ext.header_bytes": [
-        "First 16 bytes of file used to check file integrity."
-    ],
-    "threat.indicator.file.Ext.header_data": [
-        "First 16 bytes of file used to check file integrity."
-    ],
-    "threat.indicator.file.Ext.malware_classification.features.data.buffer": [
-        "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-    ],
-    "threat.indicator.file.Ext.malware_classification.features.data.decompressed_size": [
-        "The decompressed size of buffer."
-    ],
-    "threat.indicator.file.Ext.malware_classification.features.data.encoding": [
-        "The encoding of buffer (e.g. zlib)."
-    ],
-    "threat.indicator.file.Ext.malware_classification.identifier": [
-        "The model's unique identifier."
-    ],
-    "threat.indicator.file.Ext.malware_classification.score": [
-        "The score produced by the classification model."
-    ],
-    "threat.indicator.file.Ext.malware_classification.threshold": [
-        "The score threshold for the model.  Files that score above this threshold are considered malicious."
-    ],
-    "threat.indicator.file.Ext.malware_classification.upx_packed": [
-        "Whether UPX packing was detected."
-    ],
-    "threat.indicator.file.Ext.malware_classification.version": [
-        "The version of the model used."
-    ],
-    "threat.indicator.file.Ext.malware_signature": [
-        "Nested version of malware_signature fieldset."
-    ],
-    "threat.indicator.file.Ext.malware_signature.all_names": [
-        "The concatenated names of all yara signatures"
-    ],
-    "threat.indicator.file.Ext.malware_signature.identifier": [
-        "Malware artifact identifier."
-    ],
-    "threat.indicator.file.Ext.malware_signature.primary": [
-        "Primary malware signature match."
-    ],
-    "threat.indicator.file.Ext.malware_signature.primary.matches": [
-        "An array of bytes representing yara signature matches"
-    ],
-    "threat.indicator.file.Ext.malware_signature.primary.signature": [
-        "Primary malware signature match."
-    ],
-    "threat.indicator.file.Ext.malware_signature.primary.signature.hash": [
-        "Primary malware signature hash."
-    ],
-    "threat.indicator.file.Ext.malware_signature.primary.signature.hash.sha256": [
-        "Primary malware signature sha256."
-    ],
-    "threat.indicator.file.Ext.malware_signature.primary.signature.id": [
-        "Primary malware signature id."
-    ],
-    "threat.indicator.file.Ext.malware_signature.primary.signature.name": [
-        "Primary malware signature name."
-    ],
-    "threat.indicator.file.Ext.malware_signature.secondary": [
-        "An array of malware signature matches"
-    ],
-    "threat.indicator.file.Ext.malware_signature.version": [
-        "Primary malware signature version."
-    ],
-    "threat.indicator.file.Ext.monotonic_id": [
-        "File event monotonic ID."
-    ],
-    "threat.indicator.file.Ext.original": [
-        "Original file information during a modification event."
-    ],
-    "threat.indicator.file.Ext.original.gid": [
-        "Primary group ID (GID) of the file."
-    ],
-    "threat.indicator.file.Ext.original.group": [
-        "Primary group name of the file."
-    ],
-    "threat.indicator.file.Ext.original.mode": [
-        "Original file mode prior to a modification event"
-    ],
-    "threat.indicator.file.Ext.original.name": [
-        "Original file name prior to a modification event"
-    ],
-    "threat.indicator.file.Ext.original.owner": [
-        "File owner's username."
-    ],
-    "threat.indicator.file.Ext.original.path": [
-        "Original file path prior to a modification event"
-    ],
-    "threat.indicator.file.Ext.original.uid": [
-        "The user ID (UID) or security identifier (SID) of the file owner."
-    ],
-    "threat.indicator.file.Ext.quarantine_message": [
-        "Message describing quarantine results."
-    ],
-    "threat.indicator.file.Ext.quarantine_path": [
-        "Path on endpoint the quarantined file was originally."
-    ],
-    "threat.indicator.file.Ext.quarantine_result": [
-        "Boolean representing whether or not file quarantine succeeded."
-    ],
-    "threat.indicator.file.Ext.temp_file_path": [
-        "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
-    ],
-    "threat.indicator.file.Ext.windows": [
-        "Platform-specific Windows fields"
-    ],
-    "threat.indicator.file.Ext.windows.zone_identifier": [
-        "Windows zone identifier for a file"
-    ],
-    "threat.indicator.file.accessed": [
-        "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-    ],
-    "threat.indicator.file.attributes": [
-        "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write."
-    ],
-    "threat.indicator.file.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "threat.indicator.file.code_signature.signing_id": [
-        "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only."
-    ],
-    "threat.indicator.file.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "threat.indicator.file.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "threat.indicator.file.code_signature.team_id": [
-        "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only."
-    ],
-    "threat.indicator.file.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "threat.indicator.file.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "threat.indicator.file.created": [
-        "File creation time.\nNote that not all filesystems store the creation time."
-    ],
-    "threat.indicator.file.ctime": [
-        "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-    ],
-    "threat.indicator.file.device": [
-        "Device that is the source of the file."
-    ],
-    "threat.indicator.file.directory": [
-        "Directory where the file is located. It should include the drive letter, when appropriate."
-    ],
-    "threat.indicator.file.drive_letter": [
-        "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon."
-    ],
-    "threat.indicator.file.elf.architecture": [
-        "Machine architecture of the ELF file."
-    ],
-    "threat.indicator.file.elf.byte_order": [
-        "Byte sequence of ELF file."
-    ],
-    "threat.indicator.file.elf.cpu_type": [
-        "CPU type of the ELF file."
-    ],
-    "threat.indicator.file.elf.creation_date": [
-        "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
-    ],
-    "threat.indicator.file.elf.exports": [
-        "List of exported element names and types."
-    ],
-    "threat.indicator.file.elf.go_import_hash": [
-        "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
-    ],
-    "threat.indicator.file.elf.go_imports": [
-        "List of imported Go language element names and types."
-    ],
-    "threat.indicator.file.elf.go_imports_names_entropy": [
-        "Shannon entropy calculation from the list of Go imports."
-    ],
-    "threat.indicator.file.elf.go_imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of Go imports."
-    ],
-    "threat.indicator.file.elf.go_stripped": [
-        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-    ],
-    "threat.indicator.file.elf.header.abi_version": [
-        "Version of the ELF Application Binary Interface (ABI)."
-    ],
-    "threat.indicator.file.elf.header.class": [
-        "Header class of the ELF file."
-    ],
-    "threat.indicator.file.elf.header.data": [
-        "Data table of the ELF header."
-    ],
-    "threat.indicator.file.elf.header.entrypoint": [
-        "Header entrypoint of the ELF file."
-    ],
-    "threat.indicator.file.elf.header.object_version": [
-        "\"0x1\" for original ELF files."
-    ],
-    "threat.indicator.file.elf.header.os_abi": [
-        "Application Binary Interface (ABI) of the Linux OS."
-    ],
-    "threat.indicator.file.elf.header.type": [
-        "Header type of the ELF file."
-    ],
-    "threat.indicator.file.elf.header.version": [
-        "Version of the ELF header."
-    ],
-    "threat.indicator.file.elf.import_hash": [
-        "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash."
-    ],
-    "threat.indicator.file.elf.imports": [
-        "List of imported element names and types."
-    ],
-    "threat.indicator.file.elf.imports_names_entropy": [
-        "Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "threat.indicator.file.elf.imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "threat.indicator.file.elf.sections": [
-        "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
-    ],
-    "threat.indicator.file.elf.sections.chi2": [
-        "Chi-square probability distribution of the section."
-    ],
-    "threat.indicator.file.elf.sections.entropy": [
-        "Shannon entropy calculation from the section."
-    ],
-    "threat.indicator.file.elf.sections.flags": [
-        "ELF Section List flags."
-    ],
-    "threat.indicator.file.elf.sections.name": [
-        "ELF Section List name."
-    ],
-    "threat.indicator.file.elf.sections.physical_offset": [
-        "ELF Section List offset."
-    ],
-    "threat.indicator.file.elf.sections.physical_size": [
-        "ELF Section List physical size."
-    ],
-    "threat.indicator.file.elf.sections.type": [
-        "ELF Section List type."
-    ],
-    "threat.indicator.file.elf.sections.var_entropy": [
-        "Variance for Shannon entropy calculation from the section."
-    ],
-    "threat.indicator.file.elf.sections.virtual_address": [
-        "ELF Section List virtual address."
-    ],
-    "threat.indicator.file.elf.sections.virtual_size": [
-        "ELF Section List virtual size."
-    ],
-    "threat.indicator.file.elf.segments": [
-        "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
-    ],
-    "threat.indicator.file.elf.segments.sections": [
-        "ELF object segment sections."
-    ],
-    "threat.indicator.file.elf.segments.type": [
-        "ELF object segment type."
-    ],
-    "threat.indicator.file.elf.shared_libraries": [
-        "List of shared libraries used by this ELF object."
-    ],
-    "threat.indicator.file.elf.telfhash": [
-        "telfhash symbol hash for ELF file."
-    ],
-    "threat.indicator.file.extension": [
-        "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
-    ],
-    "threat.indicator.file.gid": [
-        "Primary group ID (GID) of the file."
-    ],
-    "threat.indicator.file.group": [
-        "Primary group name of the file."
-    ],
-    "threat.indicator.file.hash.md5": [
-        "MD5 hash."
-    ],
-    "threat.indicator.file.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "threat.indicator.file.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "threat.indicator.file.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "threat.indicator.file.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "threat.indicator.file.inode": [
-        "Inode representing the file in the filesystem."
-    ],
-    "threat.indicator.file.mime_type": [
-        "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-    ],
-    "threat.indicator.file.mode": [
-        "Mode of the file in octal representation."
-    ],
-    "threat.indicator.file.mtime": [
-        "Last time the file content was modified."
-    ],
-    "threat.indicator.file.name": [
-        "Name of the file including the extension, without the directory."
-    ],
-    "threat.indicator.file.owner": [
-        "File owner's username."
-    ],
-    "threat.indicator.file.path": [
-        "Full path to the file, including the file name. It should include the drive letter, when appropriate."
-    ],
-    "threat.indicator.file.pe.architecture": [
-        "CPU architecture target for the file."
-    ],
-    "threat.indicator.file.pe.company": [
-        "Internal company name of the file, provided at compile-time."
-    ],
-    "threat.indicator.file.pe.description": [
-        "Internal description of the file, provided at compile-time."
-    ],
-    "threat.indicator.file.pe.file_version": [
-        "Internal version of the file, provided at compile-time."
-    ],
-    "threat.indicator.file.pe.imphash": [
-        "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html."
-    ],
-    "threat.indicator.file.pe.original_file_name": [
-        "Internal name of the file, provided at compile-time."
-    ],
-    "threat.indicator.file.pe.product": [
-        "Internal product name of the file, provided at compile-time."
-    ],
-    "threat.indicator.file.size": [
-        "File size in bytes.\nOnly relevant when `file.type` is \"file\"."
-    ],
-    "threat.indicator.file.target_path": [
-        "Target path for symlinks."
-    ],
-    "threat.indicator.file.type": [
-        "File type (file, dir, or symlink)."
-    ],
-    "threat.indicator.file.uid": [
-        "The user ID (UID) or security identifier (SID) of the file owner."
-    ],
-    "threat.indicator.first_seen": [
-        "The date and time when intelligence source first reported sighting this indicator."
-    ],
-    "threat.indicator.geo.city_name": [
-        "City name."
-    ],
-    "threat.indicator.geo.continent_code": [
-        "Two-letter code representing continent's name."
-    ],
-    "threat.indicator.geo.continent_name": [
-        "Name of the continent."
-    ],
-    "threat.indicator.geo.country_iso_code": [
-        "Country ISO code."
-    ],
-    "threat.indicator.geo.country_name": [
-        "Country name."
-    ],
-    "threat.indicator.geo.location": [
-        "Longitude and latitude."
-    ],
-    "threat.indicator.geo.name": [
-        "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation."
-    ],
-    "threat.indicator.geo.postal_code": [
-        "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country."
-    ],
-    "threat.indicator.geo.region_iso_code": [
-        "Region ISO code."
-    ],
-    "threat.indicator.geo.region_name": [
-        "Region name."
-    ],
-    "threat.indicator.geo.timezone": [
-        "The time zone of the location, such as IANA time zone name."
-    ],
-    "threat.indicator.ip": [
-        "Identifies a threat indicator as an IP address (irrespective of direction)."
-    ],
-    "threat.indicator.last_seen": [
-        "The date and time when intelligence source last reported sighting this indicator."
-    ],
-    "threat.indicator.marking.tlp": [
-        "Traffic Light Protocol sharing markings."
-    ],
-    "threat.indicator.modified_at": [
-        "The date and time when intelligence source last modified information for this indicator."
-    ],
-    "threat.indicator.port": [
-        "Identifies a threat indicator as a port number (irrespective of direction)."
-    ],
-    "threat.indicator.provider": [
-        "The name of the indicator's provider."
-    ],
-    "threat.indicator.reference": [
-        "Reference URL linking to additional information about this indicator."
-    ],
-    "threat.indicator.registry.data.bytes": [
-        "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values."
-    ],
-    "threat.indicator.registry.data.strings": [
-        "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`)."
-    ],
-    "threat.indicator.registry.data.type": [
-        "Standard registry type for encoding contents"
-    ],
-    "threat.indicator.registry.hive": [
-        "Abbreviated name for the hive."
-    ],
-    "threat.indicator.registry.key": [
-        "Hive-relative path of keys."
-    ],
-    "threat.indicator.registry.path": [
-        "Full path, including hive, key and value"
-    ],
-    "threat.indicator.registry.value": [
-        "Name of the value written."
-    ],
-    "threat.indicator.scanner_stats": [
-        "Count of AV/EDR vendors that successfully detected malicious file or URL."
-    ],
-    "threat.indicator.sightings": [
-        "Number of times this indicator was observed conducting threat activity."
-    ],
-    "threat.indicator.type": [
-        "Type of indicator as represented by Cyber Observable in STIX 2.0."
-    ],
-    "threat.indicator.url.domain": [
-        "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field."
-    ],
-    "threat.indicator.url.extension": [
-        "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\")."
-    ],
-    "threat.indicator.url.fragment": [
-        "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
-    ],
-    "threat.indicator.url.full": [
-        "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source."
-    ],
-    "threat.indicator.url.original": [
-        "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not."
-    ],
-    "threat.indicator.url.password": [
-        "Password of the request."
-    ],
-    "threat.indicator.url.path": [
-        "Path of the request, such as \"/search\"."
-    ],
-    "threat.indicator.url.port": [
-        "Port of the request, such as 443."
-    ],
-    "threat.indicator.url.query": [
-        "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
-    ],
-    "threat.indicator.url.registered_domain": [
-        "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
-    ],
-    "threat.indicator.url.scheme": [
-        "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme."
-    ],
-    "threat.indicator.url.subdomain": [
-        "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period."
-    ],
-    "threat.indicator.url.top_level_domain": [
-        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
-    ],
-    "threat.indicator.url.username": [
-        "Username of the request."
-    ],
-    "threat.indicator.x509.alternative_names": [
-        "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses."
-    ],
-    "threat.indicator.x509.issuer.common_name": [
-        "List of common name (CN) of issuing certificate authority."
-    ],
-    "threat.indicator.x509.issuer.country": [
-        "List of country \\(C) codes"
-    ],
-    "threat.indicator.x509.issuer.distinguished_name": [
-        "Distinguished name (DN) of issuing certificate authority."
-    ],
-    "threat.indicator.x509.issuer.locality": [
-        "List of locality names (L)"
-    ],
-    "threat.indicator.x509.issuer.organization": [
-        "List of organizations (O) of issuing certificate authority."
-    ],
-    "threat.indicator.x509.issuer.organizational_unit": [
-        "List of organizational units (OU) of issuing certificate authority."
-    ],
-    "threat.indicator.x509.issuer.state_or_province": [
-        "List of state or province names (ST, S, or P)"
-    ],
-    "threat.indicator.x509.not_after": [
-        "Time at which the certificate is no longer considered valid."
-    ],
-    "threat.indicator.x509.not_before": [
-        "Time at which the certificate is first considered valid."
-    ],
-    "threat.indicator.x509.public_key_algorithm": [
-        "Algorithm used to generate the public key."
-    ],
-    "threat.indicator.x509.public_key_curve": [
-        "The curve used by the elliptic curve public key algorithm. This is algorithm specific."
-    ],
-    "threat.indicator.x509.public_key_exponent": [
-        "Exponent used to derive the public key. This is algorithm specific."
-    ],
-    "threat.indicator.x509.public_key_size": [
-        "The size of the public key space in bits."
-    ],
-    "threat.indicator.x509.serial_number": [
-        "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters."
-    ],
-    "threat.indicator.x509.signature_algorithm": [
-        "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353."
-    ],
-    "threat.indicator.x509.subject.common_name": [
-        "List of common names (CN) of subject."
-    ],
-    "threat.indicator.x509.subject.country": [
-        "List of country \\(C) code"
-    ],
-    "threat.indicator.x509.subject.distinguished_name": [
-        "Distinguished name (DN) of the certificate subject entity."
-    ],
-    "threat.indicator.x509.subject.locality": [
-        "List of locality names (L)"
-    ],
-    "threat.indicator.x509.subject.organization": [
-        "List of organizations (O) of subject."
-    ],
-    "threat.indicator.x509.subject.organizational_unit": [
-        "List of organizational units (OU) of subject."
-    ],
-    "threat.indicator.x509.subject.state_or_province": [
-        "List of state or province names (ST, S, or P)"
-    ],
-    "threat.indicator.x509.version_number": [
-        "Version of x509 format."
-    ],
-    "threat.software.id": [
-        "The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use a MITRE ATT&CK\u00ae software id."
-    ],
-    "threat.software.name": [
-        "The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use a MITRE ATT&CK\u00ae software name."
-    ],
-    "threat.software.platforms": [
-        "The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use MITRE ATT&CK\u00ae software platform values."
-    ],
-    "threat.software.reference": [
-        "The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use a MITRE ATT&CK\u00ae software reference URL."
-    ],
-    "threat.software.type": [
-        "The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK\u00ae.\nWhile not required, you can use a MITRE ATT&CK\u00ae software type."
-    ],
-    "threat.tactic.id": [
-        "The id of tactic used by this threat. You can use a MITRE ATT&CK\u00ae tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )"
-    ],
-    "threat.tactic.name": [
-        "Name of the type of tactic used by this threat. You can use a MITRE ATT&CK\u00ae tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)"
-    ],
-    "threat.tactic.reference": [
-        "The reference url of tactic used by this threat. You can use a MITRE ATT&CK\u00ae tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )"
-    ],
-    "threat.technique.id": [
-        "The id of technique used by this threat. You can use a MITRE ATT&CK\u00ae technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)"
-    ],
-    "threat.technique.name": [
-        "The name of technique used by this threat. You can use a MITRE ATT&CK\u00ae technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)"
-    ],
-    "threat.technique.reference": [
-        "The reference url of technique used by this threat. You can use a MITRE ATT&CK\u00ae technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)"
-    ],
-    "threat.technique.subtechnique.id": [
-        "The full id of subtechnique used by this threat. You can use a MITRE ATT&CK\u00ae subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)"
-    ],
-    "threat.technique.subtechnique.name": [
-        "The name of subtechnique used by this threat. You can use a MITRE ATT&CK\u00ae subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)"
-    ],
-    "threat.technique.subtechnique.reference": [
-        "The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK\u00ae subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)"
-    ],
-    "user.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "user.Ext.real": [
-        "User info prior to any setuid operations.",
-        "User info prior to any setuid operations.",
-        "User info prior to any setuid operations.",
-        "User info prior to any setuid operations.",
-        "User info prior to any setuid operations.",
-        "User info prior to any setuid operations.",
-        "User info prior to any setuid operations."
-    ],
-    "user.Ext.real.id": [
-        "One or multiple unique identifiers of the user.",
-        "One or multiple unique identifiers of the user.",
-        "One or multiple unique identifiers of the user.",
-        "One or multiple unique identifiers of the user.",
-        "One or multiple unique identifiers of the user.",
-        "One or multiple unique identifiers of the user.",
-        "One or multiple unique identifiers of the user."
-    ],
-    "user.Ext.real.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "user.domain": [
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name.",
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-    ],
-    "user.email": [
-        "User email address.",
-        "User email address.",
-        "User email address.",
-        "User email address.",
-        "User email address.",
-        "User email address.",
-        "User email address."
-    ],
-    "user.full_name": [
-        "User's full name, if available.",
-        "User's full name, if available.",
-        "User's full name, if available.",
-        "User's full name, if available.",
-        "User's full name, if available.",
-        "User's full name, if available.",
-        "User's full name, if available."
-    ],
-    "user.group.Ext": [
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in.",
-        "Object for all custom defined fields to live in."
-    ],
-    "user.group.Ext.real": [
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations.",
-        "Group info prior to any setgid operations."
-    ],
-    "user.group.Ext.real.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "user.group.Ext.real.name": [
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "user.group.domain": [
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name.",
-        "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-    ],
-    "user.group.id": [
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform.",
-        "Unique identifier for the group on the system/platform."
-    ],
-    "user.group.name": [
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group.",
-        "Name of the group."
-    ],
-    "user.hash": [
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used.",
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-    ],
-    "user.id": [
-        "Unique identifier of the user.",
-        "Unique identifier of the user.",
-        "Unique identifier of the user.",
-        "Unique identifier of the user.",
-        "Unique identifier of the user.",
-        "Unique identifier of the user.",
-        "Unique identifier of the user.",
-        "Unique identifier of the user.",
-        "Unique identifier of the user."
-    ],
-    "user.name": [
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user.",
-        "Short name or login of the user."
-    ],
-    "Endpoint.configuration": [
-        "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state",
-        "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
-    ],
-    "Endpoint.configuration.isolation": [
-        "Configuration setting for Host Isolation from the network",
-        "Configuration setting for Host Isolation from the network"
-    ],
-    "Endpoint.policy.applied.actions": [
-        "actions applied during the application of the policy"
-    ],
-    "Endpoint.policy.applied.actions.message": [
-        "message about the application of the action to further qualify the status of the action"
-    ],
-    "Endpoint.policy.applied.actions.name": [
-        "name of the action that was applied"
-    ],
-    "Endpoint.policy.applied.actions.status": [
-        "the status of the action"
-    ],
-    "Endpoint.policy.applied.endpoint_policy_version": [
-        "the version of this applied policy"
-    ],
-    "Endpoint.policy.applied.response": [
-        "the response of actions that failed in the applied policy"
-    ],
-    "Endpoint.policy.applied.response.configurations": [
-        "the configurations of the applied policy"
-    ],
-    "Endpoint.policy.applied.response.configurations.antivirus_registration": [
-        "overall antivirus registration configuration and status of the applied policy"
-    ],
-    "Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions": [
-        "all actions that were taken for antivirus registration"
-    ],
-    "Endpoint.policy.applied.response.configurations.antivirus_registration.status": [
-        "the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions": [
-        "all actions that were taken for attack surface reduction"
-    ],
-    "Endpoint.policy.applied.response.configurations.attack_surface_reduction.status": [
-        "the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions": [
-        "all actions that were taken for behavior_protection"
-    ],
-    "Endpoint.policy.applied.response.configurations.behavior_protection.status": [
-        "the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.configurations.events": [
-        "overall event collection configuration and status of the applied policy"
-    ],
-    "Endpoint.policy.applied.response.configurations.events.concerned_actions": [
-        "all actions that were taken for event collection"
-    ],
-    "Endpoint.policy.applied.response.configurations.events.status": [
-        "the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions": [
-        "all actions that were taken for host isolation"
-    ],
-    "Endpoint.policy.applied.response.configurations.host_isolation.status": [
-        "the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.configurations.logging": [
-        "overall logging configuration and status of the applied policy"
-    ],
-    "Endpoint.policy.applied.response.configurations.logging.concerned_actions": [
-        "all actions that were taken for logging"
-    ],
-    "Endpoint.policy.applied.response.configurations.logging.status": [
-        "the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.configurations.malware": [
-        "overall malware configuration and status of the applied policy"
-    ],
-    "Endpoint.policy.applied.response.configurations.malware.concerned_actions": [
-        "all actions that were taken for malware"
-    ],
-    "Endpoint.policy.applied.response.configurations.malware.status": [
-        "the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.configurations.memory_protection": [
-        "overall memory_protection configuration and status of the applied policy"
-    ],
-    "Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions": [
-        "all actions that were taken for memory_protection"
-    ],
-    "Endpoint.policy.applied.response.configurations.memory_protection.status": [
-        "the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.configurations.ransomware.concerned_actions": [
-        "all actions that were taken for ransomware"
-    ],
-    "Endpoint.policy.applied.response.configurations.ransomware.status": [
-        "the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.configurations.streaming": [
-        "overall data streaming configuration and status of the applied policy"
-    ],
-    "Endpoint.policy.applied.response.configurations.streaming.concerned_actions": [
-        "all actions that were taken for data streaming"
-    ],
-    "Endpoint.policy.applied.response.configurations.streaming.status": [
-        "the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.diagnostic": [
-        "the diagnostic configurations of the applied policy"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions": [
-        "all actions that were taken for the diagnostic configuration of behavior protection"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.behavior_protection.status": [
-        "the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.credential_protection.concerned_actions": [
-        "all actions that were taken for the diagnostic configuration of credential protection"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.credential_protection.status": [
-        "the overall status of the diagnostic configuration of credential protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.malware.concerned_actions": [
-        "all actions that were taken for the diagnostic configuration of malware"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.malware.status": [
-        "the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions": [
-        "all actions that were taken for the diagnostic configuration of memory protection"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.memory_protection.status": [
-        "the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.memory_scan.concerned_actions": [
-        "all actions that were taken for the diagnostic configuration of memory scan"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.memory_scan.status": [
-        "the overall status of the diagnostic configuration of memory scan, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions": [
-        "all actions that were taken for the diagnostic configuration of ransomware"
-    ],
-    "Endpoint.policy.applied.response.diagnostic.ransomware.status": [
-        "the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-    ],
-    "Endpoint.state": [
-        "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)",
-        "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
-    ],
-    "Endpoint.state.isolation": [
-        "Current network isolation state of the host",
-        "Current network isolation state of the host"
-    ],
-    "agent.build.original": [
-        "Extended build information for the agent.\nThis field is intended to contain any build information that a data source may provide, no specific formatting is required."
-    ],
-    "Effective_process.entity_id": [
-        "Unique identifier for the effective process.",
-        "Unique identifier for the effective process.",
-        "Unique identifier for the effective process."
-    ],
-    "Effective_process.executable": [
-        "Executable name for the effective process.",
-        "Executable name for the effective process.",
-        "Executable name for the effective process."
-    ],
-    "Effective_process.name": [
-        "Process name for the effective process.",
-        "Process name for the effective process.",
-        "Process name for the effective process."
-    ],
-    "Effective_process.pid": [
-        "Process ID.",
-        "Process ID.",
-        "Process ID."
-    ],
-    "process.thread.Ext.call_stack.allocation_private_bytes": [
-        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing.",
-        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing.",
-        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing.",
-        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-    ],
-    "process.thread.Ext.call_stack.callsite_leading_bytes": [
-        "Hex opcode bytes preceding the callsite",
-        "Hex opcode bytes preceding the callsite",
-        "Hex opcode bytes preceding the callsite",
-        "Hex opcode bytes preceding the callsite"
-    ],
-    "process.thread.Ext.call_stack.callsite_trailing_bytes": [
-        "Hex opcode bytes after the callsite (where control will return to)",
-        "Hex opcode bytes after the callsite (where control will return to)",
-        "Hex opcode bytes after the callsite (where control will return to)",
-        "Hex opcode bytes after the callsite (where control will return to)"
-    ],
-    "process.thread.Ext.call_stack.protection": [
-        "Protection of the page containing this instruction.  This is `R-X' by default if omitted.",
-        "Protection of the page containing this instruction.  This is `R-X' by default if omitted.",
-        "Protection of the page containing this instruction.  This is `R-X' by default if omitted.",
-        "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-    ],
-    "registry.data.bytes": [
-        "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values."
-    ],
-    "registry.data.type": [
-        "Standard registry type for encoding contents"
-    ],
-    "registry.hive": [
-        "Abbreviated name for the hive."
-    ],
-    "registry.key": [
-        "Hive-relative path of keys."
-    ],
-    "container.image.hash.all": [
-        "An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set."
-    ],
-    "orchestrator.cluster.id": [
-        "Unique ID of the cluster."
-    ],
-    "orchestrator.resource.ip": [
-        "IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running)."
-    ],
-    "orchestrator.resource.parent.type": [
-        "Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet)."
-    ],
-    "package.name": [
-        "Package name"
-    ],
-    "process.Ext.defense_evasions": [
-        "List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping."
-    ],
-    "process.Ext.device.bus_type": [
-        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-    ],
-    "process.Ext.device.dos_name": [
-        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-    ],
-    "process.Ext.device.file_system_type": [
-        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-    ],
-    "process.Ext.device.nt_name": [
-        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-    ],
-    "process.Ext.device.product_id": [
-        "ProductID of the device. It is provided by the vendor of the device if any."
-    ],
-    "process.Ext.device.serial_number": [
-        "Serial Number of the device. It is provided by the vendor of the device if any."
-    ],
-    "process.Ext.device.vendor_id": [
-        "VendorID of the device. It is provided by the vendor of the device."
-    ],
-    "process.Ext.device.volume_device_type": [
-        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-    ],
-    "process.Ext.effective_parent.entity_id": [
-        "Unique identifier for the effective process."
-    ],
-    "process.Ext.effective_parent.executable": [
-        "Executable name for the effective process."
-    ],
-    "process.Ext.effective_parent.name": [
-        "Process name for the effective process."
-    ],
-    "process.Ext.effective_parent.pid": [
-        "Process ID."
-    ],
-    "process.Ext.memfd": [
-        "Object for memfd events."
-    ],
-    "process.Ext.memfd.flag_allow_seal": [
-        "Allow sealing operations on this file."
-    ],
-    "process.Ext.memfd.flag_cloexec": [
-        "Sets the the close-on-exec flag on the new file descriptor."
-    ],
-    "process.Ext.memfd.flag_exec": [
-        "Exec flag is set for file."
-    ],
-    "process.Ext.memfd.flag_hugetlb": [
-        "The anonymous file will be created in the hugetlbfs filesystem using huge pages."
-    ],
-    "process.Ext.memfd.flag_noexec_seal": [
-        "Sets both NOEXEC and MFD_ALLOW_SEALING."
-    ],
-    "process.Ext.memfd.flags": [
-        "Flags passed to the memfd operation."
-    ],
-    "process.Ext.memfd.name": [
-        "Filename for the created file. Appears in /proc/self/fd."
-    ],
-    "process.Ext.mitigation_policies": [
-        "Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled"
-    ],
-    "process.Ext.ptrace": [
-        "Object for ptrace events."
-    ],
-    "process.Ext.ptrace.child_pid": [
-        "PID of the ptrace target."
-    ],
-    "process.Ext.ptrace.request": [
-        "ptrace request."
-    ],
-    "process.Ext.relative_file_creation_time": [
-        "Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future."
-    ],
-    "process.Ext.relative_file_name_modify_time": [
-        "Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
-    ],
-    "process.Ext.session_info.authentication_package": [
-        "Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP"
-    ],
-    "process.Ext.session_info.client_address": [
-        "Client's IPv4 or IPv6 address as a string, if available."
-    ],
-    "process.Ext.session_info.id": [
-        "Session ID"
-    ],
-    "process.Ext.session_info.logon_type": [
-        "Session logon type.  Examples include Interactive, Network, and Service."
-    ],
-    "process.Ext.session_info.relative_logon_time": [
-        "Process creation time, relative to logon time, in seconds."
-    ],
-    "process.Ext.session_info.relative_password_age": [
-        "Process creation time, relative to the last time the password was changed, in seconds."
-    ],
-    "process.Ext.session_info.user_flags": [
-        "List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON."
-    ],
-    "process.Ext.shmget": [
-        "Object for shmget events."
-    ],
-    "process.Ext.shmget.flags": [
-        "flags passed to shmget."
-    ],
-    "process.Ext.shmget.key": [
-        "Key passed to the shmget request."
-    ],
-    "process.Ext.shmget.size": [
-        "Requested size."
-    ],
-    "process.Ext.token.elevation_level": [
-        "What level of elevation the token has"
-    ],
-    "process.Ext.token.security_attributes": [
-        "Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class."
-    ],
-    "process.Ext.trusted": [
-        "Whether or not the process is a trusted application"
-    ],
-    "process.Ext.trusted_descendant": [
-        "Whether or not the process is a descendent of a trusted application"
-    ],
-    "process.end": [
-        "The time the process ended."
-    ],
-    "process.entry_leader.attested_groups.name": [
-        "Name of the group."
-    ],
-    "process.entry_leader.attested_user.id": [
-        "Unique identifier of the user."
-    ],
-    "process.entry_leader.attested_user.name": [
-        "Short name or login of the user."
-    ],
-    "process.group.id": [
-        "Unique identifier for the group on the system/platform."
-    ],
-    "process.group.name": [
-        "Name of the group."
-    ],
-    "process.io": [
-        "A chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input."
-    ],
-    "process.io.max_bytes_per_process_exceeded": [
-        "If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting."
-    ],
-    "process.io.text": [
-        "A chunk of output or input sanitized to UTF-8.\nBest efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word."
-    ],
-    "process.io.total_bytes_captured": [
-        "The total number of bytes captured in this event."
-    ],
-    "process.io.total_bytes_skipped": [
-        "The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero"
-    ],
-    "process.parent.thread.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "process.parent.thread.Ext.call_stack": [
-        "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame."
-    ],
-    "process.parent.thread.Ext.call_stack.allocation_private_bytes": [
-        "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-    ],
-    "process.parent.thread.Ext.call_stack.callsite_leading_bytes": [
-        "Hex opcode bytes preceding the callsite"
-    ],
-    "process.parent.thread.Ext.call_stack.callsite_trailing_bytes": [
-        "Hex opcode bytes after the callsite (where control will return to)"
-    ],
-    "process.parent.thread.Ext.call_stack.protection": [
-        "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-    ],
-    "process.parent.thread.Ext.call_stack.symbol_info": [
-        "The nearest symbol for `instruction_pointer`."
-    ],
-    "process.parent.thread.Ext.call_stack_contains_unbacked": [
-        "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
-    ],
-    "process.parent.thread.Ext.call_stack_summary": [
-        "Concatentation of the non-repeated modules in the call stack."
-    ],
-    "process.parent.thread.Ext.hardware_breakpoint_set": [
-        "Whether a hardware breakpoint was set for the thread. This field is omitted if false."
-    ],
-    "process.thread.capabilities.effective": [
-        "This is the set of capabilities used by the kernel to perform permission checks for the thread."
-    ],
-    "process.thread.capabilities.permitted": [
-        "This is a limiting superset for the effective capabilities that the thread may assume."
-    ],
-    "process.tty.columns": [
-        "The number of character columns per line. e.g terminal width\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'"
-    ],
-    "process.tty.rows": [
-        "The number of character rows in the terminal. e.g terminal height\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'"
-    ],
-    "user.effective.domain": [
-        "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-    ],
-    "user.effective.email": [
-        "User email address."
-    ],
-    "user.effective.full_name": [
-        "User's full name, if available."
-    ],
-    "user.effective.hash": [
-        "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-    ],
-    "user.effective.id": [
-        "Unique identifier of the user."
-    ],
-    "user.effective.name": [
-        "Short name or login of the user."
-    ],
-    "winlog.event_data": [
-        "The event-specific data. This is a non-exhaustive list of parameters that are used in Windows events."
-    ],
-    "winlog.event_data.PrivilegeList": [
-        "An array of sensitive privileges, assigned to the new logon."
-    ],
-    "Endpoint.capabilities": [
-        "Enabled capabilities"
-    ],
-    "Endpoint.status": [
-        "The current status of the endpoint e.g. enrolled, unenrolled."
-    ],
-    "action_id": [
-        "The action id",
-        "The action id"
-    ],
-    "agent_id": [
-        "Alias field that maps to {agent: {id}}"
-    ],
-    "completed_at": [
-        "Request completion timestamp when the response is done executing. Usually matches with @timestamp."
-    ],
-    "data.alert_id": [
-        "List of alert ids that triggered the action",
-        "List of alert ids that triggered the action"
-    ],
-    "data.command": [
-        "The action that is requested",
-        "The action that is requested"
-    ],
-    "data.comment": [
-        "A comment that describes the action that is requested",
-        "A comment that describes the action that is requested"
-    ],
-    "started_at": [
-        "Timestamp of start of request"
-    ],
-    "status": [
-        "The status of the request that distinguishes if the request is queued, running or completed."
-    ],
-    "EndpointActions.action_id": [
-        "The action id",
-        "The action id"
-    ],
-    "EndpointActions.completed_at": [
-        "Request completion timestamp when the response is done executing. Usually matches with @timestamp."
-    ],
-    "EndpointActions.data": [
-        "The action request information",
-        "The action request information"
-    ],
-    "EndpointActions.data.alert_id": [
-        "List of alert ids that triggered the action",
-        "List of alert ids that triggered the action"
-    ],
-    "EndpointActions.data.command": [
-        "The action that is requested",
-        "The action that is requested"
-    ],
-    "EndpointActions.data.comment": [
-        "A comment that describes the action that is requested",
-        "A comment that describes the action that is requested"
-    ],
-    "EndpointActions.started_at": [
-        "Timestamp of start of request"
-    ],
-    "EndpointActions.status": [
-        "The status of the request that distinguishes if the request is queued, running or completed."
-    ],
-    "error.code": [
-        "Error code describing the error.",
-        "Error code describing the error."
-    ],
-    "error.id": [
-        "Unique identifier for the error.",
-        "Unique identifier for the error."
-    ],
-    "error.message": [
-        "Error message.",
-        "Error message."
-    ],
-    "error.stack_trace": [
-        "The stack trace of this error in plain text.",
-        "The stack trace of this error in plain text."
-    ],
-    "error.type": [
-        "The type of the error, for example the class name of the exception.",
-        "The type of the error, for example the class name of the exception."
-    ],
-    "event.end": [
-        "`event.end` contains the date when the event ended or when the activity was last observed.",
-        "`event.end` contains the date when the event ended or when the activity was last observed.",
-        "`event.end` contains the date when the event ended or when the activity was last observed.",
-        "`event.end` contains the date when the event ended or when the activity was last observed."
-    ],
-    "event.start": [
-        "`event.start` contains the date when the event started or when the activity was first observed.",
-        "`event.start` contains the date when the event started or when the activity was first observed.",
-        "`event.start` contains the date when the event started or when the activity was first observed.",
-        "`event.start` contains the date when the event started or when the activity was first observed."
-    ],
-    "dll.Ext.defense_evasions": [
-        "List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump."
-    ],
-    "dll.Ext.device.bus_type": [
-        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-    ],
-    "dll.Ext.device.dos_name": [
-        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-    ],
-    "dll.Ext.device.file_system_type": [
-        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-    ],
-    "dll.Ext.device.nt_name": [
-        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-    ],
-    "dll.Ext.device.product_id": [
-        "ProductID of the device. It is provided by the vendor of the device if any."
-    ],
-    "dll.Ext.device.serial_number": [
-        "Serial Number of the device. It is provided by the vendor of the device if any."
-    ],
-    "dll.Ext.device.vendor_id": [
-        "VendorID of the device. It is provided by the vendor of the device."
-    ],
-    "dll.Ext.device.volume_device_type": [
-        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-    ],
-    "dll.Ext.load_index": [
-        "A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.\nThe first load index is 1."
-    ],
-    "dll.Ext.relative_file_creation_time": [
-        "Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future."
-    ],
-    "dll.Ext.relative_file_name_modify_time": [
-        "Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
-    ],
-    "dll.Ext.size": [
-        "Size of DLL"
-    ],
-    "billable": [
-        "Whether document should be included in billing calculations"
-    ],
-    "agents": [
-        "Alias field that maps to {agent: {id}}"
-    ],
-    "expiration": [
-        "Request expiration timestamp"
-    ],
-    "input_type": [
-        "The input type of the action, distinguishes endpoint actions as `endpoint`"
-    ],
-    "type": [
-        "Distinguishes the type of input. Usually set to `INPUT_ACTION`"
-    ],
-    "user_id": [
-        "The user id"
-    ],
-    "EndpointActions.expiration": [
-        "Request expiration timestamp"
-    ],
-    "EndpointActions.input_type": [
-        "The input type of the action, distinguishes endpoint actions as `endpoint`"
-    ],
-    "EndpointActions.type": [
-        "Distinguishes the type of input. Usually set to `INPUT_ACTION`"
-    ],
-    "Persistence.args": [
-        "Arguments used to execute the persistence item"
-    ],
-    "Persistence.executable": [
-        "The persistence item's executable"
-    ],
-    "Persistence.keepalive": [
-        "Keep alive option boolean"
-    ],
-    "Persistence.name": [
-        "The persistence item's name"
-    ],
-    "Persistence.path": [
-        "The file's path"
-    ],
-    "Persistence.runatload": [
-        "Run at load option boolean"
-    ],
-    "event.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "event.Ext.correlation": [
-        "Information about event this should be correlated with."
-    ],
-    "event.Ext.correlation.id": [
-        "ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event"
-    ],
-    "file.Ext.device.bus_type": [
-        "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-    ],
-    "file.Ext.device.dos_name": [
-        "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-    ],
-    "file.Ext.device.file_system_type": [
-        "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-    ],
-    "file.Ext.device.nt_name": [
-        "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-    ],
-    "file.Ext.device.product_id": [
-        "ProductID of the device. It is provided by the vendor of the device if any."
-    ],
-    "file.Ext.device.serial_number": [
-        "Serial Number of the device. It is provided by the vendor of the device if any."
-    ],
-    "file.Ext.device.vendor_id": [
-        "VendorID of the device. It is provided by the vendor of the device."
-    ],
-    "file.Ext.device.volume_device_type": [
-        "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-    ],
-    "file.Ext.entropy": [
-        "Entropy calculation of file's header and footer used to check file integrity."
-    ],
-    "file.Ext.header_bytes": [
-        "First 16 bytes of file used to check file integrity."
-    ],
-    "file.Ext.header_data": [
-        "First 16 bytes of file used to check file integrity."
-    ],
-    "file.Ext.malware_signature": [
-        "Nested version of malware_signature fieldset."
-    ],
-    "file.Ext.malware_signature.all_names": [
-        "The concatenated names of all yara signatures"
-    ],
-    "file.Ext.malware_signature.identifier": [
-        "Malware artifact identifier."
-    ],
-    "file.Ext.malware_signature.primary": [
-        "Primary malware signature match."
-    ],
-    "file.Ext.malware_signature.primary.matches": [
-        "An array of bytes representing yara signature matches"
-    ],
-    "file.Ext.malware_signature.primary.signature": [
-        "Primary malware signature match."
-    ],
-    "file.Ext.malware_signature.primary.signature.hash": [
-        "Primary malware signature hash."
-    ],
-    "file.Ext.malware_signature.primary.signature.hash.sha256": [
-        "Primary malware signature sha256."
-    ],
-    "file.Ext.malware_signature.primary.signature.id": [
-        "Primary malware signature id."
-    ],
-    "file.Ext.malware_signature.primary.signature.name": [
-        "Primary malware signature name."
-    ],
-    "file.Ext.malware_signature.secondary": [
-        "An array of malware signature matches"
-    ],
-    "file.Ext.malware_signature.version": [
-        "Primary malware signature version."
-    ],
-    "file.Ext.monotonic_id": [
-        "File event monotonic ID."
-    ],
-    "file.Ext.original.extension": [
-        "Original file extension prior to a modification event"
-    ],
-    "file.origin_referrer_url": [
-        "The url of the webpage that linked to the file."
-    ],
-    "file.origin_url": [
-        "The url where the file is hosted."
-    ],
-    "Target.process.Ext.created_suspended": [
-        "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls."
-    ],
-    "Target.process.Ext.memory_region.hash.sha256": [
-        "The sha256 of the memory region."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.secondary": [
-        "Additional matching details if available."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.secondary.matches": [
-        "The second matching details."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.secondary.signature.hash": [
-        "hash of second file matching signature."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256": [
-        "sha256 hash of second file matching signature."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.secondary.signature.id": [
-        "The id of the second yara rule matched."
-    ],
-    "Target.process.Ext.memory_region.malware_signature.secondary.signature.name": [
-        "The name of the second yara rule matched."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.dotnet": [
-        "Whether this file is a .NET PE"
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.sections": [
-        "The file's relevant sections, if it is a PE"
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5": [
-        "MD5 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384": [
-        "SHA384 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh": [
-        "TLSH hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.sections.name": [
-        "The section's name"
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.streams": [
-        "The file's streams, if it is a PE"
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5": [
-        "MD5 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384": [
-        "SHA384 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh": [
-        "TLSH hash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.Ext.streams.name": [
-        "The stream's name"
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.architecture": [
-        "CPU architecture target for the file."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.go_import_hash": [
-        "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.go_imports": [
-        "List of imported Go language element names and types."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.go_imports_names_entropy": [
-        "Shannon entropy calculation from the list of Go imports."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of Go imports."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.go_stripped": [
-        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.import_hash": [
-        "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.imports": [
-        "List of imported element names and types."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.imports_names_entropy": [
-        "Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.pehash": [
-        "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.sections": [
-        "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.sections.entropy": [
-        "Shannon entropy calculation from the section."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.sections.name": [
-        "PE Section List name."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.sections.physical_size": [
-        "PE Section List physical size."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.sections.var_entropy": [
-        "Variance for Shannon entropy calculation from the section."
-    ],
-    "Target.process.Ext.memory_region.mapped_pe.sections.virtual_size": [
-        "PE Section List virtual size. This is always the same as `physical_size`."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.dotnet": [
-        "Whether this file is a .NET PE"
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.sections": [
-        "The file's relevant sections, if it is a PE"
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.md5": [
-        "MD5 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384": [
-        "SHA384 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh": [
-        "TLSH hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.sections.name": [
-        "The section's name"
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.streams": [
-        "The file's streams, if it is a PE"
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.md5": [
-        "MD5 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384": [
-        "SHA384 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh": [
-        "TLSH hash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.Ext.streams.name": [
-        "The stream's name"
-    ],
-    "Target.process.Ext.memory_region.memory_pe.architecture": [
-        "CPU architecture target for the file."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.go_import_hash": [
-        "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.go_imports": [
-        "List of imported Go language element names and types."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.go_imports_names_entropy": [
-        "Shannon entropy calculation from the list of Go imports."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.go_imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of Go imports."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.go_stripped": [
-        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.import_hash": [
-        "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.imports": [
-        "List of imported element names and types."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.imports_names_entropy": [
-        "Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.pehash": [
-        "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.sections": [
-        "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.sections.entropy": [
-        "Shannon entropy calculation from the section."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.sections.name": [
-        "PE Section List name."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.sections.physical_size": [
-        "PE Section List physical size."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.sections.var_entropy": [
-        "Variance for Shannon entropy calculation from the section."
-    ],
-    "Target.process.Ext.memory_region.memory_pe.sections.virtual_size": [
-        "PE Section List virtual size. This is always the same as `physical_size`."
-    ],
-    "destination.port": [
-        "Port of the destination.",
-        "Port of the destination."
-    ],
-    "network.transport": [
-        "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
-        "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying."
-    ],
-    "network.type": [
-        "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
-        "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying."
-    ],
-    "process.Ext.api.metadata": [
-        "Information related to the API call."
-    ],
-    "process.Ext.api.metadata.amsi_filenames": [
-        "A list of filenames previously scanned by AMSI."
-    ],
-    "process.Ext.api.metadata.amsi_logs": [
-        "Information related to previous AMSI scans."
-    ],
-    "process.Ext.api.metadata.amsi_logs.entries": [
-        "A subset of the AMSI content buffers scanned prior to this event."
-    ],
-    "process.Ext.api.metadata.amsi_logs.type": [
-        "The AMSI content type scanned prior to this event."
-    ],
-    "process.Ext.api.metadata.background_callcount": [
-        "This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call."
-    ],
-    "process.Ext.api.metadata.client_is_local": [
-        "Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely."
-    ],
-    "process.Ext.api.metadata.client_machine": [
-        "Client process's machine name (provided by the client and potentially untrustworthy)."
-    ],
-    "process.Ext.api.metadata.client_machine_fqdn": [
-        "Client process's machine name FQDN (provided by the client and potentially untrustworthy)."
-    ],
-    "process.Ext.api.metadata.client_process_id": [
-        "Client process id"
-    ],
-    "process.Ext.api.metadata.ms_since_last_keyevent": [
-        "This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event."
-    ],
-    "process.Ext.api.metadata.procedure_symbol": [
-        "Summary of the hook procedure."
-    ],
-    "process.Ext.api.metadata.return_value": [
-        "Return value of RegisterRawInputDevices API call."
-    ],
-    "process.Ext.api.metadata.security_descriptor": [
-        "The security descriptor of the device."
-    ],
-    "process.Ext.api.metadata.start_address_allocation_protection": [
-        "Memory protection attributes associated with the starting address of a thread."
-    ],
-    "process.Ext.api.metadata.start_address_module": [
-        "Name of the module associated with the starting address of a thread."
-    ],
-    "process.Ext.api.metadata.target_address_name": [
-        "The name of the memory region targeted by the API call."
-    ],
-    "process.Ext.api.metadata.target_address_path": [
-        "The path of the memory region targeted by the API call."
-    ],
-    "process.Ext.api.metadata.thread_info_flags": [
-        "Thread info flags."
-    ],
-    "process.Ext.api.metadata.visible_windows_count": [
-        "Number of visible windows owned by the caller thread."
-    ],
-    "process.Ext.api.metadata.windows_count": [
-        "Number of windows owned by the caller thread."
-    ],
-    "process.Ext.api.parameters": [
-        "Parameter values passed to the API call."
-    ],
-    "process.Ext.api.parameters.address": [
-        "The target memory address."
-    ],
-    "process.Ext.api.parameters.allocation_type": [
-        "The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`"
-    ],
-    "process.Ext.api.parameters.app_name": [
-        "The application name requesting the AMSI scan."
-    ],
-    "process.Ext.api.parameters.argument1": [
-        "The first argument to the procedure."
-    ],
-    "process.Ext.api.parameters.argument2": [
-        "The second argument to the procedure."
-    ],
-    "process.Ext.api.parameters.argument3": [
-        "The third argument to the procedure."
-    ],
-    "process.Ext.api.parameters.buffer": [
-        "The content associated with an AMSI scan."
-    ],
-    "process.Ext.api.parameters.consumer_details": [
-        "Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name."
-    ],
-    "process.Ext.api.parameters.consumer_name": [
-        "Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered."
-    ],
-    "process.Ext.api.parameters.consumer_type": [
-        "An example list of consumer type.\n  \"ActiveScriptEventConsumer\" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.\n  \"CommandLineEventConsumer\" - Launches an arbitrary process in the local system context when an event is delivered to it.\n  \"LogFileEventConsumer\" - Writes customized strings to a text log file when events are delivered to it.\n  \"NTEventLogEventConsumer\" - Logs a specific message to the Windows event log when an event is delivered to it.\n  \"SMTPEventConsumer\" - Sends an email message using SMTP each time an event is delivered to it."
-    ],
-    "process.Ext.api.parameters.content_name": [
-        "The content name, typically a filename, associated with an AMSI scan."
-    ],
-    "process.Ext.api.parameters.context_flags": [
-        "The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`"
-    ],
-    "process.Ext.api.parameters.desired_access": [
-        "This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`."
-    ],
-    "process.Ext.api.parameters.desired_access_numeric": [
-        "This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`."
-    ],
-    "process.Ext.api.parameters.device": [
-        "The name of the device object."
-    ],
-    "process.Ext.api.parameters.driver": [
-        "The name of the driver object."
-    ],
-    "process.Ext.api.parameters.eax": [
-        "The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall."
-    ],
-    "process.Ext.api.parameters.ebp": [
-        "The x86 EBP frame pointer register."
-    ],
-    "process.Ext.api.parameters.ebx": [
-        "The x86 EBX general purpose register."
-    ],
-    "process.Ext.api.parameters.ecx": [
-        "The x86 ECX general purpose register. First argument in __fastcall and __thiscall."
-    ],
-    "process.Ext.api.parameters.edi": [
-        "The x86 EDI general purpose register."
-    ],
-    "process.Ext.api.parameters.edx": [
-        "The x86 EDX general purpose register. Second argument in a __fastcall."
-    ],
-    "process.Ext.api.parameters.eip": [
-        "The x86 EIP instruction pointer register."
-    ],
-    "process.Ext.api.parameters.esi": [
-        "The x86 ESI general purpose register."
-    ],
-    "process.Ext.api.parameters.esp": [
-        "The x86 ESP stack pointer register."
-    ],
-    "process.Ext.api.parameters.event_filter_details": [
-        "Provide an overview of the query that define when an event should be triggered."
-    ],
-    "process.Ext.api.parameters.event_filter_name": [
-        "Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer."
-    ],
-    "process.Ext.api.parameters.flags": [
-        "Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure."
-    ],
-    "process.Ext.api.parameters.handle_type": [
-        "This parameter indicates whether the detected access was attempt against a process or a thread."
-    ],
-    "process.Ext.api.parameters.hook_module": [
-        "DLL containing the hook procedure."
-    ],
-    "process.Ext.api.parameters.hook_type": [
-        "Type of hook procedure to be installed."
-    ],
-    "process.Ext.api.parameters.io_control_code": [
-        "The I/O control code for the requested device operation."
-    ],
-    "process.Ext.api.parameters.namespace": [
-        "WMI namespace to which the connection is made."
-    ],
-    "process.Ext.api.parameters.operation": [
-        "Specifies the connection or request to WMI"
-    ],
-    "process.Ext.api.parameters.procedure": [
-        "The memory address of the procedure or function."
-    ],
-    "process.Ext.api.parameters.protection": [
-        "The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
-    ],
-    "process.Ext.api.parameters.protection_old": [
-        "The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
-    ],
-    "process.Ext.api.parameters.r8": [
-        "The x64 R8 general purpose register. Third argument in a __fastcall."
-    ],
-    "process.Ext.api.parameters.r9": [
-        "The x64 R9 general purpose register. Fourth argument in a __fastcall."
-    ],
-    "process.Ext.api.parameters.rax": [
-        "The x64 RAX general purpose register. Return value in a __fastcall."
-    ],
-    "process.Ext.api.parameters.rbp": [
-        "The x64 RBP general purpose register."
-    ],
-    "process.Ext.api.parameters.rbx": [
-        "The x64 RBX general purpose register."
-    ],
-    "process.Ext.api.parameters.rcx": [
-        "The x64 RCX general purpose register. First argument in a __fastcall."
-    ],
-    "process.Ext.api.parameters.rdi": [
-        "The x64 RDI general purpose register."
-    ],
-    "process.Ext.api.parameters.rdx": [
-        "The x64 RDX general purpose register. Second argument in a __fastcall."
-    ],
-    "process.Ext.api.parameters.rip": [
-        "The x64 RIP instruction pointer register."
-    ],
-    "process.Ext.api.parameters.rsi": [
-        "The x64 RSI general purpose register."
-    ],
-    "process.Ext.api.parameters.rsp": [
-        "The x64 RSP stack pointer register."
-    ],
-    "process.Ext.api.parameters.size": [
-        "The size."
-    ],
-    "process.Ext.api.parameters.usage": [
-        "This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure."
-    ],
-    "process.Ext.api.parameters.usage_page": [
-        "This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure."
-    ],
-    "process.Ext.memory_region.hash.sha256": [
-        "The sha256 of the memory region."
-    ],
-    "process.Ext.memory_region.malware_signature.secondary": [
-        "Additional matching details if available."
-    ],
-    "process.Ext.memory_region.malware_signature.secondary.matches": [
-        "The second matching details."
-    ],
-    "process.Ext.memory_region.malware_signature.secondary.signature.hash": [
-        "hash of second file matching signature."
-    ],
-    "process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256": [
-        "sha256 hash of second file matching signature."
-    ],
-    "process.Ext.memory_region.malware_signature.secondary.signature.id": [
-        "The id of the second yara rule matched."
-    ],
-    "process.Ext.memory_region.malware_signature.secondary.signature.name": [
-        "The name of the second yara rule matched."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.dotnet": [
-        "Whether this file is a .NET PE"
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.sections": [
-        "The file's relevant sections, if it is a PE"
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5": [
-        "MD5 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384": [
-        "SHA384 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh": [
-        "TLSH hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.sections.name": [
-        "The section's name"
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.streams": [
-        "The file's streams, if it is a PE"
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5": [
-        "MD5 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384": [
-        "SHA384 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh": [
-        "TLSH hash."
-    ],
-    "process.Ext.memory_region.mapped_pe.Ext.streams.name": [
-        "The stream's name"
-    ],
-    "process.Ext.memory_region.mapped_pe.architecture": [
-        "CPU architecture target for the file."
-    ],
-    "process.Ext.memory_region.mapped_pe.go_import_hash": [
-        "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
-    ],
-    "process.Ext.memory_region.mapped_pe.go_imports": [
-        "List of imported Go language element names and types."
-    ],
-    "process.Ext.memory_region.mapped_pe.go_imports_names_entropy": [
-        "Shannon entropy calculation from the list of Go imports."
-    ],
-    "process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of Go imports."
-    ],
-    "process.Ext.memory_region.mapped_pe.go_stripped": [
-        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-    ],
-    "process.Ext.memory_region.mapped_pe.import_hash": [
-        "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash."
-    ],
-    "process.Ext.memory_region.mapped_pe.imports": [
-        "List of imported element names and types."
-    ],
-    "process.Ext.memory_region.mapped_pe.imports_names_entropy": [
-        "Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "process.Ext.memory_region.mapped_pe.imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "process.Ext.memory_region.mapped_pe.pehash": [
-        "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html."
-    ],
-    "process.Ext.memory_region.mapped_pe.sections": [
-        "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-    ],
-    "process.Ext.memory_region.mapped_pe.sections.entropy": [
-        "Shannon entropy calculation from the section."
-    ],
-    "process.Ext.memory_region.mapped_pe.sections.name": [
-        "PE Section List name."
-    ],
-    "process.Ext.memory_region.mapped_pe.sections.physical_size": [
-        "PE Section List physical size."
-    ],
-    "process.Ext.memory_region.mapped_pe.sections.var_entropy": [
-        "Variance for Shannon entropy calculation from the section."
-    ],
-    "process.Ext.memory_region.mapped_pe.sections.virtual_size": [
-        "PE Section List virtual size. This is always the same as `physical_size`."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.dotnet": [
-        "Whether this file is a .NET PE"
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.sections": [
-        "The file's relevant sections, if it is a PE"
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.sections.hash.md5": [
-        "MD5 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384": [
-        "SHA384 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh": [
-        "TLSH hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.sections.name": [
-        "The section's name"
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.streams": [
-        "The file's streams, if it is a PE"
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.streams.hash.md5": [
-        "MD5 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1": [
-        "SHA1 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256": [
-        "SHA256 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384": [
-        "SHA384 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512": [
-        "SHA512 hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep": [
-        "SSDEEP hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh": [
-        "TLSH hash."
-    ],
-    "process.Ext.memory_region.memory_pe.Ext.streams.name": [
-        "The stream's name"
-    ],
-    "process.Ext.memory_region.memory_pe.architecture": [
-        "CPU architecture target for the file."
-    ],
-    "process.Ext.memory_region.memory_pe.go_import_hash": [
-        "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma)."
-    ],
-    "process.Ext.memory_region.memory_pe.go_imports": [
-        "List of imported Go language element names and types."
-    ],
-    "process.Ext.memory_region.memory_pe.go_imports_names_entropy": [
-        "Shannon entropy calculation from the list of Go imports."
-    ],
-    "process.Ext.memory_region.memory_pe.go_imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of Go imports."
-    ],
-    "process.Ext.memory_region.memory_pe.go_stripped": [
-        "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-    ],
-    "process.Ext.memory_region.memory_pe.import_hash": [
-        "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash."
-    ],
-    "process.Ext.memory_region.memory_pe.imports": [
-        "List of imported element names and types."
-    ],
-    "process.Ext.memory_region.memory_pe.imports_names_entropy": [
-        "Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "process.Ext.memory_region.memory_pe.imports_names_var_entropy": [
-        "Variance for Shannon entropy calculation from the list of imported element names and types."
-    ],
-    "process.Ext.memory_region.memory_pe.pehash": [
-        "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html."
-    ],
-    "process.Ext.memory_region.memory_pe.sections": [
-        "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-    ],
-    "process.Ext.memory_region.memory_pe.sections.entropy": [
-        "Shannon entropy calculation from the section."
-    ],
-    "process.Ext.memory_region.memory_pe.sections.name": [
-        "PE Section List name."
-    ],
-    "process.Ext.memory_region.memory_pe.sections.physical_size": [
-        "PE Section List physical size."
-    ],
-    "process.Ext.memory_region.memory_pe.sections.var_entropy": [
-        "Variance for Shannon entropy calculation from the section."
-    ],
-    "process.Ext.memory_region.memory_pe.sections.virtual_size": [
-        "PE Section List virtual size. This is always the same as `physical_size`."
-    ],
-    "process.thread.Ext.call_stack.protection_provenance": [
-        "The name of the memory region that last modified the protection of this page.  \"Unbacked\" can indicate shellcode."
-    ],
-    "process.thread.Ext.call_stack_contains_unbacked": [
-        "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.allocation_private_bytes": [
-        "The number of bytes in this memory region that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.protection": [
-        "The memory protection for the acting region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
-    ],
-    "process.thread.Ext.call_stack_final_user_module.protection_provenance": [
-        "The name of the memory region that caused the last modification of the protection of this page. \"Unbacked\" may indicate shellcode."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.protection_provenance_path": [
-        "The path of the module that caused the last modification the protection of this page."
-    ],
-    "process.thread.Ext.call_stack_final_user_module.reason": [
-        "The unexpected call_stack_summary that led to an \"Undetermined\" protection_provenance."
-    ],
-    "destination.address": [
-        "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
-    ],
-    "destination.as.number": [
-        "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet."
-    ],
-    "destination.as.organization.name": [
-        "Organization name."
-    ],
-    "destination.bytes": [
-        "Bytes sent from the destination to the source."
-    ],
-    "destination.domain": [
-        "The domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment."
-    ],
-    "destination.packets": [
-        "Packets sent from the destination to the source."
-    ],
-    "destination.registered_domain": [
-        "The highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
-    ],
-    "destination.top_level_domain": [
-        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
-    ],
-    "dns.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "dns.Ext.options": [
-        "DNS options field, uint64, representing as a keyword to avoid overflows in ES"
-    ],
-    "dns.Ext.status": [
-        "DNS status field, uint32"
-    ],
-    "dns.question.registered_domain": [
-        "The highest registered domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
-    ],
-    "dns.question.subdomain": [
-        "The subdomain is all of the labels under the registered_domain.\nIf the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period."
-    ],
-    "dns.question.top_level_domain": [
-        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
-    ],
-    "dns.resolved_ip": [
-        "Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for."
-    ],
-    "http.request.body.bytes": [
-        "Size in bytes of the request body."
-    ],
-    "http.request.body.content": [
-        "The full HTTP request body."
-    ],
-    "http.request.bytes": [
-        "Total size in bytes of the request (body and headers)."
-    ],
-    "http.response.Ext": [
-        "Object for all custom defined fields to live in."
-    ],
-    "http.response.Ext.version": [
-        "HTTP version"
-    ],
-    "http.response.body.bytes": [
-        "Size in bytes of the response body."
-    ],
-    "http.response.body.content": [
-        "The full HTTP response body."
-    ],
-    "http.response.bytes": [
-        "Total size in bytes of the response (body and headers)."
-    ],
-    "http.response.status_code": [
-        "HTTP response status code."
-    ],
-    "network.bytes": [
-        "Total bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum."
-    ],
-    "network.community_id": [
-        "A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec."
-    ],
-    "network.direction": [
-        "Direction of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values \"ingress\" or \"egress\".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values \"inbound\", \"outbound\", \"internal\" or \"external\".\nNote that \"internal\" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that \"external\" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers."
-    ],
-    "network.iana_number": [
-        "IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number."
-    ],
-    "network.packets": [
-        "Total packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum."
-    ],
-    "network.protocol": [
-        "In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying."
-    ],
-    "source.address": [
-        "Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
-    ],
-    "source.as.number": [
-        "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet."
-    ],
-    "source.as.organization.name": [
-        "Organization name."
-    ],
-    "source.bytes": [
-        "Bytes sent from the source to the destination."
-    ],
-    "source.domain": [
-        "The domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment."
-    ],
-    "source.packets": [
-        "Packets sent from the source to the destination."
-    ],
-    "source.port": [
-        "Port of the source."
-    ],
-    "source.registered_domain": [
-        "The highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\"."
-    ],
-    "source.top_level_domain": [
-        "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\"."
-    ],
-    "Endpoint.metrics": [
-        "Metrics fields hold the endpoint and system's performance metrics"
-    ],
-    "Endpoint.metrics.cpu": [
-        "CPU statistics"
-    ],
-    "Endpoint.metrics.cpu.endpoint": [
-        "CPU metrics for the endpoint"
-    ],
-    "Endpoint.metrics.cpu.endpoint.histogram": [
-        "This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket"
-    ],
-    "Endpoint.metrics.cpu.endpoint.latest": [
-        "Average CPU over the last sample interval"
-    ],
-    "Endpoint.metrics.cpu.endpoint.mean": [
-        "Average CPU load used by the endpoint"
-    ],
-    "Endpoint.metrics.disks": [
-        "An array of disk information for the host"
-    ],
-    "Endpoint.metrics.disks.device": [
-        "Device name"
-    ],
-    "Endpoint.metrics.disks.endpoint_drive": [
-        "This field will be present and set to true only for the drive that holds the installed endpoint"
-    ],
-    "Endpoint.metrics.disks.free": [
-        "The number of bytes marked as free on the disk"
-    ],
-    "Endpoint.metrics.disks.fstype": [
-        "The file system type for the drive"
-    ],
-    "Endpoint.metrics.disks.mount": [
-        "The disks mount location"
-    ],
-    "Endpoint.metrics.disks.total": [
-        "The size of the disk in bytes"
-    ],
-    "Endpoint.metrics.documents_volume": [
-        "Statistics about sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.alerts.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.alerts.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.alerts.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.alerts.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.sent_bytes": [
-        "Total size of API Event sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.sent_count": [
-        "Number of sent API Event documents"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.sources": [
-        "An array of API Event document statistics per source"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.sources.sent_bytes": [
-        "Total size of API Event sent documents from source"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.sources.sent_count": [
-        "Number of sent API Event documents from source"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.sources.source": [
-        "API Event document source name"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes": [
-        "Total size of suppressed API Event documents from source"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.sources.suppressed_count": [
-        "Number of suppressed API Event documents from source"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.suppressed_bytes": [
-        "Total size of suppressed API Event documents"
-    ],
-    "Endpoint.metrics.documents_volume.api_events.suppressed_count": [
-        "Number of suppressed API Event documents"
-    ],
-    "Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.dns_events.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.dns_events.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.dns_events.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.dns_events.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.file_events.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.file_events.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.file_events.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.file_events.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.library_events.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.library_events.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.library_events.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.library_events.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.network_events.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.network_events.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.network_events.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.network_events.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.overall.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.overall.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.overall.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.overall.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.process_events.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.process_events.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.process_events.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.process_events.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.registry_events.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.registry_events.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.registry_events.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.registry_events.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.security_events.sent_bytes": [
-        "Total size of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.security_events.sent_count": [
-        "Number of sent documents"
-    ],
-    "Endpoint.metrics.documents_volume.security_events.suppressed_bytes": [
-        "Total size of suppressed documents"
-    ],
-    "Endpoint.metrics.documents_volume.security_events.suppressed_count": [
-        "Number of suppressed documents"
-    ],
-    "Endpoint.metrics.event_filter.active_global_count": [
-        "The number of active global event filters"
-    ],
-    "Endpoint.metrics.event_filter.active_user_count": [
-        "The number of active user event filters"
-    ],
-    "Endpoint.metrics.malicious_behavior_rules": [
-        "An array of performance information about each malicious behavior rule"
-    ],
-    "Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent": [
-        "Perfect of Endpoint's update spent running the rule"
-    ],
-    "Endpoint.metrics.malicious_behavior_rules.id": [
-        "The rule id"
-    ],
-    "Endpoint.metrics.memory": [
-        "Memory statistics"
-    ],
-    "Endpoint.metrics.memory.endpoint": [
-        "Endpoint memory utilization"
-    ],
-    "Endpoint.metrics.memory.endpoint.private": [
-        "The memory private to the endpoint"
-    ],
-    "Endpoint.metrics.memory.endpoint.private.latest": [
-        "The memory usage by the endpoint for the last sample interval"
-    ],
-    "Endpoint.metrics.memory.endpoint.private.mean": [
-        "Average memory usage by the endpoint since its start"
-    ],
-    "Endpoint.metrics.system_impact": [
-        "An array of system impact information"
-    ],
-    "Endpoint.metrics.system_impact.authentication_events.week_idle_ms": [
-        "The total milliseconds spent queueing authentication events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.authentication_events.week_ms": [
-        "The total milliseconds spent on authentication events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.dns_events.week_idle_ms": [
-        "The total milliseconds spent queueing DNS events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.dns_events.week_ms": [
-        "The total milliseconds spent on DNS events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.file_events.week_idle_ms": [
-        "The total milliseconds spent queueing file events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.file_events.week_ms": [
-        "The total milliseconds spent on file events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.library_load_events.week_idle_ms": [
-        "The total milliseconds spent queueing library load events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.library_load_events.week_ms": [
-        "The total milliseconds spent on library load events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.malware.week_idle_ms": [
-        "The total milliseconds spent queueing malware scanning due to the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.malware.week_ms": [
-        "The total milliseconds spent on malware scanning due to the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.network_events.week_idle_ms": [
-        "The total milliseconds spent queueing network events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.network_events.week_ms": [
-        "The total milliseconds spent on network events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.overall.week_idle_ms": [
-        "The total milliseconds spent queueing activity for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.overall.week_ms": [
-        "The total milliseconds spent monitoring the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.process.code_signature": [
-        "Code signature of the process"
-    ],
-    "Endpoint.metrics.system_impact.process.code_signature.exists": [
-        "Boolean to capture if a signature is present."
-    ],
-    "Endpoint.metrics.system_impact.process.code_signature.signing_id": [
-        "'The identifier used to sign the binary.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'"
-    ],
-    "Endpoint.metrics.system_impact.process.code_signature.status": [
-        "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked."
-    ],
-    "Endpoint.metrics.system_impact.process.code_signature.subject_name": [
-        "Subject name of the code signer"
-    ],
-    "Endpoint.metrics.system_impact.process.code_signature.team_id": [
-        "'The team identifier used to sign the binary.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'"
-    ],
-    "Endpoint.metrics.system_impact.process.code_signature.trusted": [
-        "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status."
-    ],
-    "Endpoint.metrics.system_impact.process.code_signature.valid": [
-        "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked."
-    ],
-    "Endpoint.metrics.system_impact.process.executable": [
-        "Path to the process executable for the impact entry"
-    ],
-    "Endpoint.metrics.system_impact.process_events.week_idle_ms": [
-        "The total milliseconds spent queueing process events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.process_events.week_ms": [
-        "The total milliseconds spent on process events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.registry_events.week_idle_ms": [
-        "The total milliseconds spent queueing registry events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.registry_events.week_ms": [
-        "The total milliseconds spent on registry events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms": [
-        "The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.threat_intelligence_events.week_ms": [
-        "The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.win32k_events.week_idle_ms": [
-        "The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week"
-    ],
-    "Endpoint.metrics.system_impact.win32k_events.week_ms": [
-        "The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week"
-    ],
-    "Endpoint.metrics.threads": [
-        "Statistics about the individual Endpoint threads (array)"
-    ],
-    "Endpoint.metrics.threads.cpu.mean": [
-        "The thread's average CPU use"
-    ],
-    "Endpoint.metrics.threads.name": [
-        "The thread name"
-    ],
-    "Endpoint.metrics.uptime": [
-        "Number of seconds since boot"
-    ],
-    "Endpoint.metrics.uptime.endpoint": [
-        "Number of seconds since the endpoint was started"
-    ],
-    "Endpoint.metrics.uptime.system": [
-        "Number of seconds since the system was started"
-    ]
-}
diff --git a/scripts/generate-docs/pydocgen/Readme.md b/scripts/generate-docs/pydocgen/Readme.md
new file mode 100644
index 000000000..2f5461b68
--- /dev/null
+++ b/scripts/generate-docs/pydocgen/Readme.md
@@ -0,0 +1,54 @@
+# Custom Documentation Generator
+
+## Description
+
+This module generates documentation for the custom endpoint fields defined in [custom_documentation](../../../custom_documentation/)
+
+### Background
+
+The fields defined in [custom_documentation](../../../custom_documentation/) do not have descriptions.  They are simply the possible fields
+of an event, including all the custom fields Endpoint uses but are not mapped.
+
+The fields defined in [package](../../../package/) are the fields that are mapped into Kibana.  These fields have descriptions and documentation.
+
+
+### Implementation
+
+This python module generates markdown for all of the fields in [custom_documentation](../../../custom_documentation/) by taking the following steps
+
+1. Parses all of the mapped fields defined in [package](../../../package/), collecting descriptions, examples, and other metadata
+
+2. Parses any override fields defined in [documentation_overrides.yaml](../../../custom_documentation/src/documentation_overrides.yaml)
+   - overrides can be set for any field.  They can be set at the event level, the os level, or a default override that applies to all
+    instances of that field.
+   - See [documentation_overrides.yaml](../../../custom_documentation/src/documentation_overrides.yaml) for the format
+   - If overrides are updated, the documentation must be regenerated
+
+3. Puts all of that data into an sqlite database
+
+4. Parses all of the endpoint fields defined in [custom_documentation](../../../custom_documentation/)
+
+5. Iterates over the custom_documentation data, filling out descriptions and examples pulled from the database that was just created.
+
+### Example Usage
+`python -m pydocgen --output-dir /path/to/output`
+
+#### Help statement
+```
+usage: __main__.py [-h] [--database DATABASE] [--no-cache] [--output-dir OUTPUT_DIR] [-v] [-l {DEBUG,INFO,WARNING,ERROR,CRITICAL}] [--csv CSV]
+
+Create markdown documentation for the fields defined in custom_documentation
+
+options:
+  -h, --help            show this help message and exit
+  --database DATABASE   path to the database
+  --no-cache            do not use cached database if it exists, always regenerate the database
+  --output-dir OUTPUT_DIR
+                        output directory for markdown documentation
+  -v, --verbose         Force maximum verbosity (DEBUG level + detailed output)
+  -l {DEBUG,INFO,WARNING,ERROR,CRITICAL}, --log-level {DEBUG,INFO,WARNING,ERROR,CRITICAL}
+                        Set logging verbosity level
+  --csv CSV             Path to CSV file for missing documentation fields (optional)
+
+Example usage: python -m pydocgen --output-dir /path/to/output
+```
diff --git a/scripts/generate-docs/pydocgen/__main__.py b/scripts/generate-docs/pydocgen/__main__.py
index 4351064a1..2c2afabf4 100644
--- a/scripts/generate-docs/pydocgen/__main__.py
+++ b/scripts/generate-docs/pydocgen/__main__.py
@@ -78,6 +78,13 @@ def main():
         help="Set logging verbosity level",
     )
 
+    parser.add_argument(
+        "--csv",
+        type=pathlib.Path,
+        default=None,
+        help="Path to CSV file for missing documentation fields (optional)",
+    )
+
     args = parser.parse_args()
 
     configure_logging(args.log_level, args.verbose)
@@ -89,21 +96,6 @@ def main():
     generate_custom_documentation_markdown(args.database, args.output_dir)
     logging.info(f"Generated markdown documentation to {args.output_dir}")
 
-# #
-# # Validate the output directory
-# #
-# if args.output.exists():
-#     raise FileExistsError(
-#         f"output directory {args.output} already exists, please remove it or specify a different directory"
-#     )
-# args.output.mkdir(parents=True)
-
-#
-# Create the PackageList object and dump it to a file
-#
-# package_list = PackageList.from_packages_dir(args.packages_dir)
-
-
 if __name__ == "__main__":
     try:
         main()
diff --git a/scripts/generate-docs/pydocgen/database.py b/scripts/generate-docs/pydocgen/database.py
index f837a0872..c2a1d6484 100644
--- a/scripts/generate-docs/pydocgen/database.py
+++ b/scripts/generate-docs/pydocgen/database.py
@@ -9,6 +9,7 @@
 
 from typing import Optional
 
+
 #
 # These models represent the database tables for mapped fields
 #
@@ -36,6 +37,7 @@ class PackageField(SQLModel, table=True):
     Returns:
         _description_
     """
+
     __tablename__ = "package_fields"
     id: Optional[int] = Field(default=None, primary_key=True)
     name: str
@@ -57,7 +59,7 @@ def package(self) -> Package:
 class OverrideField(SQLModel, table=True):
     __tablename__ = "overrides"
     id: Optional[int] = Field(default=None, primary_key=True)
-    description: str
+    description: Optional[str] = None
     example: Optional[str] = None
     type: Optional[str] = None
 
@@ -87,9 +89,7 @@ def populate_overrides(session: Session):
                 session.flush()
 
                 related_record = OverrideRelationship(
-                    name=name,
-                    os=os,
-                    override_id=record.id
+                    name=name, os=os, override_id=record.id
                 )
                 session.add(related_record)
 
@@ -105,9 +105,7 @@ def populate_overrides(session: Session):
                 session.flush()
 
                 related_record = OverrideRelationship(
-                    name=name,
-                    event=event,
-                    override_id=record.id
+                    name=name, event=event, override_id=record.id
                 )
                 session.add(related_record)
 
@@ -121,14 +119,13 @@ def populate_overrides(session: Session):
             session.flush()
 
             related_record = OverrideRelationship(
-                name=name,
-                default=True,
-                override_id=record.id
+                name=name, default=True, override_id=record.id
             )
             session.add(related_record)
 
     session.commit()
 
+
 def populate_packages_fields(session: Session):
     """
     populate_packages_fields populates the package fields in the database
@@ -136,6 +133,7 @@ def populate_packages_fields(session: Session):
     Args:
         session: database session
     """
+
     def add_to_db(field: PackageField, session: Session):
         existing_field = session.exec(
             select(PackageField).where(PackageField.name == field.name)
@@ -185,6 +183,11 @@ def getDatabase(db_path: pathlib.Path) -> Engine:
     """
     getDatabase creates a database if it does not exist, otherwise it uses the existing database
 
+    This stores the documentation in package/endpoint/data_stream in a lightweight SQLite database.  We will
+    use this when generating markdown documentation for the fields defined in the custom_documentation.
+
+    overrides are also added to the database here.
+
     Args:
         db_path: path to the database
 
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index c2cee1977..65523124f 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -1,3 +1,4 @@
+import csv
 import logging
 import pathlib
 from .models import CustomDocumentationList, Filter
@@ -14,8 +15,59 @@
 from typing import List
 
 
+class MetadataCsvWriter:
+    """
+    This class will write a CSV file that contains fields
+    that are missing either a description or an example. This
+    can be imported into a spreadsheet to track missing documentation
+    """
+
+    def __init__(self, csv_path: pathlib.Path):
+
+        self.csv_path = csv_path
+        self.fields = [
+            "Field Name",
+            "Event Name",
+            "Has Description",
+            "Has Example",
+        ]
+        self.rows = []
+
+    def add_row(
+        self, field_name: str, event_name: str, has_description: bool, has_example: bool
+    ):
+        """
+        add_row adds a row to the CSV output
+
+        Args:
+            name: field name
+            file: source file path
+            has_description: boolean indicating if the field has a description
+            has_example: boolean indicating if the field has an example
+        """
+        self.rows.append(
+            {
+                "Field Name": field_name,
+                "Event Name": event_name,
+                "Has Description": has_description,
+                "Has Example": has_example,
+            }
+        )
+
+    def write_csv(self):
+        """
+        write_csv writes the collected rows to a CSV file
+        """
+        logging.debug(f"Generating CSV output at {self.csv_path}")
+        with self.csv_path.open("w", newline="") as csvfile:
+            writer = csv.DictWriter(csvfile, fieldnames=self.fields)
+            writer.writeheader()
+            for row in self.rows:
+                writer.writerow(row)
+
+
 def generate_custom_documentation_markdown(
-    db_path: pathlib.Path, output_dir: pathlib.Path
+    db_path: pathlib.Path, output_dir: pathlib.Path, csv_path: pathlib.Path = None
 ):
     """
     Generate markdown files for custom documentation
@@ -105,6 +157,10 @@ def get_kql_query_string(filter: Filter) -> str:
     # Get the custom documentation
     custom_docs = CustomDocumentationList.from_files()
 
+    csv_writer = None
+    if csv_path:
+        csv_writer = MetadataCsvWriter()
+
     # Generate markdown for each custom document
     with Session(engine) as session:
         for custom_doc in custom_docs:
@@ -140,13 +196,27 @@ def get_kql_query_string(filter: Filter) -> str:
                 f.write("</table>\n\n")
 
                 f.write(f"## Fields\n\n")
-                # f.write("<table>\n")
-                # f.write("<tr><th>Name</th><th>Description</th><th>Example</th></tr>\n")
                 for field in custom_doc.fields.endpoint:
-                    description = "No Description Found"
-                    example = ""
+                    description = None
+                    example = None
                     event_name = custom_doc.filepath.stem
 
+                    #
+                    # Look for the description and example from mapped values (packages directory)
+                    #
+                    package_field = session.exec(
+                        select(PackageField).where(PackageField.name == field)
+                    ).first()
+                    if package_field:
+                        #
+                        # The package field description may contain newlines, so we replace them with spaces
+                        #
+                        description = package_field.description.replace(
+                            "\n", "  "
+                        ).replace("\r", "  ")
+                        if package_field.example:
+                            example = package_field.example
+
                     #
                     # This query will look for an override for the field in the following order:
                     # 1. Event name
@@ -155,7 +225,7 @@ def get_kql_query_string(filter: Filter) -> str:
                     #
                     # If no override is found, the package field description will be used
                     #
-                    override = session.exec(
+                    override_meta = session.exec(
                         select(OverrideRelationship)
                         .where(
                             and_(
@@ -187,47 +257,44 @@ def get_kql_query_string(filter: Filter) -> str:
                         )
                     ).first()
 
-                    if override:
-                        description = override.override.description
-                        if override.override.example:
-                            example = override.override.example
-                        logging.debug(
-                            f"Found override for field {field} in {event_name}"
+                    if override_meta:
+                        override = override_meta.override
+                        if override.description:
+                            description = override.description
+                            logging.debug(
+                                f"Found description override for field {field} in {event_name}"
+                            )
+                        if override.example:
+                            example = override.example
+                            logging.debug(
+                                f"Found example override for field {field} in {event_name}"
+                            )
+
+                    if csv_writer and (not description or not example):
+                        csv_writer.add_row(
+                            field_name=field,
+                            event_name=event_name,
+                            has_description=bool(description),
+                            has_example=bool(example),
                         )
-                    else:
-                        #
-                        # If no override is found, use the package field description
-                        #
-                        package_field = session.exec(
-                            select(PackageField).where(PackageField.name == field)
-                        ).first()
-                        if package_field:
-                            #
-                            # The package field description may contain newlines, so we replace them with spaces
-                            #
-                            description = package_field.description.replace(
-                                "\n", "  "
-                            ).replace("\r", "  ")
-                            if package_field.example:
-                                example = package_field.example
+
+                    description = (
+                        description if description else "No description available"
+                    )
+                    example = example if example else None
 
                     f.write(f"#### `{field}`\n\n")
                     f.write("<div style='margin-left: 20px;'>\n")
                     f.write("<table>\n")
                     f.write(f"<tr><td>Description</td><td>{description}</td></tr>\n")
                     if example:
-                        f.write(f"<tr><td>Example</td><td><code>{example}</code></td></tr>\n")
+                        f.write(
+                            f"<tr><td>Example</td><td><code>{example}</code></td></tr>\n"
+                        )
                     f.write("</table>\n\n<br>\n\n")
                     f.write("</div>\n\n")
-                #     f.write("<tr>\n")
-                #     f.write(f"<td><code>{field}</code></td>\n")
-                #     f.write(f"<td>{description}</td>\n")
-                #     if example:
-                #         f.write(f"<td><code>{example}</code></td>\n")
-                #     else:
-                #         f.write("<td></td>\n")
-                #     f.write("</tr>\n")
-
-                # f.write("</table>\n")
 
             logging.debug(f"wrote markdown to {output_filename}")
+
+        if csv_writer:
+            csv_writer.write_csv()
diff --git a/scripts/generate-docs/pydocgen/models/custom_documentation.py b/scripts/generate-docs/pydocgen/models/custom_documentation.py
index 8dbd2f02a..88b597b84 100644
--- a/scripts/generate-docs/pydocgen/models/custom_documentation.py
+++ b/scripts/generate-docs/pydocgen/models/custom_documentation.py
@@ -6,6 +6,10 @@
 
 from ..paths import CUSTOM_DOCUMENTATION_DIR, DOCUMENTATION_OVERRIDE_PATH
 
+#
+# See any of the files at custom_documentation/src/endpoint/data_stream/*/*.yaml for examples 
+# of the data these models parse
+#
 class Overview(BaseModel):
     """
     Overview of the package
diff --git a/scripts/generate-docs/pydocgen/models/packages.py b/scripts/generate-docs/pydocgen/models/packages.py
index 679446b2f..a42f26abc 100644
--- a/scripts/generate-docs/pydocgen/models/packages.py
+++ b/scripts/generate-docs/pydocgen/models/packages.py
@@ -8,6 +8,11 @@
 from ..paths import PACKAGES_DIR
 
 
+#
+# See any of the files at package/endpoint/data_stream/*/fields/fields.yaml for examples
+# of the data these models parse
+#
+
 class MultiField(BaseModel):
     """
     fields can have a number of multi_fields
diff --git a/scripts/requirements.txt b/scripts/requirements.txt
index 462653e44..cc08f3c7c 100644
--- a/scripts/requirements.txt
+++ b/scripts/requirements.txt
@@ -3,5 +3,8 @@ GitPython~=3.1
 Jinja2~=3.0
 PyYAML~=6.0
 pyyaml-include~=1.2
+pydantic~=2.10.6
+SQLAlchemy~=2.0.39
+sqlmodel~=0.0.24
 click
 xxhash

From 703313791dd134e701d9a6c8da9fe93b5f626294 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 28 Mar 2025 20:51:23 +0000
Subject: [PATCH 18/25] update the generated markdown

---
 .../linux/linux_malicious_behavior_alert.md   |    0
 .../alerts/linux/linux_malware_alert.md       |    0
 .../alerts/linux/linux_memory_threat_alert.md |    0
 .../macos/macos_malicious_behavior_alert.md   |    0
 .../alerts/macos/macos_malware_alert.md       |    0
 .../alerts/macos/macos_memory_threat_alert.md |    0
 .../windows_malicious_behavior_alert.md       |    0
 .../alerts/windows/windows_malware_alert.md   |    0
 .../windows/windows_memory_threat_alert.md    |    0
 .../windows/windows_ransomware_alert.md       |    0
 .../windows/windows_shellcode_thread.md       |    0
 .../api/windows/windows_api_amsi.md           |    0
 .../api/windows/windows_api_asm.md            |    0
 .../windows/windows_api_credential_access.md  |    0
 .../api/windows/windows_api_kernel_audit.md   |    0
 .../api/windows/windows_api_tcpip.md          |    0
 .../windows_api_threat_intelligence.md        |    0
 .../api/windows/windows_api_win32k.md         |    0
 .../api/windows/windows_api_wmi.md            |    0
 .../file/linux/linux_file_create.md           |    0
 .../file/linux/linux_file_delete.md           |    0
 .../linux/linux_file_endpoint_unquarantine.md |    0
 .../file/linux/linux_file_rename.md           |    0
 .../file/macos/macos_file_access.md           |    0
 .../file/macos/macos_file_delete.md           |    0
 .../macos/macos_file_endpoint_unquarantine.md |    0
 .../macos_file_extended_attributes_delete.md  |    0
 .../file/macos/macos_file_launch_daemon.md    |    0
 .../file/macos/macos_file_modification.md     |    0
 .../file/macos/macos_file_mount.md            |    0
 .../file/macos/macos_file_rename.md           |    0
 .../file/windows/windows_file_create.md       |    0
 .../file/windows/windows_file_delete.md       |    0
 .../windows_file_endpoint_unquarantine.md     |    0
 .../file/windows/windows_file_modification.md |    0
 .../file/windows/windows_file_open.md         |    0
 .../file/windows/windows_file_overwrite.md    |    0
 .../file/windows/windows_file_rename.md       |    0
 .../library/macos/macos_library_load.md       |    0
 .../library/windows/windows_library_load.md   |    0
 .../metadata/metadata.md                      |    0
 .../metrics/metrics.md                        |    0
 ...twork_attempted_accepted_and_disconnect.md |    0
 .../linux/linux_network_dns_lookup_result.md  |    0
 ...ork_connection_attempted_and_disconnect.md |    0
 .../macos/macos_network_dns_lookup_result.md  |    0
 ...twork_attempted_accepted_and_disconnect.md |    0
 .../windows_network_dns_lookup_requested.md   |    0
 .../windows_network_dns_lookup_result.md      |    0
 .../policy/policy_response.md                 |    0
 .../linux/linux_process_already_running.md    |    0
 .../linux/linux_process_fork_exec_exit.md     |    0
 .../process/linux/linux_process_gid_change.md |    0
 .../linux/linux_process_memfd_create.md       |    0
 .../process/linux/linux_process_ptrace.md     |    0
 .../linux/linux_process_session_id_change.md  |    0
 .../process/linux/linux_process_shmget.md     |    0
 .../linux/linux_process_text_output.md        |    0
 .../process/linux/linux_process_uid_change.md |    0
 .../macos/macos_process_already_running.md    |    0
 .../macos/macos_process_fork_exec_exit.md     |    0
 .../macos/macos_process_remote_thread.md      |    0
 .../windows_process_already_running.md        |    0
 .../windows_process_create_and_exit.md        |    0
 .../windows/windows_registry_modification.md  |    0
 .../windows/windows_registry_query.md         |    0
 .../macos_security_gatekeeper_override.md     |    0
 .../security/macos/macos_security_log_on.md   |    0
 .../macos/macos_security_rdp_log_on.md        |    0
 .../macos/macos_security_ssh_log_on.md        |    0
 .../windows/windows_security_log_off.md       |    0
 .../windows/windows_security_log_on.md        |    0
 .../windows/windows_volume_device_mount.md    |    0
 .../windows/windows_volume_device_unmount.md  |    0
 .../linux/linux_malicious_behavior_alert.md   |  554 --------
 .../alerts/linux/linux_malware_alert.md       | 1109 ---------------
 .../alerts/linux/linux_memory_threat_alert.md |  979 -------------
 .../macos/macos_malicious_behavior_alert.md   |  489 -------
 .../alerts/macos/macos_malware_alert.md       |  699 ---------
 .../alerts/macos/macos_memory_threat_alert.md |  599 --------
 .../windows_malicious_behavior_alert.md       |  534 -------
 .../alerts/windows/windows_malware_alert.md   |  974 -------------
 .../windows/windows_memory_threat_alert.md    |  679 ---------
 .../windows/windows_ransomware_alert.md       |  824 -----------
 .../windows/windows_shellcode_thread.md       | 1259 -----------------
 .../api/windows/windows_api_amsi.md           |  338 -----
 .../api/windows/windows_api_asm.md            |  353 -----
 .../windows/windows_api_credential_access.md  |  338 -----
 .../api/windows/windows_api_kernel_audit.md   |  313 ----
 .../api/windows/windows_api_tcpip.md          |  333 -----
 .../windows_api_threat_intelligence.md        |  533 -------
 .../api/windows/windows_api_win32k.md         |  443 ------
 .../api/windows/windows_api_wmi.md            |  388 -----
 .../file/linux/linux_file_create.md           |  314 ----
 .../file/linux/linux_file_delete.md           |  309 ----
 .../linux/linux_file_endpoint_unquarantine.md |  229 ---
 .../file/linux/linux_file_rename.md           |  329 -----
 .../file/macos/macos_file_access.md           |  274 ----
 .../file/macos/macos_file_delete.md           |  349 -----
 .../macos/macos_file_endpoint_unquarantine.md |  229 ---
 .../macos_file_extended_attributes_delete.md  |  349 -----
 .../file/macos/macos_file_launch_daemon.md    |  339 -----
 .../file/macos/macos_file_modification.md     |  359 -----
 .../file/macos/macos_file_mount.md            |  334 -----
 .../file/macos/macos_file_rename.md           |  364 -----
 .../file/windows/windows_file_create.md       |  369 -----
 .../file/windows/windows_file_delete.md       |  344 -----
 .../windows_file_endpoint_unquarantine.md     |  229 ---
 .../file/windows/windows_file_modification.md |  349 -----
 .../file/windows/windows_file_open.md         |  354 -----
 .../file/windows/windows_file_overwrite.md    |  349 -----
 .../file/windows/windows_file_rename.md       |  369 -----
 .../library/macos/macos_library_load.md       |  364 -----
 .../library/windows/windows_library_load.md   |  394 ------
 .../doc/sample_output/metadata/metadata.md    |  249 ----
 .../doc/sample_output/metrics/metrics.md      |  949 -------------
 ...twork_attempted_accepted_and_disconnect.md |  369 -----
 .../linux/linux_network_dns_lookup_result.md  |  283 ----
 ...ork_connection_attempted_and_disconnect.md |  359 -----
 .../macos/macos_network_dns_lookup_result.md  |  374 -----
 ...twork_attempted_accepted_and_disconnect.md |  339 -----
 .../windows_network_dns_lookup_requested.md   |  309 ----
 .../windows_network_dns_lookup_result.md      |  314 ----
 .../sample_output/policy/policy_response.md   |  454 ------
 .../linux/linux_process_already_running.md    |  959 -------------
 .../linux/linux_process_fork_exec_exit.md     |  979 -------------
 .../process/linux/linux_process_gid_change.md |  969 -------------
 .../linux/linux_process_memfd_create.md       |  988 -------------
 .../process/linux/linux_process_ptrace.md     |  968 -------------
 .../linux/linux_process_session_id_change.md  |  949 -------------
 .../process/linux/linux_process_shmget.md     |  968 -------------
 .../linux/linux_process_text_output.md        |  979 -------------
 .../process/linux/linux_process_uid_change.md |  973 -------------
 .../macos/macos_process_already_running.md    |  354 -----
 .../macos/macos_process_fork_exec_exit.md     |  444 ------
 .../macos/macos_process_remote_thread.md      |  419 ------
 .../windows_process_already_running.md        |  479 -------
 .../windows_process_create_and_exit.md        |  604 --------
 .../windows/windows_registry_modification.md  |  334 -----
 .../windows/windows_registry_query.md         |  324 -----
 .../macos_security_gatekeeper_override.md     |  354 -----
 .../security/macos/macos_security_log_on.md   |  339 -----
 .../macos/macos_security_rdp_log_on.md        |  339 -----
 .../macos/macos_security_ssh_log_on.md        |  339 -----
 .../windows/windows_security_log_off.md       |  314 ----
 .../windows/windows_security_log_on.md        |  329 -----
 .../windows/windows_volume_device_mount.md    |  319 -----
 .../windows/windows_volume_device_unmount.md  |  274 ----
 148 files changed, 36933 deletions(-)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/linux/linux_malicious_behavior_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/linux/linux_malware_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/linux/linux_memory_threat_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/macos/macos_malicious_behavior_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/macos/macos_malware_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/macos/macos_memory_threat_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/windows/windows_malicious_behavior_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/windows/windows_malware_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/windows/windows_memory_threat_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/windows/windows_ransomware_alert.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/alerts/windows/windows_shellcode_thread.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/api/windows/windows_api_amsi.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/api/windows/windows_api_asm.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/api/windows/windows_api_credential_access.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/api/windows/windows_api_kernel_audit.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/api/windows/windows_api_tcpip.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/api/windows/windows_api_threat_intelligence.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/api/windows/windows_api_win32k.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/api/windows/windows_api_wmi.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/linux/linux_file_create.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/linux/linux_file_delete.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/linux/linux_file_endpoint_unquarantine.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/linux/linux_file_rename.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/macos/macos_file_access.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/macos/macos_file_delete.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/macos/macos_file_endpoint_unquarantine.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/macos/macos_file_extended_attributes_delete.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/macos/macos_file_launch_daemon.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/macos/macos_file_modification.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/macos/macos_file_mount.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/macos/macos_file_rename.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/windows/windows_file_create.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/windows/windows_file_delete.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/windows/windows_file_endpoint_unquarantine.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/windows/windows_file_modification.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/windows/windows_file_open.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/windows/windows_file_overwrite.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/file/windows/windows_file_rename.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/library/macos/macos_library_load.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/library/windows/windows_library_load.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/metadata/metadata.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/metrics/metrics.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/network/linux/linux_network_attempted_accepted_and_disconnect.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/network/linux/linux_network_dns_lookup_result.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/network/macos/macos_network_connection_attempted_and_disconnect.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/network/macos/macos_network_dns_lookup_result.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/network/windows/windows_network_attempted_accepted_and_disconnect.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/network/windows/windows_network_dns_lookup_requested.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/network/windows/windows_network_dns_lookup_result.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/policy/policy_response.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/linux/linux_process_already_running.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/linux/linux_process_fork_exec_exit.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/linux/linux_process_gid_change.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/linux/linux_process_memfd_create.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/linux/linux_process_ptrace.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/linux/linux_process_session_id_change.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/linux/linux_process_shmget.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/linux/linux_process_text_output.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/linux/linux_process_uid_change.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/macos/macos_process_already_running.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/macos/macos_process_fork_exec_exit.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/macos/macos_process_remote_thread.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/windows/windows_process_already_running.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/process/windows/windows_process_create_and_exit.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/registry/windows/windows_registry_modification.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/registry/windows/windows_registry_query.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/security/macos/macos_security_gatekeeper_override.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/security/macos/macos_security_log_on.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/security/macos/macos_security_rdp_log_on.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/security/macos/macos_security_ssh_log_on.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/security/windows/windows_security_log_off.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/security/windows/windows_security_log_on.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/volume_device/windows/windows_volume_device_mount.md (100%)
 rename custom_documentation/doc/{sample_variant_1 => new_output}/volume_device/windows/windows_volume_device_unmount.md (100%)
 delete mode 100644 custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md
 delete mode 100644 custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md
 delete mode 100644 custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md
 delete mode 100644 custom_documentation/doc/sample_output/api/windows/windows_api_asm.md
 delete mode 100644 custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md
 delete mode 100644 custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md
 delete mode 100644 custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md
 delete mode 100644 custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md
 delete mode 100644 custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md
 delete mode 100644 custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md
 delete mode 100644 custom_documentation/doc/sample_output/file/linux/linux_file_create.md
 delete mode 100644 custom_documentation/doc/sample_output/file/linux/linux_file_delete.md
 delete mode 100644 custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md
 delete mode 100644 custom_documentation/doc/sample_output/file/linux/linux_file_rename.md
 delete mode 100644 custom_documentation/doc/sample_output/file/macos/macos_file_access.md
 delete mode 100644 custom_documentation/doc/sample_output/file/macos/macos_file_delete.md
 delete mode 100644 custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md
 delete mode 100644 custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md
 delete mode 100644 custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md
 delete mode 100644 custom_documentation/doc/sample_output/file/macos/macos_file_modification.md
 delete mode 100644 custom_documentation/doc/sample_output/file/macos/macos_file_mount.md
 delete mode 100644 custom_documentation/doc/sample_output/file/macos/macos_file_rename.md
 delete mode 100644 custom_documentation/doc/sample_output/file/windows/windows_file_create.md
 delete mode 100644 custom_documentation/doc/sample_output/file/windows/windows_file_delete.md
 delete mode 100644 custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md
 delete mode 100644 custom_documentation/doc/sample_output/file/windows/windows_file_modification.md
 delete mode 100644 custom_documentation/doc/sample_output/file/windows/windows_file_open.md
 delete mode 100644 custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md
 delete mode 100644 custom_documentation/doc/sample_output/file/windows/windows_file_rename.md
 delete mode 100644 custom_documentation/doc/sample_output/library/macos/macos_library_load.md
 delete mode 100644 custom_documentation/doc/sample_output/library/windows/windows_library_load.md
 delete mode 100644 custom_documentation/doc/sample_output/metadata/metadata.md
 delete mode 100644 custom_documentation/doc/sample_output/metrics/metrics.md
 delete mode 100644 custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
 delete mode 100644 custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md
 delete mode 100644 custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
 delete mode 100644 custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md
 delete mode 100644 custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
 delete mode 100644 custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md
 delete mode 100644 custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md
 delete mode 100644 custom_documentation/doc/sample_output/policy/policy_response.md
 delete mode 100644 custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md
 delete mode 100644 custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md
 delete mode 100644 custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md
 delete mode 100644 custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md
 delete mode 100644 custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md
 delete mode 100644 custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md
 delete mode 100644 custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md
 delete mode 100644 custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md
 delete mode 100644 custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md
 delete mode 100644 custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md
 delete mode 100644 custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md
 delete mode 100644 custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md
 delete mode 100644 custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md
 delete mode 100644 custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md
 delete mode 100644 custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md
 delete mode 100644 custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md
 delete mode 100644 custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md
 delete mode 100644 custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md
 delete mode 100644 custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md
 delete mode 100644 custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md
 delete mode 100644 custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md
 delete mode 100644 custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md
 delete mode 100644 custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md
 delete mode 100644 custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md

diff --git a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md b/custom_documentation/doc/new_output/alerts/linux/linux_malicious_behavior_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/linux/linux_malicious_behavior_alert.md
rename to custom_documentation/doc/new_output/alerts/linux/linux_malicious_behavior_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md b/custom_documentation/doc/new_output/alerts/linux/linux_malware_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/linux/linux_malware_alert.md
rename to custom_documentation/doc/new_output/alerts/linux/linux_malware_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md b/custom_documentation/doc/new_output/alerts/linux/linux_memory_threat_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/linux/linux_memory_threat_alert.md
rename to custom_documentation/doc/new_output/alerts/linux/linux_memory_threat_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md b/custom_documentation/doc/new_output/alerts/macos/macos_malicious_behavior_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/macos/macos_malicious_behavior_alert.md
rename to custom_documentation/doc/new_output/alerts/macos/macos_malicious_behavior_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md b/custom_documentation/doc/new_output/alerts/macos/macos_malware_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/macos/macos_malware_alert.md
rename to custom_documentation/doc/new_output/alerts/macos/macos_malware_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md b/custom_documentation/doc/new_output/alerts/macos/macos_memory_threat_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/macos/macos_memory_threat_alert.md
rename to custom_documentation/doc/new_output/alerts/macos/macos_memory_threat_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md b/custom_documentation/doc/new_output/alerts/windows/windows_malicious_behavior_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/windows/windows_malicious_behavior_alert.md
rename to custom_documentation/doc/new_output/alerts/windows/windows_malicious_behavior_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md b/custom_documentation/doc/new_output/alerts/windows/windows_malware_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/windows/windows_malware_alert.md
rename to custom_documentation/doc/new_output/alerts/windows/windows_malware_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md b/custom_documentation/doc/new_output/alerts/windows/windows_memory_threat_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/windows/windows_memory_threat_alert.md
rename to custom_documentation/doc/new_output/alerts/windows/windows_memory_threat_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md b/custom_documentation/doc/new_output/alerts/windows/windows_ransomware_alert.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/windows/windows_ransomware_alert.md
rename to custom_documentation/doc/new_output/alerts/windows/windows_ransomware_alert.md
diff --git a/custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md b/custom_documentation/doc/new_output/alerts/windows/windows_shellcode_thread.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/alerts/windows/windows_shellcode_thread.md
rename to custom_documentation/doc/new_output/alerts/windows/windows_shellcode_thread.md
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md b/custom_documentation/doc/new_output/api/windows/windows_api_amsi.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/api/windows/windows_api_amsi.md
rename to custom_documentation/doc/new_output/api/windows/windows_api_amsi.md
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md b/custom_documentation/doc/new_output/api/windows/windows_api_asm.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/api/windows/windows_api_asm.md
rename to custom_documentation/doc/new_output/api/windows/windows_api_asm.md
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md b/custom_documentation/doc/new_output/api/windows/windows_api_credential_access.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/api/windows/windows_api_credential_access.md
rename to custom_documentation/doc/new_output/api/windows/windows_api_credential_access.md
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md b/custom_documentation/doc/new_output/api/windows/windows_api_kernel_audit.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/api/windows/windows_api_kernel_audit.md
rename to custom_documentation/doc/new_output/api/windows/windows_api_kernel_audit.md
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md b/custom_documentation/doc/new_output/api/windows/windows_api_tcpip.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/api/windows/windows_api_tcpip.md
rename to custom_documentation/doc/new_output/api/windows/windows_api_tcpip.md
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md b/custom_documentation/doc/new_output/api/windows/windows_api_threat_intelligence.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/api/windows/windows_api_threat_intelligence.md
rename to custom_documentation/doc/new_output/api/windows/windows_api_threat_intelligence.md
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md b/custom_documentation/doc/new_output/api/windows/windows_api_win32k.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/api/windows/windows_api_win32k.md
rename to custom_documentation/doc/new_output/api/windows/windows_api_win32k.md
diff --git a/custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md b/custom_documentation/doc/new_output/api/windows/windows_api_wmi.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/api/windows/windows_api_wmi.md
rename to custom_documentation/doc/new_output/api/windows/windows_api_wmi.md
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md b/custom_documentation/doc/new_output/file/linux/linux_file_create.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/linux/linux_file_create.md
rename to custom_documentation/doc/new_output/file/linux/linux_file_create.md
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md b/custom_documentation/doc/new_output/file/linux/linux_file_delete.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/linux/linux_file_delete.md
rename to custom_documentation/doc/new_output/file/linux/linux_file_delete.md
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md b/custom_documentation/doc/new_output/file/linux/linux_file_endpoint_unquarantine.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/linux/linux_file_endpoint_unquarantine.md
rename to custom_documentation/doc/new_output/file/linux/linux_file_endpoint_unquarantine.md
diff --git a/custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md b/custom_documentation/doc/new_output/file/linux/linux_file_rename.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/linux/linux_file_rename.md
rename to custom_documentation/doc/new_output/file/linux/linux_file_rename.md
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md b/custom_documentation/doc/new_output/file/macos/macos_file_access.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/macos/macos_file_access.md
rename to custom_documentation/doc/new_output/file/macos/macos_file_access.md
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md b/custom_documentation/doc/new_output/file/macos/macos_file_delete.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/macos/macos_file_delete.md
rename to custom_documentation/doc/new_output/file/macos/macos_file_delete.md
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md b/custom_documentation/doc/new_output/file/macos/macos_file_endpoint_unquarantine.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/macos/macos_file_endpoint_unquarantine.md
rename to custom_documentation/doc/new_output/file/macos/macos_file_endpoint_unquarantine.md
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md b/custom_documentation/doc/new_output/file/macos/macos_file_extended_attributes_delete.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/macos/macos_file_extended_attributes_delete.md
rename to custom_documentation/doc/new_output/file/macos/macos_file_extended_attributes_delete.md
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md b/custom_documentation/doc/new_output/file/macos/macos_file_launch_daemon.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/macos/macos_file_launch_daemon.md
rename to custom_documentation/doc/new_output/file/macos/macos_file_launch_daemon.md
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md b/custom_documentation/doc/new_output/file/macos/macos_file_modification.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/macos/macos_file_modification.md
rename to custom_documentation/doc/new_output/file/macos/macos_file_modification.md
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md b/custom_documentation/doc/new_output/file/macos/macos_file_mount.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/macos/macos_file_mount.md
rename to custom_documentation/doc/new_output/file/macos/macos_file_mount.md
diff --git a/custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md b/custom_documentation/doc/new_output/file/macos/macos_file_rename.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/macos/macos_file_rename.md
rename to custom_documentation/doc/new_output/file/macos/macos_file_rename.md
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md b/custom_documentation/doc/new_output/file/windows/windows_file_create.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/windows/windows_file_create.md
rename to custom_documentation/doc/new_output/file/windows/windows_file_create.md
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md b/custom_documentation/doc/new_output/file/windows/windows_file_delete.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/windows/windows_file_delete.md
rename to custom_documentation/doc/new_output/file/windows/windows_file_delete.md
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md b/custom_documentation/doc/new_output/file/windows/windows_file_endpoint_unquarantine.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/windows/windows_file_endpoint_unquarantine.md
rename to custom_documentation/doc/new_output/file/windows/windows_file_endpoint_unquarantine.md
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md b/custom_documentation/doc/new_output/file/windows/windows_file_modification.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/windows/windows_file_modification.md
rename to custom_documentation/doc/new_output/file/windows/windows_file_modification.md
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md b/custom_documentation/doc/new_output/file/windows/windows_file_open.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/windows/windows_file_open.md
rename to custom_documentation/doc/new_output/file/windows/windows_file_open.md
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md b/custom_documentation/doc/new_output/file/windows/windows_file_overwrite.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/windows/windows_file_overwrite.md
rename to custom_documentation/doc/new_output/file/windows/windows_file_overwrite.md
diff --git a/custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md b/custom_documentation/doc/new_output/file/windows/windows_file_rename.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/file/windows/windows_file_rename.md
rename to custom_documentation/doc/new_output/file/windows/windows_file_rename.md
diff --git a/custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md b/custom_documentation/doc/new_output/library/macos/macos_library_load.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/library/macos/macos_library_load.md
rename to custom_documentation/doc/new_output/library/macos/macos_library_load.md
diff --git a/custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md b/custom_documentation/doc/new_output/library/windows/windows_library_load.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/library/windows/windows_library_load.md
rename to custom_documentation/doc/new_output/library/windows/windows_library_load.md
diff --git a/custom_documentation/doc/sample_variant_1/metadata/metadata.md b/custom_documentation/doc/new_output/metadata/metadata.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/metadata/metadata.md
rename to custom_documentation/doc/new_output/metadata/metadata.md
diff --git a/custom_documentation/doc/sample_variant_1/metrics/metrics.md b/custom_documentation/doc/new_output/metrics/metrics.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/metrics/metrics.md
rename to custom_documentation/doc/new_output/metrics/metrics.md
diff --git a/custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/new_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/network/linux/linux_network_attempted_accepted_and_disconnect.md
rename to custom_documentation/doc/new_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
diff --git a/custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md b/custom_documentation/doc/new_output/network/linux/linux_network_dns_lookup_result.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/network/linux/linux_network_dns_lookup_result.md
rename to custom_documentation/doc/new_output/network/linux/linux_network_dns_lookup_result.md
diff --git a/custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md b/custom_documentation/doc/new_output/network/macos/macos_network_connection_attempted_and_disconnect.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/network/macos/macos_network_connection_attempted_and_disconnect.md
rename to custom_documentation/doc/new_output/network/macos/macos_network_connection_attempted_and_disconnect.md
diff --git a/custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md b/custom_documentation/doc/new_output/network/macos/macos_network_dns_lookup_result.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/network/macos/macos_network_dns_lookup_result.md
rename to custom_documentation/doc/new_output/network/macos/macos_network_dns_lookup_result.md
diff --git a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/new_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/network/windows/windows_network_attempted_accepted_and_disconnect.md
rename to custom_documentation/doc/new_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
diff --git a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md b/custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_requested.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_requested.md
rename to custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_requested.md
diff --git a/custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md b/custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_result.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/network/windows/windows_network_dns_lookup_result.md
rename to custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_result.md
diff --git a/custom_documentation/doc/sample_variant_1/policy/policy_response.md b/custom_documentation/doc/new_output/policy/policy_response.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/policy/policy_response.md
rename to custom_documentation/doc/new_output/policy/policy_response.md
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md b/custom_documentation/doc/new_output/process/linux/linux_process_already_running.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/linux/linux_process_already_running.md
rename to custom_documentation/doc/new_output/process/linux/linux_process_already_running.md
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md b/custom_documentation/doc/new_output/process/linux/linux_process_fork_exec_exit.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/linux/linux_process_fork_exec_exit.md
rename to custom_documentation/doc/new_output/process/linux/linux_process_fork_exec_exit.md
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md b/custom_documentation/doc/new_output/process/linux/linux_process_gid_change.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/linux/linux_process_gid_change.md
rename to custom_documentation/doc/new_output/process/linux/linux_process_gid_change.md
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md b/custom_documentation/doc/new_output/process/linux/linux_process_memfd_create.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/linux/linux_process_memfd_create.md
rename to custom_documentation/doc/new_output/process/linux/linux_process_memfd_create.md
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md b/custom_documentation/doc/new_output/process/linux/linux_process_ptrace.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/linux/linux_process_ptrace.md
rename to custom_documentation/doc/new_output/process/linux/linux_process_ptrace.md
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md b/custom_documentation/doc/new_output/process/linux/linux_process_session_id_change.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/linux/linux_process_session_id_change.md
rename to custom_documentation/doc/new_output/process/linux/linux_process_session_id_change.md
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md b/custom_documentation/doc/new_output/process/linux/linux_process_shmget.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/linux/linux_process_shmget.md
rename to custom_documentation/doc/new_output/process/linux/linux_process_shmget.md
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md b/custom_documentation/doc/new_output/process/linux/linux_process_text_output.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/linux/linux_process_text_output.md
rename to custom_documentation/doc/new_output/process/linux/linux_process_text_output.md
diff --git a/custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md b/custom_documentation/doc/new_output/process/linux/linux_process_uid_change.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/linux/linux_process_uid_change.md
rename to custom_documentation/doc/new_output/process/linux/linux_process_uid_change.md
diff --git a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md b/custom_documentation/doc/new_output/process/macos/macos_process_already_running.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/macos/macos_process_already_running.md
rename to custom_documentation/doc/new_output/process/macos/macos_process_already_running.md
diff --git a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md b/custom_documentation/doc/new_output/process/macos/macos_process_fork_exec_exit.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/macos/macos_process_fork_exec_exit.md
rename to custom_documentation/doc/new_output/process/macos/macos_process_fork_exec_exit.md
diff --git a/custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md b/custom_documentation/doc/new_output/process/macos/macos_process_remote_thread.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/macos/macos_process_remote_thread.md
rename to custom_documentation/doc/new_output/process/macos/macos_process_remote_thread.md
diff --git a/custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md b/custom_documentation/doc/new_output/process/windows/windows_process_already_running.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/windows/windows_process_already_running.md
rename to custom_documentation/doc/new_output/process/windows/windows_process_already_running.md
diff --git a/custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md b/custom_documentation/doc/new_output/process/windows/windows_process_create_and_exit.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/process/windows/windows_process_create_and_exit.md
rename to custom_documentation/doc/new_output/process/windows/windows_process_create_and_exit.md
diff --git a/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md b/custom_documentation/doc/new_output/registry/windows/windows_registry_modification.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_modification.md
rename to custom_documentation/doc/new_output/registry/windows/windows_registry_modification.md
diff --git a/custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md b/custom_documentation/doc/new_output/registry/windows/windows_registry_query.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/registry/windows/windows_registry_query.md
rename to custom_documentation/doc/new_output/registry/windows/windows_registry_query.md
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md b/custom_documentation/doc/new_output/security/macos/macos_security_gatekeeper_override.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/security/macos/macos_security_gatekeeper_override.md
rename to custom_documentation/doc/new_output/security/macos/macos_security_gatekeeper_override.md
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md b/custom_documentation/doc/new_output/security/macos/macos_security_log_on.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/security/macos/macos_security_log_on.md
rename to custom_documentation/doc/new_output/security/macos/macos_security_log_on.md
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md b/custom_documentation/doc/new_output/security/macos/macos_security_rdp_log_on.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/security/macos/macos_security_rdp_log_on.md
rename to custom_documentation/doc/new_output/security/macos/macos_security_rdp_log_on.md
diff --git a/custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md b/custom_documentation/doc/new_output/security/macos/macos_security_ssh_log_on.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/security/macos/macos_security_ssh_log_on.md
rename to custom_documentation/doc/new_output/security/macos/macos_security_ssh_log_on.md
diff --git a/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md b/custom_documentation/doc/new_output/security/windows/windows_security_log_off.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_off.md
rename to custom_documentation/doc/new_output/security/windows/windows_security_log_off.md
diff --git a/custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md b/custom_documentation/doc/new_output/security/windows/windows_security_log_on.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/security/windows/windows_security_log_on.md
rename to custom_documentation/doc/new_output/security/windows/windows_security_log_on.md
diff --git a/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md b/custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_mount.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_mount.md
rename to custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_mount.md
diff --git a/custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md b/custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_unmount.md
similarity index 100%
rename from custom_documentation/doc/sample_variant_1/volume_device/windows/windows_volume_device_unmount.md
rename to custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_unmount.md
diff --git a/custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md b/custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md
deleted file mode 100644
index 7ceda2076..000000000
--- a/custom_documentation/doc/sample_output/alerts/linux/linux_malicious_behavior_alert.md
+++ /dev/null
@@ -1,554 +0,0 @@
-# Linux Malicious Behavior Alert
-
-## Description
-
-This alert is generated when a Malicious Behavior alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "behavior"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the artifact for linux malicious behavior alert.</td>
-<td><code>stable</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Events.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Events._label</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Events._state</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.@timestamp</code></td>
-<td>Timestamp in which action was taken</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.action</code></td>
-<td>Response action name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.field</code></td>
-<td>Field in the triggering event to use as input for action</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.state</code></td>
-<td>Index of event in events array to use for field lookup</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.tree</code></td>
-<td>Indicates whether or not an action was taken against an entire process tree</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.message</code></td>
-<td>Result message</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.process.entity_id</code></td>
-<td>Entity id of actionable process</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.process.name</code></td>
-<td>Name of actionable process</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.process.pid</code></td>
-<td>pid of actionable process</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.result</code></td>
-<td>Response action result code</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.account.id</code></td>
-<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
-<td><code>666777888999</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>rule.description</code></td>
-<td>The description of the rule generating the event.</td>
-<td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td>
-</tr>
-<tr>
-<td><code>rule.id</code></td>
-<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
-<td><code>101</code></td>
-</tr>
-<tr>
-<td><code>rule.name</code></td>
-<td>The name of the rule or signature generating the event.</td>
-<td><code>BLOCK_DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.reference</code></td>
-<td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td>
-<td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>rule.version</code></td>
-<td>The version / revision of the rule being used for analysis.</td>
-<td><code>1.1</code></td>
-</tr>
-<tr>
-<td><code>threat.framework</code></td>
-<td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td>
-<td><code>MITRE ATT&CK</code></td>
-</tr>
-<tr>
-<td><code>threat.tactic.id</code></td>
-<td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
-<td><code>TA0002</code></td>
-</tr>
-<tr>
-<td><code>threat.tactic.name</code></td>
-<td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td>
-<td><code>Execution</code></td>
-</tr>
-<tr>
-<td><code>threat.tactic.reference</code></td>
-<td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
-<td><code>https://attack.mitre.org/tactics/TA0002/</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.id</code></td>
-<td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
-<td><code>T1059</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.name</code></td>
-<td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
-<td><code>Command and Scripting Interpreter</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.reference</code></td>
-<td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
-<td><code>https://attack.mitre.org/techniques/T1059/</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.subtechnique</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md b/custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md
deleted file mode 100644
index a5a74e497..000000000
--- a/custom_documentation/doc/sample_output/alerts/linux/linux_malware_alert.md
+++ /dev/null
@@ -1,1109 +0,0 @@
-# Linux Malware Alert
-
-## Description
-
-This alert is generated when a Malware alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "malicious_file"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the linux artifact.</td>
-<td><code>stable</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.identifier</code></td>
-<td>The model's unique identifier.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.score</code></td>
-<td>The score produced by the classification model.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.threshold</code></td>
-<td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.version</code></td>
-<td>The version of the model used.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.all_names</code></td>
-<td>The concatenated names of all yara signatures</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.identifier</code></td>
-<td>Malware artifact identifier.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.matches</code></td>
-<td>An array of bytes representing yara signature matches</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.signature.hash.sha256</code></td>
-<td>Primary malware signature sha256.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.signature.id</code></td>
-<td>Primary malware signature id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.signature.name</code></td>
-<td>Primary malware signature name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.matches</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.signature.hash.sha256</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.signature.id</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.signature.name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.version</code></td>
-<td>Primary malware signature version.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.quarantine_message</code></td>
-<td>Message describing quarantine results.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.quarantine_path</code></td>
-<td>Path on endpoint the quarantined file was originally.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.quarantine_result</code></td>
-<td>Boolean representing whether or not file quarantine succeeded.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.temp_file_path</code></td>
-<td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.accessed</code></td>
-<td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.created</code></td>
-<td>File creation time.  Note that not all filesystems store the creation time.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.directory</code></td>
-<td>Directory where the file is located. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.inode</code></td>
-<td>Inode representing the file in the filesystem.</td>
-<td><code>256383</code></td>
-</tr>
-<tr>
-<td><code>file.mtime</code></td>
-<td>Last time the file content was modified.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.owner</code></td>
-<td>File owner's username.</td>
-<td><code>alice</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pgid</code></td>
-<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pgid</code></td>
-<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>rule.id</code></td>
-<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
-<td><code>101</code></td>
-</tr>
-<tr>
-<td><code>rule.name</code></td>
-<td>The name of the rule or signature generating the event.</td>
-<td><code>BLOCK_DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md b/custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md
deleted file mode 100644
index 352ab7515..000000000
--- a/custom_documentation/doc/sample_output/alerts/linux/linux_memory_threat_alert.md
+++ /dev/null
@@ -1,979 +0,0 @@
-# Linux Memory Threat Alert
-
-## Description
-
-This alert is generated when a Memory Threat alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "memory_signature"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the linux artifact.</td>
-<td><code>stable</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_base</code></td>
-<td>Base address of the memory allocation containing the memory region.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_size</code></td>
-<td>Original memory size requested when the memory was allocated.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_type</code></td>
-<td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td>
-<td><code>PRIVATE</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_address</code></td>
-<td>The address where bytes_compressed begins.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_allocation_offset</code></td>
-<td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_compressed</code></td>
-<td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td>
-<td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_compressed_present</code></td>
-<td>Whether bytes_compressed is present in this event.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.all_names</code></td>
-<td>A sequence of signature names matched.</td>
-<td><code>Windows.EICAR.Not-a-virus</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.identifier</code></td>
-<td>malware signature identifier</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.matches</code></td>
-<td>The first matching details.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256</code></td>
-<td>sha256 hash of file matching signature.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.signature.id</code></td>
-<td>The id of the first yara rule matched.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.signature.name</code></td>
-<td>The name of the first yara rule matched.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.version</code></td>
-<td>malware signature version</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_base</code></td>
-<td>Base address of the memory region.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_protection</code></td>
-<td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td>
-<td><code>RWX</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_size</code></td>
-<td>Size of the memory region.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pgid</code></td>
-<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.pgid</code></td>
-<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>rule.id</code></td>
-<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
-<td><code>101</code></td>
-</tr>
-<tr>
-<td><code>rule.name</code></td>
-<td>The name of the rule or signature generating the event.</td>
-<td><code>BLOCK_DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md b/custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md
deleted file mode 100644
index 2d56f7734..000000000
--- a/custom_documentation/doc/sample_output/alerts/macos/macos_malicious_behavior_alert.md
+++ /dev/null
@@ -1,489 +0,0 @@
-# macOS Malicious Behavior Alert
-
-## Description
-
-This alert is generated when a Malicious Behavior alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "behavior"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the macos artifact.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Events.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Events._label</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Events._state</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.@timestamp</code></td>
-<td>Timestamp in which action was taken</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.action</code></td>
-<td>Response action name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.field</code></td>
-<td>Field in the triggering event to use as input for action</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.state</code></td>
-<td>Index of event in events array to use for field lookup</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.tree</code></td>
-<td>Indicates whether or not an action was taken against an entire process tree</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.message</code></td>
-<td>Result message</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.process.entity_id</code></td>
-<td>Entity id of actionable process</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.process.name</code></td>
-<td>Name of actionable process</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.process.pid</code></td>
-<td>pid of actionable process</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.result</code></td>
-<td>Response action result code</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>rule.description</code></td>
-<td>The description of the rule generating the event.</td>
-<td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td>
-</tr>
-<tr>
-<td><code>rule.id</code></td>
-<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
-<td><code>101</code></td>
-</tr>
-<tr>
-<td><code>rule.name</code></td>
-<td>The name of the rule or signature generating the event.</td>
-<td><code>BLOCK_DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.reference</code></td>
-<td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td>
-<td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>rule.version</code></td>
-<td>The version / revision of the rule being used for analysis.</td>
-<td><code>1.1</code></td>
-</tr>
-<tr>
-<td><code>threat.framework</code></td>
-<td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td>
-<td><code>MITRE ATT&CK</code></td>
-</tr>
-<tr>
-<td><code>threat.tactic.id</code></td>
-<td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
-<td><code>TA0002</code></td>
-</tr>
-<tr>
-<td><code>threat.tactic.name</code></td>
-<td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td>
-<td><code>Execution</code></td>
-</tr>
-<tr>
-<td><code>threat.tactic.reference</code></td>
-<td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
-<td><code>https://attack.mitre.org/tactics/TA0002/</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.id</code></td>
-<td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
-<td><code>T1059</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.name</code></td>
-<td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
-<td><code>Command and Scripting Interpreter</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.reference</code></td>
-<td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
-<td><code>https://attack.mitre.org/techniques/T1059/</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.subtechnique</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md b/custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md
deleted file mode 100644
index f1436d045..000000000
--- a/custom_documentation/doc/sample_output/alerts/macos/macos_malware_alert.md
+++ /dev/null
@@ -1,699 +0,0 @@
-# macOS Malware Alert
-
-## Description
-
-This alert is generated when a macOS Malware alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "malicious_file"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the macos artifact.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.identifier</code></td>
-<td>The model's unique identifier.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.score</code></td>
-<td>The score produced by the classification model.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.threshold</code></td>
-<td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.version</code></td>
-<td>The version of the model used.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.all_names</code></td>
-<td>The concatenated names of all yara signatures</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.identifier</code></td>
-<td>Malware artifact identifier.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.matches</code></td>
-<td>An array of bytes representing yara signature matches</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.signature.hash.sha256</code></td>
-<td>Primary malware signature sha256.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.signature.id</code></td>
-<td>Primary malware signature id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.signature.name</code></td>
-<td>Primary malware signature name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.matches</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.signature.hash.sha256</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.signature.id</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.signature.name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.version</code></td>
-<td>Primary malware signature version.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.quarantine_message</code></td>
-<td>Message describing quarantine results.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.quarantine_path</code></td>
-<td>Path on endpoint the quarantined file was originally.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.quarantine_result</code></td>
-<td>Boolean representing whether or not file quarantine succeeded.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.temp_file_path</code></td>
-<td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.accessed</code></td>
-<td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>file.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>file.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>file.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>file.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>file.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>file.created</code></td>
-<td>File creation time.  Note that not all filesystems store the creation time.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.directory</code></td>
-<td>Directory where the file is located. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.mtime</code></td>
-<td>Last time the file content was modified.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.owner</code></td>
-<td>File owner's username.</td>
-<td><code>alice</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pgid</code></td>
-<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.pgid</code></td>
-<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>rule.id</code></td>
-<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
-<td><code>101</code></td>
-</tr>
-<tr>
-<td><code>rule.name</code></td>
-<td>The name of the rule or signature generating the event.</td>
-<td><code>BLOCK_DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md b/custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md
deleted file mode 100644
index b82cd654c..000000000
--- a/custom_documentation/doc/sample_output/alerts/macos/macos_memory_threat_alert.md
+++ /dev/null
@@ -1,599 +0,0 @@
-# macOS Memory Threat Alert
-
-## Description
-
-This alert is generated when a macOS Memory Thread alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "memory_signature"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the macos artifact.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_base</code></td>
-<td>Base address of the memory allocation containing the memory region.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_size</code></td>
-<td>Original memory size requested when the memory was allocated.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_type</code></td>
-<td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td>
-<td><code>PRIVATE</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_address</code></td>
-<td>The address where bytes_compressed begins.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_allocation_offset</code></td>
-<td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_compressed</code></td>
-<td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td>
-<td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_compressed_present</code></td>
-<td>Whether bytes_compressed is present in this event.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.all_names</code></td>
-<td>A sequence of signature names matched.</td>
-<td><code>Windows.EICAR.Not-a-virus</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.identifier</code></td>
-<td>malware signature identifier</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.matches</code></td>
-<td>The first matching details.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256</code></td>
-<td>sha256 hash of file matching signature.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.signature.id</code></td>
-<td>The id of the first yara rule matched.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.signature.name</code></td>
-<td>The name of the first yara rule matched.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.version</code></td>
-<td>malware signature version</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_base</code></td>
-<td>Base address of the memory region.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_protection</code></td>
-<td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td>
-<td><code>RWX</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_size</code></td>
-<td>Size of the memory region.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pgid</code></td>
-<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.pgid</code></td>
-<td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>rule.id</code></td>
-<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
-<td><code>101</code></td>
-</tr>
-<tr>
-<td><code>rule.name</code></td>
-<td>The name of the rule or signature generating the event.</td>
-<td><code>BLOCK_DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md
deleted file mode 100644
index 26f968edd..000000000
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_malicious_behavior_alert.md
+++ /dev/null
@@ -1,534 +0,0 @@
-# Windows Malicious Behavior Alert
-
-## Description
-
-This alert occurs when a Malicious Behavior alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "behavior"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the windows artifact.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Events.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Events._label</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Events._state</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.@timestamp</code></td>
-<td>Timestamp in which action was taken</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.action</code></td>
-<td>Response action name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.field</code></td>
-<td>Field in the triggering event to use as input for action</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.attributes</code></td>
-<td>Destination file attributes</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.path</code></td>
-<td>Destination file path</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.reason</code></td>
-<td>Combined USN file modification reason</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.actions</code></td>
-<td>Actions taken by Registry Rollback for key</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.path</code></td>
-<td>NT path of registry key recovered by Rollback</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.values.actions</code></td>
-<td>Actions taken by Registry Rollback for value</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.values.name</code></td>
-<td>Value name recovered by Rollback</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.source.attributes</code></td>
-<td>Source file attributes</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.source.path</code></td>
-<td>Source file path</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.state</code></td>
-<td>Index of event in events array to use for field lookup</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.tree</code></td>
-<td>Indicates whether or not an action was taken against an entire process tree</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.message</code></td>
-<td>Result message</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.process.entity_id</code></td>
-<td>Entity id of actionable process</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.process.name</code></td>
-<td>Name of actionable process</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.process.pid</code></td>
-<td>pid of actionable process</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.result</code></td>
-<td>Response action result code</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>destination.ip</code></td>
-<td>IP address of the destination (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.port</code></td>
-<td>Port of the destination.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>network.transport</code></td>
-<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
-<td><code>tcp</code></td>
-</tr>
-<tr>
-<td><code>network.type</code></td>
-<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
-<td><code>ipv4</code></td>
-</tr>
-<tr>
-<td><code>process.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>registry.*</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>rule.description</code></td>
-<td>The description of the rule generating the event.</td>
-<td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td>
-</tr>
-<tr>
-<td><code>rule.id</code></td>
-<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
-<td><code>101</code></td>
-</tr>
-<tr>
-<td><code>rule.name</code></td>
-<td>The name of the rule or signature generating the event.</td>
-<td><code>BLOCK_DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.reference</code></td>
-<td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td>
-<td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>rule.version</code></td>
-<td>The version / revision of the rule being used for analysis.</td>
-<td><code>1.1</code></td>
-</tr>
-<tr>
-<td><code>threat.framework</code></td>
-<td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td>
-<td><code>MITRE ATT&CK</code></td>
-</tr>
-<tr>
-<td><code>threat.tactic.id</code></td>
-<td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
-<td><code>TA0002</code></td>
-</tr>
-<tr>
-<td><code>threat.tactic.name</code></td>
-<td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td>
-<td><code>Execution</code></td>
-</tr>
-<tr>
-<td><code>threat.tactic.reference</code></td>
-<td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td>
-<td><code>https://attack.mitre.org/tactics/TA0002/</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.id</code></td>
-<td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
-<td><code>T1059</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.name</code></td>
-<td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
-<td><code>Command and Scripting Interpreter</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.reference</code></td>
-<td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td>
-<td><code>https://attack.mitre.org/techniques/T1059/</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.subtechnique.id</code></td>
-<td>The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td>
-<td><code>T1059.001</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.subtechnique.name</code></td>
-<td>The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td>
-<td><code>PowerShell</code></td>
-</tr>
-<tr>
-<td><code>threat.technique.subtechnique.reference</code></td>
-<td>The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td>
-<td><code>https://attack.mitre.org/techniques/T1059/001/</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md
deleted file mode 100644
index 1c4df94d3..000000000
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_malware_alert.md
+++ /dev/null
@@ -1,974 +0,0 @@
-# Windows Malware Alert
-
-## Description
-
-This alert is generated when a Malware alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "malicious_file"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the windows artifact.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.@timestamp</code></td>
-<td>Timestamp in which action was taken</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.action</code></td>
-<td>Response action name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.attributes</code></td>
-<td>Destination file attributes</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.path</code></td>
-<td>Destination file path</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.reason</code></td>
-<td>Combined USN file modification reason</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.actions</code></td>
-<td>Actions taken by Registry Rollback for key</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.path</code></td>
-<td>NT path of registry key recovered by Rollback</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.values.actions</code></td>
-<td>Actions taken by Registry Rollback for value</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.values.name</code></td>
-<td>Value name recovered by Rollback</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.process.path</code></td>
-<td>Path of process killed by Process Rollback</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.source.attributes</code></td>
-<td>Source file attributes</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.source.path</code></td>
-<td>Source file path</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.message</code></td>
-<td>Result message</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.result</code></td>
-<td>Response action result code</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>file.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>file.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>file.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>file.Ext.device.bus_type</code></td>
-<td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.device.dos_name</code></td>
-<td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.device.file_system_type</code></td>
-<td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.device.nt_name</code></td>
-<td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.device.product_id</code></td>
-<td>ProductID of the device. It is provided by the vendor of the device if any.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.device.vendor_id</code></td>
-<td>VendorID of the device. It is provided by the vendor of the device.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.device.volume_device_type</code></td>
-<td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.identifier</code></td>
-<td>The model's unique identifier.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.score</code></td>
-<td>The score produced by the classification model.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.threshold</code></td>
-<td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_classification.version</code></td>
-<td>The version of the model used.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.all_names</code></td>
-<td>The concatenated names of all yara signatures</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.identifier</code></td>
-<td>Malware artifact identifier.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.matches</code></td>
-<td>An array of bytes representing yara signature matches</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.signature.hash.sha256</code></td>
-<td>Primary malware signature sha256.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.signature.id</code></td>
-<td>Primary malware signature id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.primary.signature.name</code></td>
-<td>Primary malware signature name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.matches</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.signature.hash.sha256</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.signature.id</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.secondary.signature.name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.malware_signature.version</code></td>
-<td>Primary malware signature version.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.quarantine_message</code></td>
-<td>Message describing quarantine results.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.quarantine_path</code></td>
-<td>Path on endpoint the quarantined file was originally.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.quarantine_result</code></td>
-<td>Boolean representing whether or not file quarantine succeeded.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.temp_file_path</code></td>
-<td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.accessed</code></td>
-<td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>file.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>file.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>file.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>file.created</code></td>
-<td>File creation time.  Note that not all filesystems store the creation time.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.directory</code></td>
-<td>Directory where the file is located. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>file.drive_letter</code></td>
-<td>Drive letter where the file is located. This field is only relevant on Windows.  The value should be uppercase, and not include the colon.</td>
-<td><code>C</code></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.mtime</code></td>
-<td>Last time the file content was modified.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.owner</code></td>
-<td>File owner's username.</td>
-<td><code>alice</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.pe.Ext.dotnet</code></td>
-<td>Whether this file is a .NET PE</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>file.pe.Ext.sections.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.pe.Ext.sections.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.pe.Ext.sections.name</code></td>
-<td>The section's name</td>
-<td><code>.reloc</code></td>
-</tr>
-<tr>
-<td><code>file.pe.Ext.streams.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.pe.Ext.streams.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.pe.Ext.streams.name</code></td>
-<td>The stream's name</td>
-<td><code>.reloc</code></td>
-</tr>
-<tr>
-<td><code>file.pe.company</code></td>
-<td>Internal company name of the file, provided at compile-time.</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>file.pe.description</code></td>
-<td>Internal description of the file, provided at compile-time.</td>
-<td><code>Paint</code></td>
-</tr>
-<tr>
-<td><code>file.pe.file_version</code></td>
-<td>Internal version of the file, provided at compile-time.</td>
-<td><code>6.3.9600.17415</code></td>
-</tr>
-<tr>
-<td><code>file.pe.original_file_name</code></td>
-<td>Internal name of the file, provided at compile-time.</td>
-<td><code>MSPAINT.EXE</code></td>
-</tr>
-<tr>
-<td><code>file.pe.product</code></td>
-<td>Internal product name of the file, provided at compile-time.</td>
-<td><code>Microsoft® Windows® Operating System</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.services</code></td>
-<td>Services running in this process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.domain</code></td>
-<td>Domain of token user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation</code></td>
-<td>Whether the token is elevated or not</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation_type</code></td>
-<td>What level of elevation the token has</td>
-<td><code>one of "default", "full", "limited"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.sid</code></td>
-<td>Token user's Security Identifier (SID).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.user</code></td>
-<td>Username of token owner.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.pe.company</code></td>
-<td>Internal company name of the file, provided at compile-time.</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.pe.description</code></td>
-<td>Internal description of the file, provided at compile-time.</td>
-<td><code>Paint</code></td>
-</tr>
-<tr>
-<td><code>process.pe.file_version</code></td>
-<td>Internal version of the file, provided at compile-time.</td>
-<td><code>6.3.9600.17415</code></td>
-</tr>
-<tr>
-<td><code>process.pe.original_file_name</code></td>
-<td>Internal name of the file, provided at compile-time.</td>
-<td><code>MSPAINT.EXE</code></td>
-</tr>
-<tr>
-<td><code>process.pe.product</code></td>
-<td>Internal product name of the file, provided at compile-time.</td>
-<td><code>Microsoft® Windows® Operating System</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>rule.id</code></td>
-<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
-<td><code>101</code></td>
-</tr>
-<tr>
-<td><code>rule.name</code></td>
-<td>The name of the rule or signature generating the event.</td>
-<td><code>BLOCK_DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md
deleted file mode 100644
index e42baf677..000000000
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_memory_threat_alert.md
+++ /dev/null
@@ -1,679 +0,0 @@
-# Windows Memory Threat Alert
-
-## Description
-
-This alert is generated when a Memory Threat alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "memory_signature"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the windows artifact.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_base</code></td>
-<td>Base address of the memory allocation containing the memory region.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_protection</code></td>
-<td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td>
-<td><code>RWX</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_size</code></td>
-<td>Original memory size requested when the memory was allocated.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.allocation_type</code></td>
-<td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td>
-<td><code>PRIVATE</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_address</code></td>
-<td>The address where bytes_compressed begins.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_allocation_offset</code></td>
-<td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_compressed</code></td>
-<td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td>
-<td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.bytes_compressed_present</code></td>
-<td>Whether bytes_compressed is present in this event.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.all_names</code></td>
-<td>A sequence of signature names matched.</td>
-<td><code>Windows.EICAR.Not-a-virus</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.identifier</code></td>
-<td>malware signature identifier</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.matches</code></td>
-<td>The first matching details.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.signature.hash.sha256</code></td>
-<td>sha256 hash of file matching signature.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.signature.id</code></td>
-<td>The id of the first yara rule matched.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.primary.signature.name</code></td>
-<td>The name of the first yara rule matched.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.malware_signature.version</code></td>
-<td>malware signature version</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_base</code></td>
-<td>Base address of the memory region.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_protection</code></td>
-<td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td>
-<td><code>RWX</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_size</code></td>
-<td>Size of the memory region.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_start_bytes</code></td>
-<td>First 64 bytes at the region base address.</td>
-<td><code>4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memory_region.region_state</code></td>
-<td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td>
-<td><code>COMMIT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.domain</code></td>
-<td>Domain of token user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation</code></td>
-<td>Whether the token is elevated or not</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation_type</code></td>
-<td>What level of elevation the token has</td>
-<td><code>one of "default", "full", "limited"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.sid</code></td>
-<td>Token user's Security Identifier (SID).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.user</code></td>
-<td>Username of token owner.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>rule.id</code></td>
-<td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td>
-<td><code>101</code></td>
-</tr>
-<tr>
-<td><code>rule.name</code></td>
-<td>The name of the rule or signature generating the event.</td>
-<td><code>BLOCK_DNS_over_TLS</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md b/custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md
deleted file mode 100644
index 61154353d..000000000
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_ransomware_alert.md
+++ /dev/null
@@ -1,824 +0,0 @@
-# Windows Ransomware Alert
-
-## Description
-
-This alert is generated when a Ransomware alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "ransomware"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the windows artifact.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.files.data</code></td>
-<td>File header or MBR bytes.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.files.entropy</code></td>
-<td>Entropy of file contents.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.files.extension</code></td>
-<td>File extension, excluding the leading dot.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.files.metrics</code></td>
-<td>Suspicious ransomware behaviours associated with the file event.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.files.operation</code></td>
-<td>Operation applied to file.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.files.path</code></td>
-<td>Full path to the file, including the file name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.files.score</code></td>
-<td>Ransomware score for this particular file event.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>Ransomware.child_processes.score</code></td>
-<td>Total ransomware score for aggregated file events.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.feature</code></td>
-<td>Ransomware feature which triggered the alert.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.files.data</code></td>
-<td>File header or MBR bytes.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.files.entropy</code></td>
-<td>Entropy of file contents.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.files.extension</code></td>
-<td>File extension, excluding the leading dot.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.files.metrics</code></td>
-<td>Suspicious ransomware behaviours associated with the file event.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.files.operation</code></td>
-<td>Operation applied to file.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.files.path</code></td>
-<td>Full path to the file, including the file name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.files.score</code></td>
-<td>Ransomware score for this particular file event.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.score</code></td>
-<td>Total ransomware score for aggregated file events.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Ransomware.version</code></td>
-<td>Ransomware artifact version.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.@timestamp</code></td>
-<td>Timestamp in which action was taken</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.action</code></td>
-<td>Response action name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.attributes</code></td>
-<td>Destination file attributes</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.path</code></td>
-<td>Destination file path</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.reason</code></td>
-<td>Combined USN file modification reason</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.actions</code></td>
-<td>Actions taken by Registry Rollback for key</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.path</code></td>
-<td>NT path of registry key recovered by Rollback</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.source.attributes</code></td>
-<td>Source file attributes</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.source.path</code></td>
-<td>Source file path</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.message</code></td>
-<td>Result message</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.result</code></td>
-<td>Response action result code</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.mapped_address</code></td>
-<td>The base address where this module is loaded.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.mapped_size</code></td>
-<td>The size of this module's memory mapping, in bytes.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.name</code></td>
-<td>Name of the library.  This generally maps to the name of the file on disk.</td>
-<td><code>kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.path</code></td>
-<td>Full file path of the library.</td>
-<td><code>C:\Windows\System32\kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.domain</code></td>
-<td>Domain of token user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation</code></td>
-<td>Whether the token is elevated or not</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation_type</code></td>
-<td>What level of elevation the token has</td>
-<td><code>one of "default", "full", "limited"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.sid</code></td>
-<td>Token user's Security Identifier (SID).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.user</code></td>
-<td>Username of token owner.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.pe.company</code></td>
-<td>Internal company name of the file, provided at compile-time.</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.pe.description</code></td>
-<td>Internal description of the file, provided at compile-time.</td>
-<td><code>Paint</code></td>
-</tr>
-<tr>
-<td><code>process.pe.file_version</code></td>
-<td>Internal version of the file, provided at compile-time.</td>
-<td><code>6.3.9600.17415</code></td>
-</tr>
-<tr>
-<td><code>process.pe.original_file_name</code></td>
-<td>Internal name of the file, provided at compile-time.</td>
-<td><code>MSPAINT.EXE</code></td>
-</tr>
-<tr>
-<td><code>process.pe.product</code></td>
-<td>Internal product name of the file, provided at compile-time.</td>
-<td><code>Microsoft® Windows® Operating System</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md b/custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md
deleted file mode 100644
index 4c9001b64..000000000
--- a/custom_documentation/doc/sample_output/alerts/windows/windows_shellcode_thread.md
+++ /dev/null
@@ -1,1259 +0,0 @@
-# Windows Shellcode Thread Alert
-
-## Description
-
-This alert is generated when a Shellcode Threat alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "shellcode_thread"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the windows artifact.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Memory_protection.cross_session</code></td>
-<td>Is this process injecting across operating system sessions?</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Memory_protection.feature</code></td>
-<td>Memory Protection feature which triggered the alert.</td>
-<td><code>shellcode_thread</code></td>
-</tr>
-<tr>
-<td><code>Memory_protection.parent_to_child</code></td>
-<td>Is this process injecting into its child?</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Memory_protection.self_injection</code></td>
-<td>Is this alert about a process injecting into itself?</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Memory_protection.unique_key_v1</code></td>
-<td>A unique key created by hashing several characteristics of this alert.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Memory_protection.unique_key_v2</code></td>
-<td>A unique key created by hashing several characteristics of this alert.</td>
-<td><code>00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67</code></td>
-</tr>
-<tr>
-<td><code>Responses.@timestamp</code></td>
-<td>Timestamp in which action was taken</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.action</code></td>
-<td>Response action name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.attributes</code></td>
-<td>Destination file attributes</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.path</code></td>
-<td>Destination file path</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.file.reason</code></td>
-<td>Combined USN file modification reason</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.actions</code></td>
-<td>Actions taken by Registry Rollback for key</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.path</code></td>
-<td>NT path of registry key recovered by Rollback</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.values.actions</code></td>
-<td>Actions taken by Registry Rollback for value</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.key.values.name</code></td>
-<td>Value name recovered by Rollback</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.source.attributes</code></td>
-<td>Source file attributes</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.action.source.path</code></td>
-<td>Source file path</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.message</code></td>
-<td>Result message</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Responses.result</code></td>
-<td>Response action result code</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.Ext.mapped_address</code></td>
-<td>The base address where this module is loaded.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.Ext.mapped_size</code></td>
-<td>The size of this module's memory mapping, in bytes.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.name</code></td>
-<td>Name of the library.  This generally maps to the name of the file on disk.</td>
-<td><code>kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.dll.path</code></td>
-<td>Full file path of the library.</td>
-<td><code>C:\Windows\System32\kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.allocation_base</code></td>
-<td>Base address of the memory allocation containing the memory region.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.allocation_protection</code></td>
-<td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td>
-<td><code>RWX</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.allocation_size</code></td>
-<td>Original memory size requested when the memory was allocated.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.allocation_type</code></td>
-<td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td>
-<td><code>PRIVATE</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.bytes_address</code></td>
-<td>The address where bytes_compressed begins.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.bytes_allocation_offset</code></td>
-<td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.mapped_path</code></td>
-<td>If the memory corresponds to a file mapping, this is the file's path.</td>
-<td><code>C:\Windows\System32\mshtml.dll</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.memory_pe_detected</code></td>
-<td>Whether an executable file was found in memory.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.region_base</code></td>
-<td>Base address of the memory region.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.region_protection</code></td>
-<td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td>
-<td><code>RWX</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.region_size</code></td>
-<td>Size of the memory region.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.region_state</code></td>
-<td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td>
-<td><code>COMMIT</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.memory_region.strings</code></td>
-<td>Array of strings found within the memory region.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.token.domain</code></td>
-<td>Domain of token user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.token.elevation</code></td>
-<td>Whether the token is elevated or not</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.token.elevation_type</code></td>
-<td>What level of elevation the token has</td>
-<td><code>one of "default", "full", "limited"</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.token.sid</code></td>
-<td>Token user's Security Identifier (SID).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.token.user</code></td>
-<td>Username of token owner.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>Target.process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>Target.process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>Target.process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Target.process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.parent.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>Target.process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>Target.process.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>Target.process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.call_stack.instruction_pointer</code></td>
-<td>The return address of this stack frame.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.call_stack.memory_section.memory_address</code></td>
-<td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.call_stack.memory_section.memory_size</code></td>
-<td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.call_stack.memory_section.protection</code></td>
-<td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.call_stack.module_name</code></td>
-<td>The name of the DLL/module containing `instruction_pointer`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.call_stack.module_path</code></td>
-<td>The path to the DLL/module containing `instruction_pointer`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.call_stack.symbol_info</code></td>
-<td>The nearest symbol for `instruction_pointer`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.call_stack_summary</code></td>
-<td>Concatentation of the non-repeated modules in the call stack.</td>
-<td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.original_start_address</code></td>
-<td>When a trampoline was detected, this indicates the original content for the thread start address in memory.</td>
-<td><code>4194304</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.original_start_address_allocation_offset</code></td>
-<td>When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.original_start_address_bytes</code></td>
-<td>When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.</td>
-<td><code>48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.original_start_address_bytes_disasm</code></td>
-<td>When a trampoline was detected, this holds the disassembled code at the original thread start address.</td>
-<td><code>mov rax, 0x4141414141414141\njmp rax</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.original_start_address_bytes_disasm_hash</code></td>
-<td>When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td>
-<td><code>aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.original_start_address_module</code></td>
-<td>When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.</td>
-<td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.start_address</code></td>
-<td>Memory address where the thread began execution.</td>
-<td><code>4194304</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.start_address_allocation_offset</code></td>
-<td>Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.start_address_bytes</code></td>
-<td>A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.</td>
-<td><code>c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.start_address_bytes_disasm</code></td>
-<td>The bytes at the thread start address, disassembled into human-readable assembly code.</td>
-<td><code>ret\nint3</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.start_address_bytes_disasm_hash</code></td>
-<td>The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td>
-<td><code>aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.Ext.start_address_module</code></td>
-<td>The dll/module where the thread began execution.</td>
-<td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td>
-</tr>
-<tr>
-<td><code>Target.process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>Target.process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.risk_score</code></td>
-<td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.severity</code></td>
-<td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td>
-<td><code>7</code></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.mapped_address</code></td>
-<td>The base address where this module is loaded.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.Ext.mapped_size</code></td>
-<td>The size of this module's memory mapping, in bytes.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.name</code></td>
-<td>Name of the library.  This generally maps to the name of the file on disk.</td>
-<td><code>kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.dll.path</code></td>
-<td>Full file path of the library.</td>
-<td><code>C:\Windows\System32\kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.domain</code></td>
-<td>Domain of token user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation</code></td>
-<td>Whether the token is elevated or not</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation_type</code></td>
-<td>What level of elevation the token has</td>
-<td><code>one of "default", "full", "limited"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.sid</code></td>
-<td>Token user's Security Identifier (SID).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.user</code></td>
-<td>Username of token owner.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.architecture</code></td>
-<td>Process architecture.  It can differ from host architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.user</code></td>
-<td>User associated with the running process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.ppid</code></td>
-<td>Parent process' pid.</td>
-<td><code>4241</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack.instruction_pointer</code></td>
-<td>The return address of this stack frame.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack.memory_section.memory_address</code></td>
-<td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack.memory_section.memory_size</code></td>
-<td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack.memory_section.protection</code></td>
-<td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack.module_name</code></td>
-<td>The name of the DLL/module containing `instruction_pointer`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack.module_path</code></td>
-<td>The path to the DLL/module containing `instruction_pointer`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack.symbol_info</code></td>
-<td>The nearest symbol for `instruction_pointer`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack_final_user_module.name</code></td>
-<td>The file name of the call_stack_final_user_module.</td>
-<td><code>example.dll</code></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack_summary</code></td>
-<td>Concatentation of the non-repeated modules in the call stack.</td>
-<td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.start_address</code></td>
-<td>Memory address where the thread began execution.</td>
-<td><code>4194304</code></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.start_address_module</code></td>
-<td>The dll/module where the thread began execution.</td>
-<td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>rule.ruleset</code></td>
-<td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td>
-<td><code>Standard_Protocol_Filters</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md b/custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md
deleted file mode 100644
index b25880e8c..000000000
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_amsi.md
+++ /dev/null
@@ -1,338 +0,0 @@
-# Windows AMSI API
-
-## Description
-
-This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Antimalware-Scan-Interface" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.provider</code></td>
-<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
-<td><code>kernel</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.behaviors</code></td>
-<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
-<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.return_value</code></td>
-<td>Return value of RegisterRawInputDevices API call.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.name</code></td>
-<td>The name of the API, usually the name of the function or system call.</td>
-<td><code>VirtualAlloc</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.app_name</code></td>
-<td>The application name requesting the AMSI scan.</td>
-<td><code>PowerShell</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.buffer</code></td>
-<td>The content associated with an AMSI scan.</td>
-<td><code>[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport("kernel32.dll")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20);</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.content_name</code></td>
-<td>The content name, typically a filename, associated with an AMSI scan.</td>
-<td><code>C:\script.ps1</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.size</code></td>
-<td>The size.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.summary</code></td>
-<td>The summary of the API call and its parameters.</td>
-<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_asm.md b/custom_documentation/doc/sample_output/api/windows/windows_api_asm.md
deleted file mode 100644
index beb7ca1f7..000000000
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_asm.md
+++ /dev/null
@@ -1,353 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when ETW AttackSurfaceMonitor events are generated.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "AttackSurfaceMonitor" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>dll.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.path</code></td>
-<td>Full file path of the library.</td>
-<td><code>C:\Windows\System32\kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.provider</code></td>
-<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
-<td><code>kernel</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.behaviors</code></td>
-<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
-<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.name</code></td>
-<td>The name of the API, usually the name of the function or system call.</td>
-<td><code>VirtualAlloc</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.device</code></td>
-<td>The name of the device object.</td>
-<td><code>\Device\NPCAP</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.io_control_code</code></td>
-<td>The I/O control code for the requested device operation.</td>
-<td><code>27365</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.summary</code></td>
-<td>The summary of the API call and its parameters.</td>
-<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md b/custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md
deleted file mode 100644
index 0e624ba3f..000000000
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_credential_access.md
+++ /dev/null
@@ -1,338 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when a process attempts to access priviledged credentials. 
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "ObjectCallback" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.provider</code></td>
-<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
-<td><code>kernel</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.name</code></td>
-<td>The name of the API, usually the name of the function or system call.</td>
-<td><code>VirtualAlloc</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.desired_access</code></td>
-<td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.desired_access_numeric</code></td>
-<td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.handle_type</code></td>
-<td>This parameter indicates whether the detected access was attempt against a process or a thread.</td>
-<td><code>process</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack.instruction_pointer</code></td>
-<td>The return address of this stack frame.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack.module_path</code></td>
-<td>The path to the DLL/module containing `instruction_pointer`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack_contains_unbacked</code></td>
-<td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.Ext.call_stack_final_user_module.path</code></td>
-<td>The file path of the call_stack_final_user_module.</td>
-<td><code>C:\Program Files\Example\example.dll</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md b/custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md
deleted file mode 100644
index e1b9b50b0..000000000
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_kernel_audit.md
+++ /dev/null
@@ -1,313 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events are generated.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Kernel-Audit-API-Calls" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.provider</code></td>
-<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
-<td><code>kernel</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.behaviors</code></td>
-<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
-<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.name</code></td>
-<td>The name of the API, usually the name of the function or system call.</td>
-<td><code>VirtualAlloc</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.summary</code></td>
-<td>The summary of the API call and its parameters.</td>
-<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md b/custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md
deleted file mode 100644
index 0c42f5b71..000000000
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_tcpip.md
+++ /dev/null
@@ -1,333 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-TCPIP" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>destination.ip</code></td>
-<td>IP address of the destination (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.port</code></td>
-<td>Port of the destination.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.provider</code></td>
-<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
-<td><code>kernel</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>network.transport</code></td>
-<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
-<td><code>tcp</code></td>
-</tr>
-<tr>
-<td><code>network.type</code></td>
-<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
-<td><code>ipv4</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.behaviors</code></td>
-<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
-<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.name</code></td>
-<td>The name of the API, usually the name of the function or system call.</td>
-<td><code>VirtualAlloc</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.summary</code></td>
-<td>The summary of the API call and its parameters.</td>
-<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md b/custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md
deleted file mode 100644
index 818c490f4..000000000
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_threat_intelligence.md
+++ /dev/null
@@ -1,533 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when ETW Threat-Intelligence events are generated.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Threat-Intelligence" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.created_suspended</code></td>
-<td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>Target.process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Target.process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.provider</code></td>
-<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
-<td><code>kernel</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.behaviors</code></td>
-<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
-<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.target_address_name</code></td>
-<td>The name of the memory region targeted by the API call.</td>
-<td><code>Unbacked</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.target_address_path</code></td>
-<td>The path of the memory region targeted by the API call.</td>
-<td><code>C:\programdata\example.dll</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.name</code></td>
-<td>The name of the API, usually the name of the function or system call.</td>
-<td><code>VirtualAlloc</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.address</code></td>
-<td>The target memory address.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.allocation_type</code></td>
-<td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td>
-<td><code>COMMIT|RESERVE</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.argument1</code></td>
-<td>The first argument to the procedure.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.argument2</code></td>
-<td>The second argument to the procedure.</td>
-<td><code>2</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.argument3</code></td>
-<td>The third argument to the procedure.</td>
-<td><code>3</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.context_flags</code></td>
-<td>The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`</td>
-<td><code>1048607</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.desired_access</code></td>
-<td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.desired_access_numeric</code></td>
-<td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.device</code></td>
-<td>The name of the device object.</td>
-<td><code>\Device\NPCAP</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.driver</code></td>
-<td>The name of the driver object.</td>
-<td><code>\Driver\npcap</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.eax</code></td>
-<td>The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.ebp</code></td>
-<td>The x86 EBP frame pointer register.</td>
-<td><code>15006644</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.ebx</code></td>
-<td>The x86 EBX general purpose register.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.ecx</code></td>
-<td>The x86 ECX general purpose register. First argument in __fastcall and __thiscall.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.edi</code></td>
-<td>The x86 EDI general purpose register.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.edx</code></td>
-<td>The x86 EDX general purpose register. Second argument in a __fastcall.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.eip</code></td>
-<td>The x86 EIP instruction pointer register.</td>
-<td><code>1472790528</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.esi</code></td>
-<td>The x86 ESI general purpose register.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.esp</code></td>
-<td>The x86 ESP stack pointer register.</td>
-<td><code>15007744</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.handle_type</code></td>
-<td>This parameter indicates whether the detected access was attempt against a process or a thread.</td>
-<td><code>process</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.procedure</code></td>
-<td>The memory address of the procedure or function.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.protection</code></td>
-<td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
-<td><code>RWX|GUARD</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.protection_old</code></td>
-<td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
-<td><code>RCX</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.r8</code></td>
-<td>The x64 R8 general purpose register. Third argument in a __fastcall.</td>
-<td><code>3</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.r9</code></td>
-<td>The x64 R9 general purpose register. Fourth argument in a __fastcall.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.rax</code></td>
-<td>The x64 RAX general purpose register. Return value in a __fastcall.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.rbp</code></td>
-<td>The x64 RBP general purpose register.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.rbx</code></td>
-<td>The x64 RBX general purpose register.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.rcx</code></td>
-<td>The x64 RCX general purpose register. First argument in a __fastcall.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.rdi</code></td>
-<td>The x64 RDI general purpose register.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.rdx</code></td>
-<td>The x64 RDX general purpose register. Second argument in a __fastcall.</td>
-<td><code>2</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.rip</code></td>
-<td>The x64 RIP instruction pointer register.</td>
-<td><code>140706153693184</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.rsi</code></td>
-<td>The x64 RSI general purpose register.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.rsp</code></td>
-<td>The x64 RSP stack pointer register.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.size</code></td>
-<td>The size.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.summary</code></td>
-<td>The summary of the API call and its parameters.</td>
-<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md b/custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md
deleted file mode 100644
index 66e339a92..000000000
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_win32k.md
+++ /dev/null
@@ -1,443 +0,0 @@
-# Windows Win32k API
-
-## Description
-
-This event is generated when keylogging-related Win32k APIs are called.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Win32k" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.provider</code></td>
-<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
-<td><code>kernel</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.behaviors</code></td>
-<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
-<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.background_callcount</code></td>
-<td>This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.</td>
-<td><code>6021</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.ms_since_last_keyevent</code></td>
-<td>This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.</td>
-<td><code>94</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.procedure_symbol</code></td>
-<td>Summary of the hook procedure.</td>
-<td><code>taskbar.dll</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.return_value</code></td>
-<td>Return value of RegisterRawInputDevices API call.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.start_address_allocation_protection</code></td>
-<td>Memory protection attributes associated with the starting address of a thread.</td>
-<td><code>RCX</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.start_address_module</code></td>
-<td>Name of the module associated with the starting address of a thread.</td>
-<td><code>C:\Windows\System32\DellTPad\ApMsgFwd.exe</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.target_address_name</code></td>
-<td>The name of the memory region targeted by the API call.</td>
-<td><code>Unbacked</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.target_address_path</code></td>
-<td>The path of the memory region targeted by the API call.</td>
-<td><code>C:\programdata\example.dll</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.thread_info_flags</code></td>
-<td>Thread info flags.</td>
-<td><code>16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.visible_windows_count</code></td>
-<td>Number of visible windows owned by the caller thread.</td>
-<td><code>0</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.windows_count</code></td>
-<td>Number of windows owned by the caller thread.</td>
-<td><code>2</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.name</code></td>
-<td>The name of the API, usually the name of the function or system call.</td>
-<td><code>VirtualAlloc</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.address</code></td>
-<td>The target memory address.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.allocation_type</code></td>
-<td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td>
-<td><code>COMMIT|RESERVE</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.flags</code></td>
-<td>Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.</td>
-<td><code>INPUTSINK</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.hook_module</code></td>
-<td>DLL containing the hook procedure.</td>
-<td><code>c:\windows\system32\taskbar.dll</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.hook_type</code></td>
-<td>Type of hook procedure to be installed.</td>
-<td><code>WH_KEYBOARD_LL</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.procedure</code></td>
-<td>The memory address of the procedure or function.</td>
-<td><code>2431737462784</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.protection</code></td>
-<td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
-<td><code>RWX|GUARD</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.protection_old</code></td>
-<td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td>
-<td><code>RCX</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.size</code></td>
-<td>The size.</td>
-<td><code>4096</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.usage</code></td>
-<td>This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.</td>
-<td><code>KEYBOARD</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.usage_page</code></td>
-<td>This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.</td>
-<td><code>GENERIC</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.summary</code></td>
-<td>The summary of the API call and its parameters.</td>
-<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md b/custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md
deleted file mode 100644
index b9590446b..000000000
--- a/custom_documentation/doc/sample_output/api/windows/windows_api_wmi.md
+++ /dev/null
@@ -1,388 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when WMI Activity-related APIs are called.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-WMI-Activity" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Target.process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.provider</code></td>
-<td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td>
-<td><code>kernel</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.behaviors</code></td>
-<td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td>
-<td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.client_is_local</code></td>
-<td>Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.client_machine</code></td>
-<td>Client process's machine name (provided by the client and potentially untrustworthy).</td>
-<td><code>DESKTOP-EXAMPLE</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.client_machine_fqdn</code></td>
-<td>Client process's machine name FQDN (provided by the client and potentially untrustworthy).</td>
-<td><code>DESKTOP-EXAMPLE.elastic.co</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.metadata.client_process_id</code></td>
-<td>Client process id</td>
-<td><code>3600</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.name</code></td>
-<td>The name of the API, usually the name of the function or system call.</td>
-<td><code>VirtualAlloc</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.consumer_details</code></td>
-<td>Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.consumer_name</code></td>
-<td>Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.</td>
-<td><code>ExampleConsumer</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.consumer_type</code></td>
-<td>An example list of consumer type.    "ActiveScriptEventConsumer" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.    "CommandLineEventConsumer" - Launches an arbitrary process in the local system context when an event is delivered to it.    "LogFileEventConsumer" - Writes customized strings to a text log file when events are delivered to it.    "NTEventLogEventConsumer" - Logs a specific message to the Windows event log when an event is delivered to it.    "SMTPEventConsumer" - Sends an email message using SMTP each time an event is delivered to it.</td>
-<td><code>CommandLineEventConsumer</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.event_filter_details</code></td>
-<td>Provide an overview of the query that define when an event should be triggered.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.event_filter_name</code></td>
-<td>Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.</td>
-<td><code>ExampleFilter</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.namespace</code></td>
-<td>WMI namespace to which the connection is made.</td>
-<td><code>root\Microsoft\Windows\DeviceGuard</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.parameters.operation</code></td>
-<td>Specifies the connection or request to WMI</td>
-<td><code>Win32_Process::Create</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.api.summary</code></td>
-<td>The summary of the API call and its parameters.</td>
-<td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/linux/linux_file_create.md b/custom_documentation/doc/sample_output/file/linux/linux_file_create.md
deleted file mode 100644
index 072fcbfd1..000000000
--- a/custom_documentation/doc/sample_output/file/linux/linux_file_create.md
+++ /dev/null
@@ -1,314 +0,0 @@
-# Linux File Create
-
-## Description
-
-This event is generated when a file is created.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "creation"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/linux/linux_file_delete.md b/custom_documentation/doc/sample_output/file/linux/linux_file_delete.md
deleted file mode 100644
index 9bdcf7945..000000000
--- a/custom_documentation/doc/sample_output/file/linux/linux_file_delete.md
+++ /dev/null
@@ -1,309 +0,0 @@
-# Linux File Delete
-
-## Description
-
-This event is generated when a file is deleted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "deletion"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md
deleted file mode 100644
index f0e21ed97..000000000
--- a/custom_documentation/doc/sample_output/file/linux/linux_file_endpoint_unquarantine.md
+++ /dev/null
@@ -1,229 +0,0 @@
-# Linux Malware Unquarantine
-
-## Description
-
-This event is generated when Endpoint restores a file from the malware quarantine.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "endpoint_unquarantine"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.Ext.correlation.id</code></td>
-<td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.path</code></td>
-<td>Original file path prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/linux/linux_file_rename.md b/custom_documentation/doc/sample_output/file/linux/linux_file_rename.md
deleted file mode 100644
index 37a126982..000000000
--- a/custom_documentation/doc/sample_output/file/linux/linux_file_rename.md
+++ /dev/null
@@ -1,329 +0,0 @@
-# Linux File Rename
-
-## Description
-
-This event is generated when a file is renamed.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "rename"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.extension</code></td>
-<td>Original file extension prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.name</code></td>
-<td>Original file name prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.path</code></td>
-<td>Original file path prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_access.md b/custom_documentation/doc/sample_output/file/macos/macos_file_access.md
deleted file mode 100644
index cf4ccfb10..000000000
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_access.md
+++ /dev/null
@@ -1,274 +0,0 @@
-# macOS File Rename
-
-## Description
-
-This event is generated when a file is accessed.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "open"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.inode</code></td>
-<td>Inode representing the file in the filesystem.</td>
-<td><code>256383</code></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_delete.md b/custom_documentation/doc/sample_output/file/macos/macos_file_delete.md
deleted file mode 100644
index 02bde259a..000000000
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_delete.md
+++ /dev/null
@@ -1,349 +0,0 @@
-# macOS File Delete
-
-## Description
-
-This event is generated when a file is deleted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "deletion"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.inode</code></td>
-<td>Inode representing the file in the filesystem.</td>
-<td><code>256383</code></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md
deleted file mode 100644
index 920c63712..000000000
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_endpoint_unquarantine.md
+++ /dev/null
@@ -1,229 +0,0 @@
-# macOS Malware Unquarantine
-
-## Description
-
-This event is generated when Endpoint restores a file from the malware quarantine.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "endpoint_unquarantine"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.Ext.correlation.id</code></td>
-<td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.path</code></td>
-<td>Original file path prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md b/custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md
deleted file mode 100644
index 79b405a10..000000000
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_extended_attributes_delete.md
+++ /dev/null
@@ -1,349 +0,0 @@
-# macOS File Extended Attributes Delete
-
-## Description
-
-This event is generated when extended file attributes are deleted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "extended_attributes_delete"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.attributes</code></td>
-<td>Array of file attributes.  Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.</td>
-<td><code>["readonly", "system"]</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.inode</code></td>
-<td>Inode representing the file in the filesystem.</td>
-<td><code>256383</code></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md b/custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md
deleted file mode 100644
index b2cda42f5..000000000
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_launch_daemon.md
+++ /dev/null
@@ -1,339 +0,0 @@
-# macOS Launch Daemon
-
-## Description
-
-This event includes information about a macOS Launch Daemon.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "launch_daemon"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>Persistence.args</code></td>
-<td>Arguments used to execute the persistence item</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Persistence.keepalive</code></td>
-<td>Keep alive option boolean</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Persistence.name</code></td>
-<td>The persistence item's name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Persistence.path</code></td>
-<td>The file's path</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Persistence.runatload</code></td>
-<td>Run at load option boolean</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_modification.md b/custom_documentation/doc/sample_output/file/macos/macos_file_modification.md
deleted file mode 100644
index 3454295dd..000000000
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_modification.md
+++ /dev/null
@@ -1,359 +0,0 @@
-# macOS File Modification
-
-## Description
-
-This event is generated when a file is modified.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "modification"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.header_bytes</code></td>
-<td>First 16 bytes of file used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.inode</code></td>
-<td>Inode representing the file in the filesystem.</td>
-<td><code>256383</code></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_mount.md b/custom_documentation/doc/sample_output/file/macos/macos_file_mount.md
deleted file mode 100644
index 2084a1e82..000000000
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_mount.md
+++ /dev/null
@@ -1,334 +0,0 @@
-# macOS Mount
-
-## Description
-
-This event is generated when a file system is mounted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "mount"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.path</code></td>
-<td>Original file path prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.inode</code></td>
-<td>Inode representing the file in the filesystem.</td>
-<td><code>256383</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/macos/macos_file_rename.md b/custom_documentation/doc/sample_output/file/macos/macos_file_rename.md
deleted file mode 100644
index 141f4d1df..000000000
--- a/custom_documentation/doc/sample_output/file/macos/macos_file_rename.md
+++ /dev/null
@@ -1,364 +0,0 @@
-# macOS File Rename
-
-## Description
-
-This event is generated when a file is renamed.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "rename"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.extension</code></td>
-<td>Original file extension prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.path</code></td>
-<td>Original file path prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.inode</code></td>
-<td>Inode representing the file in the filesystem.</td>
-<td><code>256383</code></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_create.md b/custom_documentation/doc/sample_output/file/windows/windows_file_create.md
deleted file mode 100644
index 98906c489..000000000
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_create.md
+++ /dev/null
@@ -1,369 +0,0 @@
-# Windows File Create
-
-## Description
-
-This event is generated when a file is created.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "creation"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.entropy</code></td>
-<td>Entropy calculation of file's header and footer used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.header_bytes</code></td>
-<td>First 16 bytes of file used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.monotonic_id</code></td>
-<td>File event monotonic ID.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.windows.zone_identifier</code></td>
-<td>Windows zone identifier for a file</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.origin_referrer_url</code></td>
-<td>The url of the webpage that linked to the file.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.origin_url</code></td>
-<td>The url where the file is hosted.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_delete.md b/custom_documentation/doc/sample_output/file/windows/windows_file_delete.md
deleted file mode 100644
index 03dcabca9..000000000
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_delete.md
+++ /dev/null
@@ -1,344 +0,0 @@
-# Windows File Delete
-
-## Description
-
-This event is generated when a file is deleted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "deletion"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.entropy</code></td>
-<td>Entropy calculation of file's header and footer used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.monotonic_id</code></td>
-<td>File event monotonic ID.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md b/custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md
deleted file mode 100644
index e63d6b373..000000000
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_endpoint_unquarantine.md
+++ /dev/null
@@ -1,229 +0,0 @@
-# Windows Malware Unquarantine
-
-## Description
-
-This event is generated when Endpoint restores a file from the malware quarantine.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "endpoint_unquarantine"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.Ext.correlation.id</code></td>
-<td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.path</code></td>
-<td>Original file path prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_modification.md b/custom_documentation/doc/sample_output/file/windows/windows_file_modification.md
deleted file mode 100644
index 0737706e3..000000000
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_modification.md
+++ /dev/null
@@ -1,349 +0,0 @@
-# Windows File Modification
-
-## Description
-
-This event is generated when a file is modified.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "modification"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.entropy</code></td>
-<td>Entropy calculation of file's header and footer used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.header_bytes</code></td>
-<td>First 16 bytes of file used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.monotonic_id</code></td>
-<td>File event monotonic ID.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_open.md b/custom_documentation/doc/sample_output/file/windows/windows_file_open.md
deleted file mode 100644
index 10b5a6c03..000000000
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_open.md
+++ /dev/null
@@ -1,354 +0,0 @@
-# Windows File Open
-
-## Description
-
-This event is generated when a file is opened.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "open"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.entropy</code></td>
-<td>Entropy calculation of file's header and footer used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.header_bytes</code></td>
-<td>First 16 bytes of file used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.monotonic_id</code></td>
-<td>File event monotonic ID.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md b/custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md
deleted file mode 100644
index abf0063ee..000000000
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_overwrite.md
+++ /dev/null
@@ -1,349 +0,0 @@
-# Windows File Overwrite
-
-## Description
-
-This event is generated when a file is overwritten
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "overwrite"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.entropy</code></td>
-<td>Entropy calculation of file's header and footer used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.header_bytes</code></td>
-<td>First 16 bytes of file used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.monotonic_id</code></td>
-<td>File event monotonic ID.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/file/windows/windows_file_rename.md b/custom_documentation/doc/sample_output/file/windows/windows_file_rename.md
deleted file mode 100644
index 8afc5a176..000000000
--- a/custom_documentation/doc/sample_output/file/windows/windows_file_rename.md
+++ /dev/null
@@ -1,369 +0,0 @@
-# Windows File Rename
-
-## Description
-
-This event is generated when a file is renamed.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "rename"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.entropy</code></td>
-<td>Entropy calculation of file's header and footer used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.header_bytes</code></td>
-<td>First 16 bytes of file used to check file integrity.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.monotonic_id</code></td>
-<td>File event monotonic ID.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.extension</code></td>
-<td>Original file extension prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.name</code></td>
-<td>Original file name prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.Ext.original.path</code></td>
-<td>Original file path prior to a modification event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.extension</code></td>
-<td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td>
-<td><code>png</code></td>
-</tr>
-<tr>
-<td><code>file.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.name</code></td>
-<td>Name of the file including the extension, without the directory.</td>
-<td><code>example.png</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>file.size</code></td>
-<td>File size in bytes.  Only relevant when `file.type` is "file".</td>
-<td><code>16384</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.id</code></td>
-<td>Thread ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/library/macos/macos_library_load.md b/custom_documentation/doc/sample_output/library/macos/macos_library_load.md
deleted file mode 100644
index 55198a076..000000000
--- a/custom_documentation/doc/sample_output/library/macos/macos_library_load.md
+++ /dev/null
@@ -1,364 +0,0 @@
-# Windows Library Load
-
-## Description
-
-This event is generated when a dynlib is loaded.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.library-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.library" and event.module : "endpoint" and host.os.type : "macos" and event.action : "load"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.size</code></td>
-<td>Size of DLL</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>dll.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>dll.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>dll.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>dll.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.name</code></td>
-<td>Name of the library.  This generally maps to the name of the file on disk.</td>
-<td><code>kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>dll.path</code></td>
-<td>Full file path of the library.</td>
-<td><code>C:\Windows\System32\kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/library/windows/windows_library_load.md b/custom_documentation/doc/sample_output/library/windows/windows_library_load.md
deleted file mode 100644
index 0291a7a1f..000000000
--- a/custom_documentation/doc/sample_output/library/windows/windows_library_load.md
+++ /dev/null
@@ -1,394 +0,0 @@
-# Windows Library Load
-
-## Description
-
-This event is generated when a DLL or driver is loaded.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.library-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.library" and event.module : "endpoint" and host.os.type : "windows" and event.action : "load"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>dll.Ext.defense_evasions</code></td>
-<td>List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.Ext.load_index</code></td>
-<td>A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.  The first load index is 1.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.Ext.relative_file_creation_time</code></td>
-<td>Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.Ext.relative_file_name_modify_time</code></td>
-<td>Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.Ext.size</code></td>
-<td>Size of DLL</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>dll.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>dll.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>dll.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>dll.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dll.name</code></td>
-<td>Name of the library.  This generally maps to the name of the file on disk.</td>
-<td><code>kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>dll.path</code></td>
-<td>Full file path of the library.</td>
-<td><code>C:\Windows\System32\kernel32.dll</code></td>
-</tr>
-<tr>
-<td><code>dll.pe.file_version</code></td>
-<td>Internal version of the file, provided at compile-time.</td>
-<td><code>6.3.9600.17415</code></td>
-</tr>
-<tr>
-<td><code>dll.pe.imphash</code></td>
-<td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td>
-<td><code>0c6803c4e922103c4dca5963aad36ddf</code></td>
-</tr>
-<tr>
-<td><code>dll.pe.original_file_name</code></td>
-<td>Internal name of the file, provided at compile-time.</td>
-<td><code>MSPAINT.EXE</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/metadata/metadata.md b/custom_documentation/doc/sample_output/metadata/metadata.md
deleted file mode 100644
index 9ae2f77ba..000000000
--- a/custom_documentation/doc/sample_output/metadata/metadata.md
+++ /dev/null
@@ -1,249 +0,0 @@
-# Endpoint Metadata
-
-## Description
-
-This is a relatively small state management document that includes details about an installed Endpoint.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux, macOS, Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>metrics-endpoint.metadata-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.metadata" and event.module : "endpoint" and event.action : "endpoint_metadata"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.capabilities</code></td>
-<td>Enabled capabilities</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.configuration.isolation</code></td>
-<td>Configuration setting for Host Isolation from the network</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.status</code></td>
-<td>the status of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.state.isolation</code></td>
-<td>Current network isolation state of the host</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.state.tamper_protection</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.status</code></td>
-<td>The current status of the endpoint e.g. enrolled, unenrolled.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/metrics/metrics.md b/custom_documentation/doc/sample_output/metrics/metrics.md
deleted file mode 100644
index 6647a919c..000000000
--- a/custom_documentation/doc/sample_output/metrics/metrics.md
+++ /dev/null
@@ -1,949 +0,0 @@
-# Endpoint Metrics
-
-## Description
-
-This is an internal state management document that includes metrics on Endpoint's performance.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux, macOS, Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>metrics-endpoint.metrics-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.metrics" and event.module : "endpoint" and event.action : "endpoint_metrics"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.behavior.rtt</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.behavior.timeout_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.malware_score.rtt</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.malware_score.timeout_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.rtt</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.timeout_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.ransomware.rtt</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.ransomware.timeout_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.rtt</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.timeout_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.shell_code.rtt</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cloud_services.reputation_lookups.shell_code.timeout_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cpu.endpoint.histogram.counts</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cpu.endpoint.histogram.values</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cpu.endpoint.latest</code></td>
-<td>Average CPU over the last sample interval</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.cpu.endpoint.mean</code></td>
-<td>Average CPU load used by the endpoint</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.disks.device</code></td>
-<td>Device name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.disks.endpoint_drive</code></td>
-<td>This field will be present and set to true only for the drive that holds the installed endpoint</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.disks.free</code></td>
-<td>The number of bytes marked as free on the disk</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.disks.fstype</code></td>
-<td>The file system type for the drive</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.disks.mount</code></td>
-<td>The disks mount location</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.disks.total</code></td>
-<td>The size of the disk in bytes</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.alerts.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.alerts.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.alerts.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.alerts.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.api_events.sent_bytes</code></td>
-<td>Total size of API Event sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.api_events.sent_count</code></td>
-<td>Number of sent API Event documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.api_events.sources.sent_bytes</code></td>
-<td>Total size of API Event sent documents from source</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.api_events.sources.sent_count</code></td>
-<td>Number of sent API Event documents from source</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.api_events.sources.source</code></td>
-<td>API Event document source name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes</code></td>
-<td>Total size of suppressed API Event documents from source</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.api_events.sources.suppressed_count</code></td>
-<td>Number of suppressed API Event documents from source</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.api_events.suppressed_bytes</code></td>
-<td>Total size of suppressed API Event documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.api_events.suppressed_count</code></td>
-<td>Number of suppressed API Event documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.device_events.sent_bytes</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.device_events.sent_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.device_events.suppressed_bytes</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.device_events.suppressed_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.dns_events.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.dns_events.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.dns_events.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.dns_events.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.file_events.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.file_events.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.file_events.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.file_events.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.library_events.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.library_events.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.library_events.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.library_events.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.network_events.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.network_events.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.network_events.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.network_events.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.overall.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.overall.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.overall.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.overall.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.process_events.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.process_events.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.process_events.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.process_events.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.registry_events.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.registry_events.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.registry_events.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.registry_events.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.security_events.sent_bytes</code></td>
-<td>Total size of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.security_events.sent_count</code></td>
-<td>Number of sent documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.security_events.suppressed_bytes</code></td>
-<td>Total size of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.security_events.suppressed_count</code></td>
-<td>Number of suppressed documents</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.volume_device_events.sent_bytes</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.volume_device_events.sent_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.volume_device_events.suppressed_bytes</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.documents_volume.volume_device_events.suppressed_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.event_filter.active_global_count</code></td>
-<td>The number of active global event filters</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.event_filter.active_user_count</code></td>
-<td>The number of active user event filters</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent</code></td>
-<td>Perfect of Endpoint's update spent running the rule</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.malicious_behavior_rules.id</code></td>
-<td>The rule id</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.memory.endpoint.private.latest</code></td>
-<td>The memory usage by the endpoint for the last sample interval</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.memory.endpoint.private.mean</code></td>
-<td>Average memory usage by the endpoint since its start</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.amsi_events.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.amsi_events.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.attack_surface_events.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.attack_surface_events.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.authentication_events.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing authentication events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.authentication_events.week_ms</code></td>
-<td>The total milliseconds spent on authentication events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.behavior_protection.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.behavior_protection.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.cred_access_events.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.cred_access_events.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.dns_events.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing DNS events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.dns_events.week_ms</code></td>
-<td>The total milliseconds spent on DNS events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.file_events.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing file events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.file_events.week_ms</code></td>
-<td>The total milliseconds spent on file events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.kernel_api_events.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.kernel_api_events.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.library_load_events.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing library load events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.library_load_events.week_ms</code></td>
-<td>The total milliseconds spent on library load events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.malware.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing malware scanning due to the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.malware.week_ms</code></td>
-<td>The total milliseconds spent on malware scanning due to the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.memory_scan.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.memory_scan.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.network_events.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing network events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.network_events.week_ms</code></td>
-<td>The total milliseconds spent on network events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.overall.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing activity for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.overall.week_ms</code></td>
-<td>The total milliseconds spent monitoring the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process.code_signature.signing_id</code></td>
-<td>'The identifier used to sign the binary.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process.code_signature.team_id</code></td>
-<td>'The team identifier used to sign the binary.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process.executable</code></td>
-<td>Path to the process executable for the impact entry</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process_events.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing process events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process_events.week_ms</code></td>
-<td>The total milliseconds spent on process events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process_injection.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.process_injection.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.ransomware.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.ransomware.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.registry_events.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing registry events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.registry_events.week_ms</code></td>
-<td>The total milliseconds spent on registry events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.tcpip_events.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.tcpip_events.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.threat_intelligence_events.week_ms</code></td>
-<td>The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.volume_device_events.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.volume_device_events.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.win32k_events.week_idle_ms</code></td>
-<td>The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.win32k_events.week_ms</code></td>
-<td>The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.wmi_events.week_idle_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.system_impact.wmi_events.week_ms</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.threads.cpu.mean</code></td>
-<td>The thread's average CPU use</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.threads.name</code></td>
-<td>The thread name</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.top_process_trees.values.event_count</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.top_process_trees.values.last_seen</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.top_process_trees.values.sample.command_line</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.top_process_trees.values.sample.entity_id</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.top_process_trees.values.sample.executable</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.top_process_trees.values.sample.parent_command_line</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.top_process_trees.window_end</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.top_process_trees.window_start</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.uptime.endpoint</code></td>
-<td>Number of seconds since the endpoint was started</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.metrics.uptime.system</code></td>
-<td>Number of seconds since the system was started</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
deleted file mode 100644
index c4cb6a7e9..000000000
--- a/custom_documentation/doc/sample_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
+++ /dev/null
@@ -1,369 +0,0 @@
-# Linux Network Connection Attempted, Connection Accepted, and Disconnect
-
-## Description
-
-This event is generated when a network session is accepted, attempted or terminated.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "linux" and event.action : "connection_attempted" or "connection_accepted" or "disconnect_received"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>destination.address</code></td>
-<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.bytes</code></td>
-<td>Bytes sent from the destination to the source.</td>
-<td><code>184</code></td>
-</tr>
-<tr>
-<td><code>destination.ip</code></td>
-<td>IP address of the destination (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.port</code></td>
-<td>Port of the destination.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>network.direction</code></td>
-<td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td>
-<td><code>inbound</code></td>
-</tr>
-<tr>
-<td><code>network.transport</code></td>
-<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
-<td><code>tcp</code></td>
-</tr>
-<tr>
-<td><code>network.type</code></td>
-<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
-<td><code>ipv4</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.effective</code></td>
-<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.permitted</code></td>
-<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>source.address</code></td>
-<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.bytes</code></td>
-<td>Bytes sent from the source to the destination.</td>
-<td><code>184</code></td>
-</tr>
-<tr>
-<td><code>source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.port</code></td>
-<td>Port of the source.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md b/custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md
deleted file mode 100644
index e99db8d1b..000000000
--- a/custom_documentation/doc/sample_output/network/linux/linux_network_dns_lookup_result.md
+++ /dev/null
@@ -1,283 +0,0 @@
-# Linux DNS Lookup Result
-
-## Description
-
-This event is generated when results are returned for a DNS lookup request.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "linux" and event.action : "lookup_result"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>destination.address</code></td>
-<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.ip</code></td>
-<td>IP address of the destination (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.port</code></td>
-<td>Port of the destination.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.question.name</code></td>
-<td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td>
-<td><code>www.example.com</code></td>
-</tr>
-<tr>
-<td><code>dns.question.type</code></td>
-<td>The type of record being queried.</td>
-<td><code>AAAA</code></td>
-</tr>
-<tr>
-<td><code>dns.resolved_ip</code></td>
-<td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td>
-<td><code>["10.10.10.10", "10.10.10.11"]</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>network.protocol</code></td>
-<td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td>
-<td><code>http</code></td>
-</tr>
-<tr>
-<td><code>network.transport</code></td>
-<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
-<td><code>tcp</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.effective</code></td>
-<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.permitted</code></td>
-<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>source.address</code></td>
-<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.port</code></td>
-<td>Port of the source.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md b/custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
deleted file mode 100644
index 5cc6e31dd..000000000
--- a/custom_documentation/doc/sample_output/network/macos/macos_network_connection_attempted_and_disconnect.md
+++ /dev/null
@@ -1,359 +0,0 @@
-# macOS Network Connection Attempted and Disconnect Received
-
-## Description
-
-This event is generated when a connection is attempted or a request to terminate a network connection occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "macos" and event.action : "connection_attempted" or "disconnect_received"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>destination.address</code></td>
-<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.bytes</code></td>
-<td>Bytes sent from the destination to the source.</td>
-<td><code>184</code></td>
-</tr>
-<tr>
-<td><code>destination.domain</code></td>
-<td>The domain name of the destination system.  This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.</td>
-<td><code>foo.example.com</code></td>
-</tr>
-<tr>
-<td><code>destination.ip</code></td>
-<td>IP address of the destination (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.port</code></td>
-<td>Port of the destination.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>network.transport</code></td>
-<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
-<td><code>tcp</code></td>
-</tr>
-<tr>
-<td><code>network.type</code></td>
-<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
-<td><code>ipv4</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>source.address</code></td>
-<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.bytes</code></td>
-<td>Bytes sent from the source to the destination.</td>
-<td><code>184</code></td>
-</tr>
-<tr>
-<td><code>source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.port</code></td>
-<td>Port of the source.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md b/custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md
deleted file mode 100644
index a50b436c6..000000000
--- a/custom_documentation/doc/sample_output/network/macos/macos_network_dns_lookup_result.md
+++ /dev/null
@@ -1,374 +0,0 @@
-# macOS DNS Lookup Result
-
-## Description
-
-This event is generated when results are returned for a DNS lookup request.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "macos" and event.action : "lookup_result"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>destination.address</code></td>
-<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.ip</code></td>
-<td>IP address of the destination (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.port</code></td>
-<td>Port of the destination.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.Ext.options</code></td>
-<td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.Ext.status</code></td>
-<td>DNS status field, uint32</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.question.name</code></td>
-<td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td>
-<td><code>www.example.com</code></td>
-</tr>
-<tr>
-<td><code>dns.question.type</code></td>
-<td>The type of record being queried.</td>
-<td><code>AAAA</code></td>
-</tr>
-<tr>
-<td><code>dns.resolved_ip</code></td>
-<td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td>
-<td><code>["10.10.10.10", "10.10.10.11"]</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>network.protocol</code></td>
-<td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td>
-<td><code>http</code></td>
-</tr>
-<tr>
-<td><code>network.transport</code></td>
-<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
-<td><code>tcp</code></td>
-</tr>
-<tr>
-<td><code>network.type</code></td>
-<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
-<td><code>ipv4</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>source.address</code></td>
-<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.port</code></td>
-<td>Port of the source.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
deleted file mode 100644
index ca04f971c..000000000
--- a/custom_documentation/doc/sample_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
+++ /dev/null
@@ -1,339 +0,0 @@
-# Windows Network Connection Attempted, Connection Accepted and Disconnect Received
-
-## Description
-
-This event is generated when a connection is attempted, a connection is accepted, or a request to terminate a network session is received.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "connection_attempted" or "connection_accepted" or "disconnect_received"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>destination.address</code></td>
-<td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.bytes</code></td>
-<td>Bytes sent from the destination to the source.</td>
-<td><code>184</code></td>
-</tr>
-<tr>
-<td><code>destination.ip</code></td>
-<td>IP address of the destination (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>destination.port</code></td>
-<td>Port of the destination.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>network.direction</code></td>
-<td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td>
-<td><code>inbound</code></td>
-</tr>
-<tr>
-<td><code>network.transport</code></td>
-<td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td>
-<td><code>tcp</code></td>
-</tr>
-<tr>
-<td><code>network.type</code></td>
-<td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td>
-<td><code>ipv4</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.uptime</code></td>
-<td>Seconds the process has been up.</td>
-<td><code>1325</code></td>
-</tr>
-<tr>
-<td><code>source.address</code></td>
-<td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.bytes</code></td>
-<td>Bytes sent from the source to the destination.</td>
-<td><code>184</code></td>
-</tr>
-<tr>
-<td><code>source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>source.port</code></td>
-<td>Port of the source.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md b/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md
deleted file mode 100644
index 9c0f41528..000000000
--- a/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_requested.md
+++ /dev/null
@@ -1,309 +0,0 @@
-# Windows DNS Lookup Request
-
-## Description
-
-This event is generated when a DNS lookup request is initiated.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "lookup_requested"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>destination.port</code></td>
-<td>Port of the destination.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.Ext.options</code></td>
-<td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.Ext.status</code></td>
-<td>DNS status field, uint32</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.question.name</code></td>
-<td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td>
-<td><code>www.example.com</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>network.destination.port</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>network.protocol</code></td>
-<td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td>
-<td><code>http</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md b/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md
deleted file mode 100644
index f21e46641..000000000
--- a/custom_documentation/doc/sample_output/network/windows/windows_network_dns_lookup_result.md
+++ /dev/null
@@ -1,314 +0,0 @@
-# Windows DNS Lookup Result
-
-## Description
-
-This event is generated when results are returned for a DNS lookup request.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "lookup_result"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>destination.port</code></td>
-<td>Port of the destination.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.Ext.options</code></td>
-<td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.Ext.status</code></td>
-<td>DNS status field, uint32</td>
-<td></td>
-</tr>
-<tr>
-<td><code>dns.question.name</code></td>
-<td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td>
-<td><code>www.example.com</code></td>
-</tr>
-<tr>
-<td><code>dns.resolved_ip</code></td>
-<td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td>
-<td><code>["10.10.10.10", "10.10.10.11"]</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>network.destination.port</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>network.protocol</code></td>
-<td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td>
-<td><code>http</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/policy/policy_response.md b/custom_documentation/doc/sample_output/policy/policy_response.md
deleted file mode 100644
index 02a8001a0..000000000
--- a/custom_documentation/doc/sample_output/policy/policy_response.md
+++ /dev/null
@@ -1,454 +0,0 @@
-# Endpoint Policy Response
-
-## Description
-
-This is a state management document that is generated every time Endpoint refreshes it's policy. It contains details of what Endpoint features are and are not in a healthy state.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux, macOS, Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>metrics-endpoint.policy-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.policy" and event.module : "endpoint" and event.action : "endpoint_policy_response"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.configuration.isolation</code></td>
-<td>Configuration setting for Host Isolation from the network</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.actions.message</code></td>
-<td>message about the application of the action to further qualify the status of the action</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.actions.name</code></td>
-<td>name of the action that was applied</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.actions.status</code></td>
-<td>the status of the action</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.actions.status</code></td>
-<td>the status of the action</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.channel</code></td>
-<td>The channel of the linux artifact.</td>
-<td><code>stable</code></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.name</code></td>
-<td>the name of global artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.identifiers.sha256</code></td>
-<td>the sha256 of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.snapshot</code></td>
-<td>the snapshot date of applied global artifacts or 'latest'</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.update_age</code></td>
-<td>number of days since global artifacts were made up-to-date</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.global.version</code></td>
-<td>the version of global artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.name</code></td>
-<td>the name of user artifact applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.identifiers.sha256</code></td>
-<td>the sha256 of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.artifacts.user.version</code></td>
-<td>the version of user artifacts applied.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.endpoint_policy_version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.id</code></td>
-<td>the id of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.name</code></td>
-<td>the name of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions</code></td>
-<td>all actions that were taken for antivirus registration</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.antivirus_registration.status</code></td>
-<td>the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions</code></td>
-<td>all actions that were taken for attack surface reduction</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.attack_surface_reduction.status</code></td>
-<td>the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions</code></td>
-<td>all actions that were taken for behavior_protection</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.behavior_protection.status</code></td>
-<td>the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.events.concerned_actions</code></td>
-<td>all actions that were taken for event collection</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.events.status</code></td>
-<td>the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions</code></td>
-<td>all actions that were taken for host isolation</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.host_isolation.status</code></td>
-<td>the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.logging.concerned_actions</code></td>
-<td>all actions that were taken for logging</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.logging.status</code></td>
-<td>the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.malware.concerned_actions</code></td>
-<td>all actions that were taken for malware</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.malware.status</code></td>
-<td>the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions</code></td>
-<td>all actions that were taken for memory_protection</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.memory_protection.status</code></td>
-<td>the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.ransomware.concerned_actions</code></td>
-<td>all actions that were taken for ransomware</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.ransomware.status</code></td>
-<td>the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.response_actions.concerned_actions</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.response_actions.status</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.streaming.concerned_actions</code></td>
-<td>all actions that were taken for data streaming</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.configurations.streaming.status</code></td>
-<td>the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions</code></td>
-<td>all actions that were taken for the diagnostic configuration of behavior protection</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.diagnostic.behavior_protection.status</code></td>
-<td>the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.diagnostic.malware.concerned_actions</code></td>
-<td>all actions that were taken for the diagnostic configuration of malware</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.diagnostic.malware.status</code></td>
-<td>the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions</code></td>
-<td>all actions that were taken for the diagnostic configuration of memory protection</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.diagnostic.memory_protection.status</code></td>
-<td>the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions</code></td>
-<td>all actions that were taken for the diagnostic configuration of ransomware</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.response.diagnostic.ransomware.status</code></td>
-<td>the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.status</code></td>
-<td>the status of the applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.policy.applied.version</code></td>
-<td>the version of this applied policy</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.state.isolation</code></td>
-<td>Current network isolation state of the host</td>
-<td></td>
-</tr>
-<tr>
-<td><code>Endpoint.state.tamper_protection</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.build.original</code></td>
-<td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td>
-<td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md b/custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md
deleted file mode 100644
index e34bd995e..000000000
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_already_running.md
+++ /dev/null
@@ -1,959 +0,0 @@
-# Linux Already Running Process
-
-## Description
-
-This event is generated for a process that was already running before Endpoint's process collection was enabled.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "already_running"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.account.id</code></td>
-<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
-<td><code>666777888999</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted</code></td>
-<td>Whether or not the process is a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.effective</code></td>
-<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.permitted</code></td>
-<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md b/custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md
deleted file mode 100644
index 40a77fbc8..000000000
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_fork_exec_exit.md
+++ /dev/null
@@ -1,979 +0,0 @@
-# Linux Process Fork, Exec, and Exit
-
-## Description
-
-This event is generated when a process calls `fork()`, `exec()`, exits, or an aggregation of the previous.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "fork" or "exec" or "end"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.account.id</code></td>
-<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
-<td><code>666777888999</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted</code></td>
-<td>Whether or not the process is a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted_descendant</code></td>
-<td>Whether or not the process is a descendent of a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.end</code></td>
-<td>The time the process ended.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.env_vars</code></td>
-<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
-<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.exit_code</code></td>
-<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
-<td><code>137</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.effective</code></td>
-<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.permitted</code></td>
-<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md b/custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md
deleted file mode 100644
index d7a61a701..000000000
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_gid_change.md
+++ /dev/null
@@ -1,969 +0,0 @@
-# Linux Process Group ID Change
-
-## Description
-
-This event is generated when the group id changes for a process.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "gid_change"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.account.id</code></td>
-<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
-<td><code>666777888999</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted_descendant</code></td>
-<td>Whether or not the process is a descendent of a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.end</code></td>
-<td>The time the process ended.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.exit_code</code></td>
-<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
-<td><code>137</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.effective</code></td>
-<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.permitted</code></td>
-<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md b/custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md
deleted file mode 100644
index 7ed2a2174..000000000
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_memfd_create.md
+++ /dev/null
@@ -1,988 +0,0 @@
-# Linux memfd Creation Events
-
-## Description
-
-This event is generated when when a memfd anonymous file is created.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "memfd_create"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.account.id</code></td>
-<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
-<td><code>666777888999</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted</code></td>
-<td>Whether or not the process is a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted_descendant</code></td>
-<td>Whether or not the process is a descendent of a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.memfd.flag_hugetlb</code></td>
-<td>The anonymous file will be created in the hugetlbfs filesystem using huge pages.</td>
-<td><code>false</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memfd.flag_allow_seal</code></td>
-<td>Allow sealing operations on this file.</td>
-<td><code>false</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memfd.flags</code></td>
-<td>Flags passed to the memfd operation.</td>
-<td><code>2</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memfd.name</code></td>
-<td>Filename for the created file. Appears in /proc/self/fd.</td>
-<td><code>anon.txt</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memfd.flag_exec</code></td>
-<td>Exec flag is set for file.</td>
-<td><code>false</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memfd.flag_cloexec</code></td>
-<td>Sets the the close-on-exec flag on the new file descriptor.</td>
-<td><code>false</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.memfd.flag_noexec_seal</code></td>
-<td>Sets both NOEXEC and MFD_ALLOW_SEALING.</td>
-<td><code>false</code></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.end</code></td>
-<td>The time the process ended.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.exit_code</code></td>
-<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
-<td><code>137</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md b/custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md
deleted file mode 100644
index fb06b62b1..000000000
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_ptrace.md
+++ /dev/null
@@ -1,968 +0,0 @@
-# Linux ptrace_attach Creation Events
-
-## Description
-
-This event is generated when when a process calls ptrace_attach on another process.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "ptrace"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.account.id</code></td>
-<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
-<td><code>666777888999</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted</code></td>
-<td>Whether or not the process is a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted_descendant</code></td>
-<td>Whether or not the process is a descendent of a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.ptrace.child_pid</code></td>
-<td>PID of the ptrace target.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.ptrace.request</code></td>
-<td>ptrace request.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.end</code></td>
-<td>The time the process ended.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.env_vars</code></td>
-<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
-<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.exit_code</code></td>
-<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
-<td><code>137</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md b/custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md
deleted file mode 100644
index 6b19319f3..000000000
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_session_id_change.md
+++ /dev/null
@@ -1,949 +0,0 @@
-# Linux Session ID Change
-
-## Description
-
-This event is generated when a process's session id changes.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "session_id_change"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.account.id</code></td>
-<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
-<td><code>666777888999</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.effective</code></td>
-<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.permitted</code></td>
-<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md b/custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md
deleted file mode 100644
index 0387d1535..000000000
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_shmget.md
+++ /dev/null
@@ -1,968 +0,0 @@
-# Linux shmget Creation Events
-
-## Description
-
-This event is generated when when a process calls shmget().
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "shmget"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.account.id</code></td>
-<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
-<td><code>666777888999</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted</code></td>
-<td>Whether or not the process is a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted_descendant</code></td>
-<td>Whether or not the process is a descendent of a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.shmget.size</code></td>
-<td>Requested size.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.shmget.flags</code></td>
-<td>flags passed to shmget.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.shmget.key</code></td>
-<td>Key passed to the shmget request.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.end</code></td>
-<td>The time the process ended.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.env_vars</code></td>
-<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
-<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.exit_code</code></td>
-<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
-<td><code>137</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md b/custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md
deleted file mode 100644
index afab55eb4..000000000
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_text_output.md
+++ /dev/null
@@ -1,979 +0,0 @@
-# Linux Process Text Output
-
-## Description
-
-This event is generated when a process generates text output.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "text_output"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.io.bytes_skipped.length</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.io.bytes_skipped.offset</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.io.max_bytes_per_process_exceeded</code></td>
-<td>If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.io.text</code></td>
-<td>A chunk of output or input sanitized to UTF-8.  Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.io.total_bytes_captured</code></td>
-<td>The total number of bytes captured in this event.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.io.total_bytes_skipped</code></td>
-<td>The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.io.type</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.effective</code></td>
-<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.permitted</code></td>
-<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.tty.columns</code></td>
-<td>The number of character columns per line. e.g terminal width  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td>
-<td><code>80</code></td>
-</tr>
-<tr>
-<td><code>process.tty.rows</code></td>
-<td>The number of character rows in the terminal. e.g terminal height  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td>
-<td><code>24</code></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md b/custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md
deleted file mode 100644
index 5aa978abe..000000000
--- a/custom_documentation/doc/sample_output/process/linux/linux_process_uid_change.md
+++ /dev/null
@@ -1,973 +0,0 @@
-# Linux Process User ID Change
-
-## Description
-
-This event is generated when the user id changes for a process.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "uid_change"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>cloud.account.id</code></td>
-<td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td>
-<td><code>666777888999</code></td>
-</tr>
-<tr>
-<td><code>cloud.instance.name</code></td>
-<td>Instance name of the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>cloud.project.id</code></td>
-<td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td>
-<td><code>my-project</code></td>
-</tr>
-<tr>
-<td><code>cloud.provider</code></td>
-<td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td>
-<td><code>aws</code></td>
-</tr>
-<tr>
-<td><code>cloud.region</code></td>
-<td>Region in which this host, resource, or service is located.</td>
-<td><code>us-east-1</code></td>
-</tr>
-<tr>
-<td><code>container.id</code></td>
-<td>Unique container id.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.hash.all</code></td>
-<td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td>
-<td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td>
-</tr>
-<tr>
-<td><code>container.image.name</code></td>
-<td>Name of the image the container was built on.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.image.tag</code></td>
-<td>Container image tags.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>container.name</code></td>
-<td>Container name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.id</code></td>
-<td>Unique ID of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.cluster.name</code></td>
-<td>Name of the cluster.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.namespace</code></td>
-<td>Namespace in which the action is taking place.</td>
-<td><code>kube-system</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.ip</code></td>
-<td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.name</code></td>
-<td>Name of the resource being acted upon.</td>
-<td><code>test-pod-cdcws</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.parent.type</code></td>
-<td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td>
-<td><code>DaemonSet</code></td>
-</tr>
-<tr>
-<td><code>orchestrator.resource.type</code></td>
-<td>Type of resource being acted upon.</td>
-<td><code>service</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted</code></td>
-<td>Whether or not the process is a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted_descendant</code></td>
-<td>Whether or not the process is a descendent of a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.end</code></td>
-<td>The time the process ended.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.source.ip</code></td>
-<td>IP address of the source (IPv4 or IPv6).</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.entry_meta.type</code></td>
-<td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.entry_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.exit_code</code></td>
-<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
-<td><code>137</code></td>
-</tr>
-<tr>
-<td><code>process.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.group_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.parent.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.parent.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.previous.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.previous.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.interactive</code></td>
-<td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.real_user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.same_as_process</code></td>
-<td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.session_leader.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>process.start</code></td>
-<td>The time the process started.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.supplemental_groups.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.effective</code></td>
-<td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.thread.capabilities.permitted</code></td>
-<td>This is a limiting superset for the effective capabilities that the thread may assume.</td>
-<td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.major</code></td>
-<td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.tty.char_device.minor</code></td>
-<td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td>
-<td><code>1</code></td>
-</tr>
-<tr>
-<td><code>process.user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>process.user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md b/custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md
deleted file mode 100644
index a77f02ad3..000000000
--- a/custom_documentation/doc/sample_output/process/macos/macos_process_already_running.md
+++ /dev/null
@@ -1,354 +0,0 @@
-# macOS Already Running Process
-
-## Description
-
-This event is generated for a process that was already running before Endpoint's process event collection was enabled.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "already_running"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.env_vars</code></td>
-<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
-<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md b/custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md
deleted file mode 100644
index 530ed10b0..000000000
--- a/custom_documentation/doc/sample_output/process/macos/macos_process_fork_exec_exit.md
+++ /dev/null
@@ -1,444 +0,0 @@
-# macOS Process Fork, Exec, and Exit
-
-## Description
-
-This event is generated when a process calls `fork()`, `exec()`, or exits.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "fork" or "exec" or "end"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>Target.process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted</code></td>
-<td>Whether or not the process is a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted_descendant</code></td>
-<td>Whether or not the process is a descendent of a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.env_vars</code></td>
-<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
-<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.exit_code</code></td>
-<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
-<td><code>137</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md b/custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md
deleted file mode 100644
index acc4fd99b..000000000
--- a/custom_documentation/doc/sample_output/process/macos/macos_process_remote_thread.md
+++ /dev/null
@@ -1,419 +0,0 @@
-# macOS Remote Thread
-
-## Description
-
-This event is generated when a remote thread is created.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "remote_thread"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>Target.process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Target.process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>Target.process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.Ext.real.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.id</code></td>
-<td>Unique identifier for the group on the system/platform.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>group.name</code></td>
-<td>Name of the group.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted</code></td>
-<td>Whether or not the process is a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.env_vars</code></td>
-<td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td>
-<td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.id</code></td>
-<td>One or multiple unique identifiers of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.Ext.real.name</code></td>
-<td>Short name or login of the user.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md b/custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md
deleted file mode 100644
index 93e30431c..000000000
--- a/custom_documentation/doc/sample_output/process/windows/windows_process_already_running.md
+++ /dev/null
@@ -1,479 +0,0 @@
-# Windows Already Running Process
-
-## Description
-
-This event is generated for a process that was already running before Endpoint's process collection was enabled.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "windows" and event.action : "already_running"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.mitigation_policies</code></td>
-<td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.relative_file_creation_time</code></td>
-<td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.authentication_package</code></td>
-<td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.client_address</code></td>
-<td>Client's IPv4 or IPv6 address as a string, if available.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.id</code></td>
-<td>Session ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.logon_type</code></td>
-<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.relative_logon_time</code></td>
-<td>Process creation time, relative to logon time, in seconds.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.relative_password_age</code></td>
-<td>Process creation time, relative to the last time the password was changed, in seconds.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.user_flags</code></td>
-<td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation_level</code></td>
-<td>What level of elevation the token has</td>
-<td><code>one of "default", "full", "limited"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.security_attributes</code></td>
-<td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td>
-<td><code>TSA://ProcUnique, LUA://DecHdAutoAp</code></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.pe.imphash</code></td>
-<td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td>
-<td><code>0c6803c4e922103c4dca5963aad36ddf</code></td>
-</tr>
-<tr>
-<td><code>process.pe.original_file_name</code></td>
-<td>Internal name of the file, provided at compile-time.</td>
-<td><code>MSPAINT.EXE</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md b/custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md
deleted file mode 100644
index 57344ea11..000000000
--- a/custom_documentation/doc/sample_output/process/windows/windows_process_create_and_exit.md
+++ /dev/null
@@ -1,604 +0,0 @@
-# Windows Process Create And Exit
-
-## Description
-
-This event is generated when a process is created or exits.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "windows" and event.action : "start" or "end"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.created_suspended</code></td>
-<td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.defense_evasions</code></td>
-<td>List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.device.bus_type</code></td>
-<td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.device.dos_name</code></td>
-<td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.device.file_system_type</code></td>
-<td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.device.nt_name</code></td>
-<td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.device.product_id</code></td>
-<td>ProductID of the device. It is provided by the vendor of the device if any.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.device.vendor_id</code></td>
-<td>VendorID of the device. It is provided by the vendor of the device.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.device.volume_device_type</code></td>
-<td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.effective_parent.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.mitigation_policies</code></td>
-<td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.protection</code></td>
-<td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.relative_file_creation_time</code></td>
-<td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.relative_file_name_modify_time</code></td>
-<td>Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.authentication_package</code></td>
-<td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.client_address</code></td>
-<td>Client's IPv4 or IPv6 address as a string, if available.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.id</code></td>
-<td>Session ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.logon_type</code></td>
-<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.relative_logon_time</code></td>
-<td>Process creation time, relative to logon time, in seconds.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.relative_password_age</code></td>
-<td>Process creation time, relative to the last time the password was changed, in seconds.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.user_flags</code></td>
-<td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.elevation_level</code></td>
-<td>What level of elevation the token has</td>
-<td><code>one of "default", "full", "limited"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.integrity_level_name</code></td>
-<td>Human readable integrity level.</td>
-<td><code>one of "system", "high", "medium", "low", "untrusted"</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.token.security_attributes</code></td>
-<td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td>
-<td><code>TSA://ProcUnique, LUA://DecHdAutoAp</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted</code></td>
-<td>Whether or not the process is a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.trusted_descendant</code></td>
-<td>Whether or not the process is a descendent of a trusted application</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.exit_code</code></td>
-<td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td>
-<td><code>137</code></td>
-</tr>
-<tr>
-<td><code>process.hash.md5</code></td>
-<td>MD5 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha1</code></td>
-<td>SHA1 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.hash.sha256</code></td>
-<td>SHA256 hash.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.real.entity_id</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.real.pid</code></td>
-<td>For process.parent this will be the ppid of the process that actually spawned the current process.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.args</code></td>
-<td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td>
-<td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td>
-</tr>
-<tr>
-<td><code>process.parent.args_count</code></td>
-<td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td>
-<td><code>4</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.parent.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.parent.command_line</code></td>
-<td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td>
-<td><code>/usr/bin/ssh -l user 10.0.0.16</code></td>
-</tr>
-<tr>
-<td><code>process.parent.Ext.command_line_truncated</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.parent.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.parent.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.parent.thread.Ext.call_stack.callsite_leading_bytes</code></td>
-<td>Hex opcode bytes preceding the callsite</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.thread.Ext.call_stack.callsite_trailing_bytes</code></td>
-<td>Hex opcode bytes after the callsite (where control will return to)</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.thread.Ext.call_stack.protection</code></td>
-<td>Protection of the page containing this instruction.  This is `R-X' by default if omitted.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.thread.Ext.call_stack.symbol_info</code></td>
-<td>The nearest symbol for `instruction_pointer`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.thread.Ext.call_stack_contains_unbacked</code></td>
-<td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.parent.thread.Ext.call_stack_summary</code></td>
-<td>Concatentation of the non-repeated modules in the call stack.</td>
-<td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td>
-</tr>
-<tr>
-<td><code>process.pe.imphash</code></td>
-<td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td>
-<td><code>0c6803c4e922103c4dca5963aad36ddf</code></td>
-</tr>
-<tr>
-<td><code>process.pe.original_file_name</code></td>
-<td>Internal name of the file, provided at compile-time.</td>
-<td><code>MSPAINT.EXE</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>process.working_directory</code></td>
-<td>The working directory of the process.</td>
-<td><code>/home/alice</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md b/custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md
deleted file mode 100644
index a71bdef26..000000000
--- a/custom_documentation/doc/sample_output/registry/windows/windows_registry_modification.md
+++ /dev/null
@@ -1,334 +0,0 @@
-# Windows Registry Modification
-
-## Description
-
-This event is generated when the registry is modified.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.registry-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.registry" and event.module : "endpoint" and host.os.type : "windows" and event.action : "modification"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>registry.data.bytes</code></td>
-<td>Original bytes written with base64 encoding.  For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.</td>
-<td><code>ZQBuAC0AVQBTAAAAZQBuAAAAAAA=</code></td>
-</tr>
-<tr>
-<td><code>registry.data.strings</code></td>
-<td>Content when writing string types.  Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).</td>
-<td><code>["C:\rta\red_ttp\bin\myapp.exe"]</code></td>
-</tr>
-<tr>
-<td><code>registry.data.type</code></td>
-<td>Standard registry type for encoding contents</td>
-<td><code>REG_SZ</code></td>
-</tr>
-<tr>
-<td><code>registry.hive</code></td>
-<td>Abbreviated name for the hive.</td>
-<td><code>HKLM</code></td>
-</tr>
-<tr>
-<td><code>registry.key</code></td>
-<td>Hive-relative path of keys.</td>
-<td><code>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe</code></td>
-</tr>
-<tr>
-<td><code>registry.path</code></td>
-<td>Full path, including hive, key and value</td>
-<td><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger</code></td>
-</tr>
-<tr>
-<td><code>registry.value</code></td>
-<td>Name of the value written.</td>
-<td><code>Debugger</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md b/custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md
deleted file mode 100644
index 410e3a10c..000000000
--- a/custom_documentation/doc/sample_output/registry/windows/windows_registry_query.md
+++ /dev/null
@@ -1,324 +0,0 @@
-# Windows Registry Query
-
-## Description
-
-This event is generated when the Windows registry is queried.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.registry-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.registry" and event.module : "endpoint" and host.os.type : "windows" and event.action : "query"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.entity_id</code></td>
-<td>Unique identifier for the effective process.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.executable</code></td>
-<td>Executable name for the effective process.</td>
-<td><code>C:\Windows\System32\wbem\WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.name</code></td>
-<td>Process name for the effective process.</td>
-<td><code>WMIC.exe</code></td>
-</tr>
-<tr>
-<td><code>Effective_process.pid</code></td>
-<td>Process ID.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>registry.data.type</code></td>
-<td>Standard registry type for encoding contents</td>
-<td><code>REG_SZ</code></td>
-</tr>
-<tr>
-<td><code>registry.hive</code></td>
-<td>Abbreviated name for the hive.</td>
-<td><code>HKLM</code></td>
-</tr>
-<tr>
-<td><code>registry.key</code></td>
-<td>Hive-relative path of keys.</td>
-<td><code>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe</code></td>
-</tr>
-<tr>
-<td><code>registry.path</code></td>
-<td>Full path, including hive, key and value</td>
-<td><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger</code></td>
-</tr>
-<tr>
-<td><code>registry.value</code></td>
-<td>Name of the value written.</td>
-<td><code>Debugger</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md b/custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md
deleted file mode 100644
index 4f9162621..000000000
--- a/custom_documentation/doc/sample_output/security/macos/macos_security_gatekeeper_override.md
+++ /dev/null
@@ -1,354 +0,0 @@
-# macOS Gatekeeper Override Exception
-
-## Description
-
-This event is generated when a user grants a gatekeeper exception
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "gatekeeper_override"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>file.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>file.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>file.path</code></td>
-<td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td>
-<td><code>/home/alice/example.png</code></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.logon_type</code></td>
-<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.email</code></td>
-<td>User email address.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.full_name</code></td>
-<td>User's full name, if available.</td>
-<td><code>Albert Einstein</code></td>
-</tr>
-<tr>
-<td><code>user.effective.hash</code></td>
-<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.effective.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md b/custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md
deleted file mode 100644
index e9b4d5da3..000000000
--- a/custom_documentation/doc/sample_output/security/macos/macos_security_log_on.md
+++ /dev/null
@@ -1,339 +0,0 @@
-# macOS User Log On
-
-## Description
-
-This event is generated when a user logs on to the computer.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "log_on"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.logon_type</code></td>
-<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.email</code></td>
-<td>User email address.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.full_name</code></td>
-<td>User's full name, if available.</td>
-<td><code>Albert Einstein</code></td>
-</tr>
-<tr>
-<td><code>user.effective.hash</code></td>
-<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.effective.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md b/custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md
deleted file mode 100644
index 8942bf80b..000000000
--- a/custom_documentation/doc/sample_output/security/macos/macos_security_rdp_log_on.md
+++ /dev/null
@@ -1,339 +0,0 @@
-# macOS Screensharing Log On
-
-## Description
-
-This event is generated when a user logs on to the computer with screensharing.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "rdp_log_on"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.logon_type</code></td>
-<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.email</code></td>
-<td>User email address.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.full_name</code></td>
-<td>User's full name, if available.</td>
-<td><code>Albert Einstein</code></td>
-</tr>
-<tr>
-<td><code>user.effective.hash</code></td>
-<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.effective.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md b/custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md
deleted file mode 100644
index 461046cd8..000000000
--- a/custom_documentation/doc/sample_output/security/macos/macos_security_ssh_log_on.md
+++ /dev/null
@@ -1,339 +0,0 @@
-# macOS SSH Log On
-
-## Description
-
-This event is generated when a user logs on to the computer with SSH.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "ssh_log_on"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.logon_type</code></td>
-<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.signing_id</code></td>
-<td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td>
-<td><code>com.apple.xpc.proxy</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.team_id</code></td>
-<td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td>
-<td><code>EQHXZ8M8AV</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.email</code></td>
-<td>User email address.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.full_name</code></td>
-<td>User's full name, if available.</td>
-<td><code>Albert Einstein</code></td>
-</tr>
-<tr>
-<td><code>user.effective.hash</code></td>
-<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.effective.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md b/custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md
deleted file mode 100644
index 8ed13bf01..000000000
--- a/custom_documentation/doc/sample_output/security/windows/windows_security_log_off.md
+++ /dev/null
@@ -1,314 +0,0 @@
-# Windows User Log Off
-
-## Description
-
-This event is generated when a user logs off of the computer.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "windows" and event.action : "log_off"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.logon_type</code></td>
-<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.email</code></td>
-<td>User email address.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.full_name</code></td>
-<td>User's full name, if available.</td>
-<td><code>Albert Einstein</code></td>
-</tr>
-<tr>
-<td><code>user.effective.hash</code></td>
-<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.effective.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md b/custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md
deleted file mode 100644
index 92684a31e..000000000
--- a/custom_documentation/doc/sample_output/security/windows/windows_security_log_on.md
+++ /dev/null
@@ -1,329 +0,0 @@
-# Windows User Log On
-
-## Description
-
-This event is generated when a user logs on to the computer.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "windows" and event.action : "log_on"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>Target.process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.code</code></td>
-<td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td>
-<td><code>4648</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.authentication_id</code></td>
-<td>Process authentication ID</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.session_info.logon_type</code></td>
-<td>Session logon type.  Examples include Interactive, Network, and Service.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.email</code></td>
-<td>User email address.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.full_name</code></td>
-<td>User's full name, if available.</td>
-<td><code>Albert Einstein</code></td>
-</tr>
-<tr>
-<td><code>user.effective.hash</code></td>
-<td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.effective.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.effective.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>winlog.event_data.PrivilegeList</code></td>
-<td>An array of sensitive privileges, assigned to the new logon.</td>
-<td><code>SeTcbPrivilege, SeSecurityPrivilege</code></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md b/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md
deleted file mode 100644
index e20c1c3dc..000000000
--- a/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_mount.md
+++ /dev/null
@@ -1,319 +0,0 @@
-# Windows Device Mount
-
-## Description
-
-This event is generated when a device is mounted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.volume_device-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.volume_device" and event.module : "endpoint" and host.os.type : "windows" and event.action : "mount"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.exists</code></td>
-<td>Boolean to capture if a signature is present.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.status</code></td>
-<td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td>
-<td><code>ERROR_UNTRUSTED_ROOT</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.subject_name</code></td>
-<td>Subject name of the code signer</td>
-<td><code>Microsoft Corporation</code></td>
-</tr>
-<tr>
-<td><code>process.code_signature.trusted</code></td>
-<td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td>
-<td><code>true</code></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.executable</code></td>
-<td>Absolute path to the process executable.</td>
-<td><code>/usr/bin/ssh</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>volume.bus_type</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.device_type</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.dos_name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.file_system_type</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.nt_name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.product_name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.serial_number</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.vendor_name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-</table>
diff --git a/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md b/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md
deleted file mode 100644
index a03fbbd85..000000000
--- a/custom_documentation/doc/sample_output/volume_device/windows/windows_volume_device_unmount.md
+++ /dev/null
@@ -1,274 +0,0 @@
-# Windows Device Unmount
-
-## Description
-
-This event is generated when a device is unmounted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.volume_device-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.volume_device" and event.module : "endpoint" and host.os.type : "windows" and event.action : "unmount"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<table>
-<tr><th>Name</th><th>Description</th><th>Example</th></tr>
-<tr>
-<td><code>@timestamp</code></td>
-<td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td>
-<td><code>2016-05-23T08:05:34.853Z</code></td>
-</tr>
-<tr>
-<td><code>agent.id</code></td>
-<td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>agent.type</code></td>
-<td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td>
-<td><code>filebeat</code></td>
-</tr>
-<tr>
-<td><code>agent.version</code></td>
-<td>Version of the agent.</td>
-<td><code>6.0.0-rc2</code></td>
-</tr>
-<tr>
-<td><code>data_stream.dataset</code></td>
-<td>Data stream dataset name.</td>
-<td><code>nginx.access</code></td>
-</tr>
-<tr>
-<td><code>data_stream.namespace</code></td>
-<td>Data stream namespace.</td>
-<td><code>production</code></td>
-</tr>
-<tr>
-<td><code>data_stream.type</code></td>
-<td>Data stream type.</td>
-<td><code>logs</code></td>
-</tr>
-<tr>
-<td><code>ecs.version</code></td>
-<td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td>
-<td><code>1.0.0</code></td>
-</tr>
-<tr>
-<td><code>elastic.agent.id</code></td>
-<td>Unique identifier of this elastic agent (if one exists).</td>
-<td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td>
-</tr>
-<tr>
-<td><code>event.action</code></td>
-<td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td>
-<td><code>user-password-change</code></td>
-</tr>
-<tr>
-<td><code>event.category</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td>
-<td><code>authentication</code></td>
-</tr>
-<tr>
-<td><code>event.created</code></td>
-<td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td>
-<td><code>2016-05-23T08:05:34.857Z</code></td>
-</tr>
-<tr>
-<td><code>event.dataset</code></td>
-<td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td>
-<td><code>apache.access</code></td>
-</tr>
-<tr>
-<td><code>event.id</code></td>
-<td>Unique ID to describe the event.</td>
-<td><code>8a4f500d</code></td>
-</tr>
-<tr>
-<td><code>event.kind</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td>
-<td><code>alert</code></td>
-</tr>
-<tr>
-<td><code>event.module</code></td>
-<td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td>
-<td><code>apache</code></td>
-</tr>
-<tr>
-<td><code>event.outcome</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td>
-<td><code>success</code></td>
-</tr>
-<tr>
-<td><code>event.sequence</code></td>
-<td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>event.type</code></td>
-<td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.architecture</code></td>
-<td>Operating system architecture.</td>
-<td><code>x86_64</code></td>
-</tr>
-<tr>
-<td><code>host.hostname</code></td>
-<td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.id</code></td>
-<td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.ip</code></td>
-<td>Host ip addresses.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.mac</code></td>
-<td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td>
-<td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td>
-</tr>
-<tr>
-<td><code>host.name</code></td>
-<td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>host.os.Ext.variant</code></td>
-<td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td>
-<td><code>Ubuntu</code></td>
-</tr>
-<tr>
-<td><code>host.os.family</code></td>
-<td>OS family (such as redhat, debian, freebsd, windows).</td>
-<td><code>debian</code></td>
-</tr>
-<tr>
-<td><code>host.os.full</code></td>
-<td>Operating system name, including the version or code name.</td>
-<td><code>Mac OS Mojave</code></td>
-</tr>
-<tr>
-<td><code>host.os.kernel</code></td>
-<td>Operating system kernel version as a raw string.</td>
-<td><code>4.4.0-112-generic</code></td>
-</tr>
-<tr>
-<td><code>host.os.name</code></td>
-<td>Operating system name, without the version.</td>
-<td><code>Mac OS X</code></td>
-</tr>
-<tr>
-<td><code>host.os.platform</code></td>
-<td>Operating system platform (such centos, ubuntu, windows).</td>
-<td><code>darwin</code></td>
-</tr>
-<tr>
-<td><code>host.os.type</code></td>
-<td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td>
-<td><code>macos</code></td>
-</tr>
-<tr>
-<td><code>host.os.version</code></td>
-<td>Operating system version as a raw string.</td>
-<td><code>10.14.1</code></td>
-</tr>
-<tr>
-<td><code>message</code></td>
-<td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td>
-<td><code>Hello World</code></td>
-</tr>
-<tr>
-<td><code>process.Ext.ancestry</code></td>
-<td>An array of entity_ids indicating the ancestors for this event</td>
-<td></td>
-</tr>
-<tr>
-<td><code>process.entity_id</code></td>
-<td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td>
-<td><code>c2c455d9f99375d</code></td>
-</tr>
-<tr>
-<td><code>process.name</code></td>
-<td>Process name.  Sometimes called program name or similar.</td>
-<td><code>ssh</code></td>
-</tr>
-<tr>
-<td><code>process.pid</code></td>
-<td>Process id.</td>
-<td><code>4242</code></td>
-</tr>
-<tr>
-<td><code>user.domain</code></td>
-<td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td>
-<td></td>
-</tr>
-<tr>
-<td><code>user.id</code></td>
-<td>Unique identifier of the user.</td>
-<td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td>
-</tr>
-<tr>
-<td><code>user.name</code></td>
-<td>Short name or login of the user.</td>
-<td><code>a.einstein</code></td>
-</tr>
-<tr>
-<td><code>volume.bus_type</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.device_type</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.dos_name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.file_system_type</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.nt_name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.product_name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.serial_number</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-<tr>
-<td><code>volume.vendor_name</code></td>
-<td>No Description Found</td>
-<td></td>
-</tr>
-</table>

From 2dea8cfe742e94360ec1b30d53fab22152efa3e1 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 28 Mar 2025 21:15:35 +0000
Subject: [PATCH 19/25] don't include examples in the code PR

---
 .../linux/linux_malicious_behavior_alert.md   | 1239 -------
 .../alerts/linux/linux_malware_alert.md       | 2533 ---------------
 .../alerts/linux/linux_memory_threat_alert.md | 2246 -------------
 .../macos/macos_malicious_behavior_alert.md   | 1090 -------
 .../alerts/macos/macos_malware_alert.md       | 1580 ---------
 .../alerts/macos/macos_memory_threat_alert.md | 1359 --------
 .../windows_malicious_behavior_alert.md       | 1190 -------
 .../alerts/windows/windows_malware_alert.md   | 2209 -------------
 .../windows/windows_memory_threat_alert.md    | 1546 ---------
 .../windows/windows_ransomware_alert.md       | 1866 -----------
 .../windows/windows_shellcode_thread.md       | 2888 -----------------
 .../api/windows/windows_api_amsi.md           |  763 -----
 .../new_output/api/windows/windows_api_asm.md |  798 -----
 .../windows/windows_api_credential_access.md  |  757 -----
 .../api/windows/windows_api_kernel_audit.md   |  703 ----
 .../api/windows/windows_api_tcpip.md          |  749 -----
 .../windows_api_threat_intelligence.md        | 1228 -------
 .../api/windows/windows_api_win32k.md         | 1013 ------
 .../new_output/api/windows/windows_api_wmi.md |  879 -----
 .../file/linux/linux_file_create.md           |  698 ----
 .../file/linux/linux_file_delete.md           |  687 ----
 .../linux/linux_file_endpoint_unquarantine.md |  497 ---
 .../file/linux/linux_file_rename.md           |  731 -----
 .../file/macos/macos_file_access.md           |  606 ----
 .../file/macos/macos_file_delete.md           |  783 -----
 .../macos/macos_file_endpoint_unquarantine.md |  497 ---
 .../macos_file_extended_attributes_delete.md  |  782 -----
 .../file/macos/macos_file_launch_daemon.md    |  754 -----
 .../file/macos/macos_file_modification.md     |  805 -----
 .../new_output/file/macos/macos_file_mount.md |  746 -----
 .../file/macos/macos_file_rename.md           |  816 -----
 .../file/windows/windows_file_create.md       |  829 -----
 .../file/windows/windows_file_delete.md       |  774 -----
 .../windows_file_endpoint_unquarantine.md     |  497 ---
 .../file/windows/windows_file_modification.md |  784 -----
 .../file/windows/windows_file_open.md         |  796 -----
 .../file/windows/windows_file_overwrite.md    |  784 -----
 .../file/windows/windows_file_rename.md       |  829 -----
 .../library/macos/macos_library_load.md       |  815 -----
 .../library/windows/windows_library_load.md   |  887 -----
 .../doc/new_output/metadata/metadata.md       |  540 ---
 .../doc/new_output/metrics/metrics.md         | 2086 ------------
 ...twork_attempted_accepted_and_disconnect.md |  824 -----
 .../linux/linux_network_dns_lookup_result.md  |  622 ----
 ...ork_connection_attempted_and_disconnect.md |  801 -----
 .../macos/macos_network_dns_lookup_result.md  |  835 -----
 ...twork_attempted_accepted_and_disconnect.md |  758 -----
 .../windows_network_dns_lookup_requested.md   |  688 ----
 .../windows_network_dns_lookup_result.md      |  700 ----
 .../doc/new_output/policy/policy_response.md  |  992 ------
 .../linux/linux_process_already_running.md    | 2201 -------------
 .../linux/linux_process_fork_exec_exit.md     | 2248 -------------
 .../process/linux/linux_process_gid_change.md | 2225 -------------
 .../linux/linux_process_memfd_create.md       | 2271 -------------
 .../process/linux/linux_process_ptrace.md     | 2221 -------------
 .../linux/linux_process_session_id_change.md  | 2179 -------------
 .../process/linux/linux_process_shmget.md     | 2221 -------------
 .../linux/linux_process_text_output.md        | 2244 -------------
 .../process/linux/linux_process_uid_change.md | 2235 -------------
 .../macos/macos_process_already_running.md    |  791 -----
 .../macos/macos_process_fork_exec_exit.md     | 1005 ------
 .../macos/macos_process_remote_thread.md      |  946 ------
 .../windows_process_already_running.md        | 1084 -------
 .../windows_process_create_and_exit.md        | 1366 --------
 .../windows/windows_registry_modification.md  |  752 -----
 .../windows/windows_registry_query.md         |  728 -----
 .../macos_security_gatekeeper_override.md     |  794 -----
 .../security/macos/macos_security_log_on.md   |  758 -----
 .../macos/macos_security_rdp_log_on.md        |  758 -----
 .../macos/macos_security_ssh_log_on.md        |  758 -----
 .../windows/windows_security_log_off.md       |  699 ----
 .../windows/windows_security_log_on.md        |  734 -----
 .../windows/windows_volume_device_mount.md    |  708 ----
 .../windows/windows_volume_device_unmount.md  |  600 ----
 74 files changed, 83405 deletions(-)
 delete mode 100644 custom_documentation/doc/new_output/alerts/linux/linux_malicious_behavior_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/linux/linux_malware_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/linux/linux_memory_threat_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/macos/macos_malicious_behavior_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/macos/macos_malware_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/macos/macos_memory_threat_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/windows/windows_malicious_behavior_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/windows/windows_malware_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/windows/windows_memory_threat_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/windows/windows_ransomware_alert.md
 delete mode 100644 custom_documentation/doc/new_output/alerts/windows/windows_shellcode_thread.md
 delete mode 100644 custom_documentation/doc/new_output/api/windows/windows_api_amsi.md
 delete mode 100644 custom_documentation/doc/new_output/api/windows/windows_api_asm.md
 delete mode 100644 custom_documentation/doc/new_output/api/windows/windows_api_credential_access.md
 delete mode 100644 custom_documentation/doc/new_output/api/windows/windows_api_kernel_audit.md
 delete mode 100644 custom_documentation/doc/new_output/api/windows/windows_api_tcpip.md
 delete mode 100644 custom_documentation/doc/new_output/api/windows/windows_api_threat_intelligence.md
 delete mode 100644 custom_documentation/doc/new_output/api/windows/windows_api_win32k.md
 delete mode 100644 custom_documentation/doc/new_output/api/windows/windows_api_wmi.md
 delete mode 100644 custom_documentation/doc/new_output/file/linux/linux_file_create.md
 delete mode 100644 custom_documentation/doc/new_output/file/linux/linux_file_delete.md
 delete mode 100644 custom_documentation/doc/new_output/file/linux/linux_file_endpoint_unquarantine.md
 delete mode 100644 custom_documentation/doc/new_output/file/linux/linux_file_rename.md
 delete mode 100644 custom_documentation/doc/new_output/file/macos/macos_file_access.md
 delete mode 100644 custom_documentation/doc/new_output/file/macos/macos_file_delete.md
 delete mode 100644 custom_documentation/doc/new_output/file/macos/macos_file_endpoint_unquarantine.md
 delete mode 100644 custom_documentation/doc/new_output/file/macos/macos_file_extended_attributes_delete.md
 delete mode 100644 custom_documentation/doc/new_output/file/macos/macos_file_launch_daemon.md
 delete mode 100644 custom_documentation/doc/new_output/file/macos/macos_file_modification.md
 delete mode 100644 custom_documentation/doc/new_output/file/macos/macos_file_mount.md
 delete mode 100644 custom_documentation/doc/new_output/file/macos/macos_file_rename.md
 delete mode 100644 custom_documentation/doc/new_output/file/windows/windows_file_create.md
 delete mode 100644 custom_documentation/doc/new_output/file/windows/windows_file_delete.md
 delete mode 100644 custom_documentation/doc/new_output/file/windows/windows_file_endpoint_unquarantine.md
 delete mode 100644 custom_documentation/doc/new_output/file/windows/windows_file_modification.md
 delete mode 100644 custom_documentation/doc/new_output/file/windows/windows_file_open.md
 delete mode 100644 custom_documentation/doc/new_output/file/windows/windows_file_overwrite.md
 delete mode 100644 custom_documentation/doc/new_output/file/windows/windows_file_rename.md
 delete mode 100644 custom_documentation/doc/new_output/library/macos/macos_library_load.md
 delete mode 100644 custom_documentation/doc/new_output/library/windows/windows_library_load.md
 delete mode 100644 custom_documentation/doc/new_output/metadata/metadata.md
 delete mode 100644 custom_documentation/doc/new_output/metrics/metrics.md
 delete mode 100644 custom_documentation/doc/new_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
 delete mode 100644 custom_documentation/doc/new_output/network/linux/linux_network_dns_lookup_result.md
 delete mode 100644 custom_documentation/doc/new_output/network/macos/macos_network_connection_attempted_and_disconnect.md
 delete mode 100644 custom_documentation/doc/new_output/network/macos/macos_network_dns_lookup_result.md
 delete mode 100644 custom_documentation/doc/new_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
 delete mode 100644 custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_requested.md
 delete mode 100644 custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_result.md
 delete mode 100644 custom_documentation/doc/new_output/policy/policy_response.md
 delete mode 100644 custom_documentation/doc/new_output/process/linux/linux_process_already_running.md
 delete mode 100644 custom_documentation/doc/new_output/process/linux/linux_process_fork_exec_exit.md
 delete mode 100644 custom_documentation/doc/new_output/process/linux/linux_process_gid_change.md
 delete mode 100644 custom_documentation/doc/new_output/process/linux/linux_process_memfd_create.md
 delete mode 100644 custom_documentation/doc/new_output/process/linux/linux_process_ptrace.md
 delete mode 100644 custom_documentation/doc/new_output/process/linux/linux_process_session_id_change.md
 delete mode 100644 custom_documentation/doc/new_output/process/linux/linux_process_shmget.md
 delete mode 100644 custom_documentation/doc/new_output/process/linux/linux_process_text_output.md
 delete mode 100644 custom_documentation/doc/new_output/process/linux/linux_process_uid_change.md
 delete mode 100644 custom_documentation/doc/new_output/process/macos/macos_process_already_running.md
 delete mode 100644 custom_documentation/doc/new_output/process/macos/macos_process_fork_exec_exit.md
 delete mode 100644 custom_documentation/doc/new_output/process/macos/macos_process_remote_thread.md
 delete mode 100644 custom_documentation/doc/new_output/process/windows/windows_process_already_running.md
 delete mode 100644 custom_documentation/doc/new_output/process/windows/windows_process_create_and_exit.md
 delete mode 100644 custom_documentation/doc/new_output/registry/windows/windows_registry_modification.md
 delete mode 100644 custom_documentation/doc/new_output/registry/windows/windows_registry_query.md
 delete mode 100644 custom_documentation/doc/new_output/security/macos/macos_security_gatekeeper_override.md
 delete mode 100644 custom_documentation/doc/new_output/security/macos/macos_security_log_on.md
 delete mode 100644 custom_documentation/doc/new_output/security/macos/macos_security_rdp_log_on.md
 delete mode 100644 custom_documentation/doc/new_output/security/macos/macos_security_ssh_log_on.md
 delete mode 100644 custom_documentation/doc/new_output/security/windows/windows_security_log_off.md
 delete mode 100644 custom_documentation/doc/new_output/security/windows/windows_security_log_on.md
 delete mode 100644 custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_mount.md
 delete mode 100644 custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_unmount.md

diff --git a/custom_documentation/doc/new_output/alerts/linux/linux_malicious_behavior_alert.md b/custom_documentation/doc/new_output/alerts/linux/linux_malicious_behavior_alert.md
deleted file mode 100644
index f6cd63281..000000000
--- a/custom_documentation/doc/new_output/alerts/linux/linux_malicious_behavior_alert.md
+++ /dev/null
@@ -1,1239 +0,0 @@
-# Linux Malicious Behavior Alert
-
-## Description
-
-This alert is generated when a Malicious Behavior alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "behavior"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the artifact for linux malicious behavior alert.</td></tr>
-<tr><td>Example</td><td><code>stable</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Events.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Events._label`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Events._state`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.field`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Field in the triggering event to use as input for action</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.state`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Index of event in events array to use for field lookup</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.tree`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Result message</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entity id of actionable process</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of actionable process</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>pid of actionable process</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.result`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action result code</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.account.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td>Example</td><td><code>666777888999</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.description`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The description of the rule generating the event.</td></tr>
-<tr><td>Example</td><td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td>Example</td><td><code>101</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
-<tr><td>Example</td><td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The version / revision of the rule being used for analysis.</td></tr>
-<tr><td>Example</td><td><code>1.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.framework`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
-<tr><td>Example</td><td><code>MITRE ATT&CK</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.tactic.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td>Example</td><td><code>TA0002</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.tactic.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
-<tr><td>Example</td><td><code>Execution</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.tactic.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td>Example</td><td><code>https://attack.mitre.org/tactics/TA0002/</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td>Example</td><td><code>T1059</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td>Example</td><td><code>Command and Scripting Interpreter</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td>Example</td><td><code>https://attack.mitre.org/techniques/T1059/</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.subtechnique`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/linux/linux_malware_alert.md b/custom_documentation/doc/new_output/alerts/linux/linux_malware_alert.md
deleted file mode 100644
index 7d1905008..000000000
--- a/custom_documentation/doc/new_output/alerts/linux/linux_malware_alert.md
+++ /dev/null
@@ -1,2533 +0,0 @@
-# Linux Malware Alert
-
-## Description
-
-This alert is generated when a Malware alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "malicious_file"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the linux artifact.</td></tr>
-<tr><td>Example</td><td><code>stable</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The model's unique identifier.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The score produced by the classification model.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.threshold`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The version of the model used.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.all_names`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The concatenated names of all yara signatures</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Malware artifact identifier.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.matches`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of bytes representing yara signature matches</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.signature.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature sha256.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.signature.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.signature.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.matches`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.signature.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.signature.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.signature.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature version.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.quarantine_message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Message describing quarantine results.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.quarantine_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Path on endpoint the quarantined file was originally.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.quarantine_result`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.temp_file_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.accessed`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.inode`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td>Example</td><td><code>256383</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.mtime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Last time the file content was modified.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.owner`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File owner's username.</td></tr>
-<tr><td>Example</td><td><code>alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pgid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pgid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td>Example</td><td><code>101</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/linux/linux_memory_threat_alert.md b/custom_documentation/doc/new_output/alerts/linux/linux_memory_threat_alert.md
deleted file mode 100644
index 205d12e29..000000000
--- a/custom_documentation/doc/new_output/alerts/linux/linux_memory_threat_alert.md
+++ /dev/null
@@ -1,2246 +0,0 @@
-# Linux Memory Threat Alert
-
-## Description
-
-This alert is generated when a Memory Threat alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "linux" and event.code : "memory_signature"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the linux artifact.</td></tr>
-<tr><td>Example</td><td><code>stable</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_base`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory allocation containing the memory region.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original memory size requested when the memory was allocated.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
-<tr><td>Example</td><td><code>PRIVATE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The address where bytes_compressed begins.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_allocation_offset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_compressed`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
-<tr><td>Example</td><td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_compressed_present`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether bytes_compressed is present in this event.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.all_names`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A sequence of signature names matched.</td></tr>
-<tr><td>Example</td><td><code>Windows.EICAR.Not-a-virus</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>malware signature identifier</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.matches`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The first matching details.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>sha256 hash of file matching signature.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.signature.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The id of the first yara rule matched.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.signature.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the first yara rule matched.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>malware signature version</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_base`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory region.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
-<tr><td>Example</td><td><code>RWX</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Size of the memory region.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pgid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pgid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td>Example</td><td><code>101</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/macos/macos_malicious_behavior_alert.md b/custom_documentation/doc/new_output/alerts/macos/macos_malicious_behavior_alert.md
deleted file mode 100644
index cbee3ae68..000000000
--- a/custom_documentation/doc/new_output/alerts/macos/macos_malicious_behavior_alert.md
+++ /dev/null
@@ -1,1090 +0,0 @@
-# macOS Malicious Behavior Alert
-
-## Description
-
-This alert is generated when a Malicious Behavior alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "behavior"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the macos artifact.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Events.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Events._label`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Events._state`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.field`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Field in the triggering event to use as input for action</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.state`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Index of event in events array to use for field lookup</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.tree`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Result message</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entity id of actionable process</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of actionable process</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>pid of actionable process</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.result`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action result code</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.description`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The description of the rule generating the event.</td></tr>
-<tr><td>Example</td><td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td>Example</td><td><code>101</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
-<tr><td>Example</td><td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The version / revision of the rule being used for analysis.</td></tr>
-<tr><td>Example</td><td><code>1.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.framework`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
-<tr><td>Example</td><td><code>MITRE ATT&CK</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.tactic.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td>Example</td><td><code>TA0002</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.tactic.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
-<tr><td>Example</td><td><code>Execution</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.tactic.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td>Example</td><td><code>https://attack.mitre.org/tactics/TA0002/</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td>Example</td><td><code>T1059</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td>Example</td><td><code>Command and Scripting Interpreter</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td>Example</td><td><code>https://attack.mitre.org/techniques/T1059/</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.subtechnique`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/macos/macos_malware_alert.md b/custom_documentation/doc/new_output/alerts/macos/macos_malware_alert.md
deleted file mode 100644
index 001a4aea5..000000000
--- a/custom_documentation/doc/new_output/alerts/macos/macos_malware_alert.md
+++ /dev/null
@@ -1,1580 +0,0 @@
-# macOS Malware Alert
-
-## Description
-
-This alert is generated when a macOS Malware alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "malicious_file"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the macos artifact.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The model's unique identifier.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The score produced by the classification model.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.threshold`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The version of the model used.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.all_names`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The concatenated names of all yara signatures</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Malware artifact identifier.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.matches`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of bytes representing yara signature matches</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.signature.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature sha256.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.signature.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.signature.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.matches`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.signature.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.signature.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.signature.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature version.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.quarantine_message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Message describing quarantine results.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.quarantine_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Path on endpoint the quarantined file was originally.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.quarantine_result`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.temp_file_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.accessed`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.mtime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Last time the file content was modified.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.owner`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File owner's username.</td></tr>
-<tr><td>Example</td><td><code>alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pgid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pgid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td>Example</td><td><code>101</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/macos/macos_memory_threat_alert.md b/custom_documentation/doc/new_output/alerts/macos/macos_memory_threat_alert.md
deleted file mode 100644
index bd158de35..000000000
--- a/custom_documentation/doc/new_output/alerts/macos/macos_memory_threat_alert.md
+++ /dev/null
@@ -1,1359 +0,0 @@
-# macOS Memory Threat Alert
-
-## Description
-
-This alert is generated when a macOS Memory Thread alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "macos" and event.code : "memory_signature"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the macos artifact.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_base`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory allocation containing the memory region.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original memory size requested when the memory was allocated.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
-<tr><td>Example</td><td><code>PRIVATE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The address where bytes_compressed begins.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_allocation_offset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_compressed`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
-<tr><td>Example</td><td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_compressed_present`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether bytes_compressed is present in this event.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.all_names`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A sequence of signature names matched.</td></tr>
-<tr><td>Example</td><td><code>Windows.EICAR.Not-a-virus</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>malware signature identifier</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.matches`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The first matching details.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>sha256 hash of file matching signature.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.signature.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The id of the first yara rule matched.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.signature.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the first yara rule matched.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>malware signature version</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_base`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory region.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
-<tr><td>Example</td><td><code>RWX</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Size of the memory region.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pgid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pgid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.  Identifier of the group of processes the process belongs to.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td>Example</td><td><code>101</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/windows/windows_malicious_behavior_alert.md b/custom_documentation/doc/new_output/alerts/windows/windows_malicious_behavior_alert.md
deleted file mode 100644
index bdd70ae43..000000000
--- a/custom_documentation/doc/new_output/alerts/windows/windows_malicious_behavior_alert.md
+++ /dev/null
@@ -1,1190 +0,0 @@
-# Windows Malicious Behavior Alert
-
-## Description
-
-This alert occurs when a Malicious Behavior alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "behavior"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Events.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Events._label`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Events._state`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.field`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Field in the triggering event to use as input for action</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Destination file attributes</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Destination file path</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.reason`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Combined USN file modification reason</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Actions taken by Registry Rollback for key</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>NT path of registry key recovered by Rollback</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.values.actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Actions taken by Registry Rollback for value</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.values.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Value name recovered by Rollback</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.source.attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source file attributes</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.source.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source file path</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.state`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Index of event in events array to use for field lookup</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.tree`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates whether or not an action was taken against an entire process tree</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Result message</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entity id of actionable process</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of actionable process</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>pid of actionable process</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.result`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action result code</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the destination.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.transport`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>tcp</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>ipv4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.*`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.description`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The description of the rule generating the event.</td></tr>
-<tr><td>Example</td><td><code>Block requests to public DNS over HTTPS / TLS protocols</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td>Example</td><td><code>101</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Reference URL to additional information about the rule used to generate this event.  The URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.</td></tr>
-<tr><td>Example</td><td><code>https://en.wikipedia.org/wiki/DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The version / revision of the rule being used for analysis.</td></tr>
-<tr><td>Example</td><td><code>1.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.framework`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.</td></tr>
-<tr><td>Example</td><td><code>MITRE ATT&CK</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.tactic.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td>Example</td><td><code>TA0002</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.tactic.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)</td></tr>
-<tr><td>Example</td><td><code>Execution</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.tactic.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )</td></tr>
-<tr><td>Example</td><td><code>https://attack.mitre.org/tactics/TA0002/</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td>Example</td><td><code>T1059</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td>Example</td><td><code>Command and Scripting Interpreter</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)</td></tr>
-<tr><td>Example</td><td><code>https://attack.mitre.org/techniques/T1059/</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.subtechnique.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
-<tr><td>Example</td><td><code>T1059.001</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.subtechnique.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
-<tr><td>Example</td><td><code>PowerShell</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `threat.technique.subtechnique.reference`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)</td></tr>
-<tr><td>Example</td><td><code>https://attack.mitre.org/techniques/T1059/001/</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/windows/windows_malware_alert.md b/custom_documentation/doc/new_output/alerts/windows/windows_malware_alert.md
deleted file mode 100644
index 15f9b5118..000000000
--- a/custom_documentation/doc/new_output/alerts/windows/windows_malware_alert.md
+++ /dev/null
@@ -1,2209 +0,0 @@
-# Windows Malware Alert
-
-## Description
-
-This alert is generated when a Malware alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "malicious_file"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Destination file attributes</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Destination file path</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.reason`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Combined USN file modification reason</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Actions taken by Registry Rollback for key</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>NT path of registry key recovered by Rollback</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.values.actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Actions taken by Registry Rollback for value</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.values.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Value name recovered by Rollback</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.process.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Path of process killed by Process Rollback</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.source.attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source file attributes</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.source.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source file path</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Result message</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.result`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action result code</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.device.bus_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.device.dos_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.device.file_system_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.device.nt_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.device.product_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ProductID of the device. It is provided by the vendor of the device if any.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.device.vendor_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>VendorID of the device. It is provided by the vendor of the device.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.device.volume_device_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The model's unique identifier.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The score produced by the classification model.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.threshold`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The score threshold for the model.  Files that score above this threshold are considered malicious.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_classification.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The version of the model used.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.all_names`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The concatenated names of all yara signatures</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Malware artifact identifier.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.matches`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of bytes representing yara signature matches</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.signature.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature sha256.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.signature.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.primary.signature.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.matches`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.signature.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.signature.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.secondary.signature.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.malware_signature.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Primary malware signature version.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.quarantine_message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Message describing quarantine results.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.quarantine_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Path on endpoint the quarantined file was originally.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.quarantine_result`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean representing whether or not file quarantine succeeded.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.temp_file_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.accessed`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Last time the file was accessed.  Note that not all filesystems keep track of access time.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File creation time.  Note that not all filesystems store the creation time.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Directory where the file is located. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.drive_letter`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Drive letter where the file is located. This field is only relevant on Windows.  The value should be uppercase, and not include the colon.</td></tr>
-<tr><td>Example</td><td><code>C</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.mtime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Last time the file content was modified.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.owner`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File owner's username.</td></tr>
-<tr><td>Example</td><td><code>alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.Ext.dotnet`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether this file is a .NET PE</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.Ext.sections.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.Ext.sections.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.Ext.sections.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The section's name</td></tr>
-<tr><td>Example</td><td><code>.reloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.Ext.streams.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.Ext.streams.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.Ext.streams.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The stream's name</td></tr>
-<tr><td>Example</td><td><code>.reloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.company`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal company name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.description`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal description of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>Paint</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.file_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal version of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>6.3.9600.17415</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.original_file_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.pe.product`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal product name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>Microsoft® Windows® Operating System</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.services`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Services running in this process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Domain of token user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>What level of elevation the token has</td></tr>
-<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.sid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Username of token owner.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.company`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal company name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.description`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal description of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>Paint</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.file_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal version of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>6.3.9600.17415</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.original_file_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.product`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal product name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>Microsoft® Windows® Operating System</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td>Example</td><td><code>101</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/windows/windows_memory_threat_alert.md b/custom_documentation/doc/new_output/alerts/windows/windows_memory_threat_alert.md
deleted file mode 100644
index 653536c27..000000000
--- a/custom_documentation/doc/new_output/alerts/windows/windows_memory_threat_alert.md
+++ /dev/null
@@ -1,1546 +0,0 @@
-# Windows Memory Threat Alert
-
-## Description
-
-This alert is generated when a Memory Threat alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "memory_signature"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_base`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory allocation containing the memory region.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td></tr>
-<tr><td>Example</td><td><code>RWX</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original memory size requested when the memory was allocated.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.allocation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
-<tr><td>Example</td><td><code>PRIVATE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The address where bytes_compressed begins.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_allocation_offset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_compressed`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.</td></tr>
-<tr><td>Example</td><td><code>eJzzSM3JyVcIzy/KSVEEABxJBD4=</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.bytes_compressed_present`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether bytes_compressed is present in this event.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.all_names`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A sequence of signature names matched.</td></tr>
-<tr><td>Example</td><td><code>Windows.EICAR.Not-a-virus</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>malware signature identifier</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.matches`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The first matching details.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.signature.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>sha256 hash of file matching signature.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.signature.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The id of the first yara rule matched.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.primary.signature.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the first yara rule matched.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.malware_signature.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>malware signature version</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_base`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory region.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
-<tr><td>Example</td><td><code>RWX</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Size of the memory region.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_start_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>First 64 bytes at the region base address.</td></tr>
-<tr><td>Example</td><td><code>4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memory_region.region_state`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td></tr>
-<tr><td>Example</td><td><code>COMMIT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Domain of token user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>What level of elevation the token has</td></tr>
-<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.sid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Username of token owner.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.</td></tr>
-<tr><td>Example</td><td><code>101</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the rule or signature generating the event.</td></tr>
-<tr><td>Example</td><td><code>BLOCK_DNS_over_TLS</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/windows/windows_ransomware_alert.md b/custom_documentation/doc/new_output/alerts/windows/windows_ransomware_alert.md
deleted file mode 100644
index eb7ca2e8d..000000000
--- a/custom_documentation/doc/new_output/alerts/windows/windows_ransomware_alert.md
+++ /dev/null
@@ -1,1866 +0,0 @@
-# Windows Ransomware Alert
-
-## Description
-
-This alert is generated when a Ransomware alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "ransomware"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.files.data`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File header or MBR bytes.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.files.entropy`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entropy of file contents.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.files.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.files.metrics`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Suspicious ransomware behaviours associated with the file event.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.files.operation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operation applied to file.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.files.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.files.score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Ransomware score for this particular file event.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.child_processes.score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total ransomware score for aggregated file events.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.feature`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Ransomware feature which triggered the alert.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.files.data`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File header or MBR bytes.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.files.entropy`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entropy of file contents.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.files.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.files.metrics`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Suspicious ransomware behaviours associated with the file event.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.files.operation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operation applied to file.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.files.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.files.score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Ransomware score for this particular file event.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total ransomware score for aggregated file events.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Ransomware.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Ransomware artifact version.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Destination file attributes</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Destination file path</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.reason`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Combined USN file modification reason</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Actions taken by Registry Rollback for key</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>NT path of registry key recovered by Rollback</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.source.attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source file attributes</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.source.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source file path</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Result message</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.result`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action result code</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.mapped_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The base address where this module is loaded.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.mapped_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The size of this module's memory mapping, in bytes.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full file path of the library.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Domain of token user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>What level of elevation the token has</td></tr>
-<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.sid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Username of token owner.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.company`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal company name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.description`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal description of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>Paint</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.file_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal version of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>6.3.9600.17415</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.original_file_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.product`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal product name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>Microsoft® Windows® Operating System</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/alerts/windows/windows_shellcode_thread.md b/custom_documentation/doc/new_output/alerts/windows/windows_shellcode_thread.md
deleted file mode 100644
index 9feae1198..000000000
--- a/custom_documentation/doc/new_output/alerts/windows/windows_shellcode_thread.md
+++ /dev/null
@@ -1,2888 +0,0 @@
-# Windows Shellcode Thread Alert
-
-## Description
-
-This alert is generated when a Shellcode Threat alert occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.alerts-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.alerts" and event.module : "endpoint" and host.os.type : "windows" and event.code : "shellcode_thread"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the windows artifact.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Memory_protection.cross_session`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Is this process injecting across operating system sessions?</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Memory_protection.feature`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory Protection feature which triggered the alert.</td></tr>
-<tr><td>Example</td><td><code>shellcode_thread</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Memory_protection.parent_to_child`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Is this process injecting into its child?</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Memory_protection.self_injection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Is this alert about a process injecting into itself?</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Memory_protection.unique_key_v1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A unique key created by hashing several characteristics of this alert.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Memory_protection.unique_key_v2`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A unique key created by hashing several characteristics of this alert.</td></tr>
-<tr><td>Example</td><td><code>00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Timestamp in which action was taken</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Destination file attributes</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Destination file path</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.file.reason`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Combined USN file modification reason</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Actions taken by Registry Rollback for key</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>NT path of registry key recovered by Rollback</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.values.actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Actions taken by Registry Rollback for value</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.key.values.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Value name recovered by Rollback</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.source.attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source file attributes</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.action.source.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source file path</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Result message</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Responses.result`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Response action result code</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.Ext.mapped_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The base address where this module is loaded.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.Ext.mapped_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The size of this module's memory mapping, in bytes.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.dll.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full file path of the library.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.allocation_base`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory allocation containing the memory region.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.allocation_protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original memory protection requested when the memory was allocated. Example values include "RWX" and "R-X".</td></tr>
-<tr><td>Example</td><td><code>RWX</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.allocation_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original memory size requested when the memory was allocated.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.allocation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The memory allocation type. Example values include "IMAGE", "MAPPED", and "PRIVATE".</td></tr>
-<tr><td>Example</td><td><code>PRIVATE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.bytes_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The address where bytes_compressed begins.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.bytes_allocation_offset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.mapped_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>If the memory corresponds to a file mapping, this is the file's path.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\mshtml.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.memory_pe_detected`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether an executable file was found in memory.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.region_base`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory region.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.region_protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory protection of the memory region. Example values include "RWX" and "R-X".</td></tr>
-<tr><td>Example</td><td><code>RWX</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.region_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Size of the memory region.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.region_state`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>State of the memory region. Example values include "RESERVE", "COMMIT", and "FREE".</td></tr>
-<tr><td>Example</td><td><code>COMMIT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.memory_region.strings`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of strings found within the memory region.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.token.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Domain of token user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.token.elevation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.token.elevation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>What level of elevation the token has</td></tr>
-<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.token.sid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.token.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Username of token owner.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.parent.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.call_stack.instruction_pointer`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The return address of this stack frame.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.call_stack.memory_section.memory_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.call_stack.memory_section.memory_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.call_stack.memory_section.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.call_stack.module_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the DLL/module containing `instruction_pointer`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.call_stack.module_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.call_stack.symbol_info`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The nearest symbol for `instruction_pointer`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.call_stack_summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
-<tr><td>Example</td><td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.original_start_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>When a trampoline was detected, this indicates the original content for the thread start address in memory.</td></tr>
-<tr><td>Example</td><td><code>4194304</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.original_start_address_allocation_offset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.original_start_address_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.</td></tr>
-<tr><td>Example</td><td><code>48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.original_start_address_bytes_disasm`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>When a trampoline was detected, this holds the disassembled code at the original thread start address.</td></tr>
-<tr><td>Example</td><td><code>mov rax, 0x4141414141414141\njmp rax</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.original_start_address_bytes_disasm_hash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td></tr>
-<tr><td>Example</td><td><code>aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.original_start_address_module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.</td></tr>
-<tr><td>Example</td><td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.start_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory address where the thread began execution.</td></tr>
-<tr><td>Example</td><td><code>4194304</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.start_address_allocation_offset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.start_address_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.</td></tr>
-<tr><td>Example</td><td><code>c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.start_address_bytes_disasm`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The bytes at the thread start address, disassembled into human-readable assembly code.</td></tr>
-<tr><td>Example</td><td><code>ret\nint3</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.start_address_bytes_disasm_hash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.</td></tr>
-<tr><td>Example</td><td><code>aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.Ext.start_address_module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The dll/module where the thread began execution.</td></tr>
-<tr><td>Example</td><td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.risk_score`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Risk score or priority of the event (e.g. security solutions). Use your system's original value here.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.severity`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The numeric severity of the event according to your event source.  What the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.  The Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.</td></tr>
-<tr><td>Example</td><td><code>7</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.mapped_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The base address where this module is loaded.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.Ext.mapped_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The size of this module's memory mapping, in bytes.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.dll.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full file path of the library.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Domain of token user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the token is elevated or not</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>What level of elevation the token has</td></tr>
-<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.sid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Token user's Security Identifier (SID).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Username of token owner.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process architecture.  It can differ from host architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.user`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User associated with the running process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.ppid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Parent process' pid.</td></tr>
-<tr><td>Example</td><td><code>4241</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack.instruction_pointer`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The return address of this stack frame.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack.memory_section.memory_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack.memory_section.memory_size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack.memory_section.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack.module_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the DLL/module containing `instruction_pointer`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack.module_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack.symbol_info`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The nearest symbol for `instruction_pointer`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack_final_user_module.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The file name of the call_stack_final_user_module.</td></tr>
-<tr><td>Example</td><td><code>example.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack_summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
-<tr><td>Example</td><td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.start_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory address where the thread began execution.</td></tr>
-<tr><td>Example</td><td><code>4194304</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.start_address_module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The dll/module where the thread began execution.</td></tr>
-<tr><td>Example</td><td><code>C:\Program Files\VMware\VMware Tools\vmtoolsd.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `rule.ruleset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.</td></tr>
-<tr><td>Example</td><td><code>Standard_Protocol_Filters</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/api/windows/windows_api_amsi.md b/custom_documentation/doc/new_output/api/windows/windows_api_amsi.md
deleted file mode 100644
index 5704852b4..000000000
--- a/custom_documentation/doc/new_output/api/windows/windows_api_amsi.md
+++ /dev/null
@@ -1,763 +0,0 @@
-# Windows AMSI API
-
-## Description
-
-This event is generated when Antimalware Scan Interface (AMSI) APIs are called.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Antimalware-Scan-Interface" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td>Example</td><td><code>kernel</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.behaviors`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.return_value`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Return value of RegisterRawInputDevices API call.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.app_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The application name requesting the AMSI scan.</td></tr>
-<tr><td>Example</td><td><code>PowerShell</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.buffer`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The content associated with an AMSI scan.</td></tr>
-<tr><td>Example</td><td><code>[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport("kernel32.dll")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20);</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.content_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The content name, typically a filename, associated with an AMSI scan.</td></tr>
-<tr><td>Example</td><td><code>C:\script.ps1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The size.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/api/windows/windows_api_asm.md b/custom_documentation/doc/new_output/api/windows/windows_api_asm.md
deleted file mode 100644
index 08de8cfd2..000000000
--- a/custom_documentation/doc/new_output/api/windows/windows_api_asm.md
+++ /dev/null
@@ -1,798 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when ETW AttackSurfaceMonitor events are generated.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "AttackSurfaceMonitor" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full file path of the library.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td>Example</td><td><code>kernel</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.behaviors`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.device`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the device object.</td></tr>
-<tr><td>Example</td><td><code>\Device\NPCAP</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.io_control_code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The I/O control code for the requested device operation.</td></tr>
-<tr><td>Example</td><td><code>27365</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/api/windows/windows_api_credential_access.md b/custom_documentation/doc/new_output/api/windows/windows_api_credential_access.md
deleted file mode 100644
index 7058238de..000000000
--- a/custom_documentation/doc/new_output/api/windows/windows_api_credential_access.md
+++ /dev/null
@@ -1,757 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when a process attempts to access priviledged credentials. 
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "ObjectCallback" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td>Example</td><td><code>kernel</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.desired_access`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.desired_access_numeric`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.handle_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This parameter indicates whether the detected access was attempt against a process or a thread.</td></tr>
-<tr><td>Example</td><td><code>process</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack.instruction_pointer`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The return address of this stack frame.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack.module_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The path to the DLL/module containing `instruction_pointer`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack_contains_unbacked`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.Ext.call_stack_final_user_module.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The file path of the call_stack_final_user_module.</td></tr>
-<tr><td>Example</td><td><code>C:\Program Files\Example\example.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/api/windows/windows_api_kernel_audit.md b/custom_documentation/doc/new_output/api/windows/windows_api_kernel_audit.md
deleted file mode 100644
index a6f3f28c5..000000000
--- a/custom_documentation/doc/new_output/api/windows/windows_api_kernel_audit.md
+++ /dev/null
@@ -1,703 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when ETW Microsoft-Windows-Kernel-Audit-API-Calls events are generated.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Kernel-Audit-API-Calls" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td>Example</td><td><code>kernel</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.behaviors`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/api/windows/windows_api_tcpip.md b/custom_documentation/doc/new_output/api/windows/windows_api_tcpip.md
deleted file mode 100644
index f56b1b06b..000000000
--- a/custom_documentation/doc/new_output/api/windows/windows_api_tcpip.md
+++ /dev/null
@@ -1,749 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when ETW Microsoft-Windows-TCPIP events are generated.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-TCPIP" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the destination.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td>Example</td><td><code>kernel</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.transport`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>tcp</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>ipv4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.behaviors`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/api/windows/windows_api_threat_intelligence.md b/custom_documentation/doc/new_output/api/windows/windows_api_threat_intelligence.md
deleted file mode 100644
index c40afd523..000000000
--- a/custom_documentation/doc/new_output/api/windows/windows_api_threat_intelligence.md
+++ /dev/null
@@ -1,1228 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when ETW Threat-Intelligence events are generated.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Threat-Intelligence" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.created_suspended`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td>Example</td><td><code>kernel</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.behaviors`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.target_address_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the memory region targeted by the API call.</td></tr>
-<tr><td>Example</td><td><code>Unbacked</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.target_address_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The path of the memory region targeted by the API call.</td></tr>
-<tr><td>Example</td><td><code>C:\programdata\example.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The target memory address.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.allocation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td></tr>
-<tr><td>Example</td><td><code>COMMIT|RESERVE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.argument1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The first argument to the procedure.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.argument2`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The second argument to the procedure.</td></tr>
-<tr><td>Example</td><td><code>2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.argument3`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The third argument to the procedure.</td></tr>
-<tr><td>Example</td><td><code>3</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.context_flags`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`</td></tr>
-<tr><td>Example</td><td><code>1048607</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.desired_access`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.desired_access_numeric`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.device`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the device object.</td></tr>
-<tr><td>Example</td><td><code>\Device\NPCAP</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.driver`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the driver object.</td></tr>
-<tr><td>Example</td><td><code>\Driver\npcap</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.eax`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.ebp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x86 EBP frame pointer register.</td></tr>
-<tr><td>Example</td><td><code>15006644</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.ebx`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x86 EBX general purpose register.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.ecx`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x86 ECX general purpose register. First argument in __fastcall and __thiscall.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.edi`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x86 EDI general purpose register.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.edx`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x86 EDX general purpose register. Second argument in a __fastcall.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.eip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x86 EIP instruction pointer register.</td></tr>
-<tr><td>Example</td><td><code>1472790528</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.esi`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x86 ESI general purpose register.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.esp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x86 ESP stack pointer register.</td></tr>
-<tr><td>Example</td><td><code>15007744</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.handle_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This parameter indicates whether the detected access was attempt against a process or a thread.</td></tr>
-<tr><td>Example</td><td><code>process</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.procedure`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The memory address of the procedure or function.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td>Example</td><td><code>RWX|GUARD</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.protection_old`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td>Example</td><td><code>RCX</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.r8`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 R8 general purpose register. Third argument in a __fastcall.</td></tr>
-<tr><td>Example</td><td><code>3</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.r9`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 R9 general purpose register. Fourth argument in a __fastcall.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.rax`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 RAX general purpose register. Return value in a __fastcall.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.rbp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 RBP general purpose register.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.rbx`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 RBX general purpose register.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.rcx`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 RCX general purpose register. First argument in a __fastcall.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.rdi`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 RDI general purpose register.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.rdx`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 RDX general purpose register. Second argument in a __fastcall.</td></tr>
-<tr><td>Example</td><td><code>2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.rip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 RIP instruction pointer register.</td></tr>
-<tr><td>Example</td><td><code>140706153693184</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.rsi`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 RSI general purpose register.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.rsp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The x64 RSP stack pointer register.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The size.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/api/windows/windows_api_win32k.md b/custom_documentation/doc/new_output/api/windows/windows_api_win32k.md
deleted file mode 100644
index 00779f3f2..000000000
--- a/custom_documentation/doc/new_output/api/windows/windows_api_win32k.md
+++ /dev/null
@@ -1,1013 +0,0 @@
-# Windows Win32k API
-
-## Description
-
-This event is generated when keylogging-related Win32k APIs are called.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-Win32k" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td>Example</td><td><code>kernel</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.behaviors`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.background_callcount`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.</td></tr>
-<tr><td>Example</td><td><code>6021</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.ms_since_last_keyevent`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.</td></tr>
-<tr><td>Example</td><td><code>94</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.procedure_symbol`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Summary of the hook procedure.</td></tr>
-<tr><td>Example</td><td><code>taskbar.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.return_value`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Return value of RegisterRawInputDevices API call.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.start_address_allocation_protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Memory protection attributes associated with the starting address of a thread.</td></tr>
-<tr><td>Example</td><td><code>RCX</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.start_address_module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module associated with the starting address of a thread.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\DellTPad\ApMsgFwd.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.target_address_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the memory region targeted by the API call.</td></tr>
-<tr><td>Example</td><td><code>Unbacked</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.target_address_path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The path of the memory region targeted by the API call.</td></tr>
-<tr><td>Example</td><td><code>C:\programdata\example.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.thread_info_flags`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread info flags.</td></tr>
-<tr><td>Example</td><td><code>16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.visible_windows_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of visible windows owned by the caller thread.</td></tr>
-<tr><td>Example</td><td><code>0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.windows_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of windows owned by the caller thread.</td></tr>
-<tr><td>Example</td><td><code>2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The target memory address.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.allocation_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`</td></tr>
-<tr><td>Example</td><td><code>COMMIT|RESERVE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.flags`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.</td></tr>
-<tr><td>Example</td><td><code>INPUTSINK</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.hook_module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>DLL containing the hook procedure.</td></tr>
-<tr><td>Example</td><td><code>c:\windows\system32\taskbar.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.hook_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of hook procedure to be installed.</td></tr>
-<tr><td>Example</td><td><code>WH_KEYBOARD_LL</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.procedure`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The memory address of the procedure or function.</td></tr>
-<tr><td>Example</td><td><code>2431737462784</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td>Example</td><td><code>RWX|GUARD</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.protection_old`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`</td></tr>
-<tr><td>Example</td><td><code>RCX</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The size.</td></tr>
-<tr><td>Example</td><td><code>4096</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.usage`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.</td></tr>
-<tr><td>Example</td><td><code>KEYBOARD</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.usage_page`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.</td></tr>
-<tr><td>Example</td><td><code>GENERIC</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/api/windows/windows_api_wmi.md b/custom_documentation/doc/new_output/api/windows/windows_api_wmi.md
deleted file mode 100644
index 1f6b63b83..000000000
--- a/custom_documentation/doc/new_output/api/windows/windows_api_wmi.md
+++ /dev/null
@@ -1,879 +0,0 @@
-# Windows API
-
-## Description
-
-This event is generated when WMI Activity-related APIs are called.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.api-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.api" and event.module : "endpoint" and event.provider : "Microsoft-Windows-WMI-Activity" and host.os.type : "windows"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Source of the event.  Event transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).</td></tr>
-<tr><td>Example</td><td><code>kernel</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.behaviors`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A list of observed behaviors.    "cross-process" - the observed activity was between two processes    "parent-child" - the observed activity was between a parent process and its child    "native_api" - a call was made directly to the Native API rather than the Win32 API    "direct_syscall" - a syscall instruction originated outside of the Native API layer    "proxy_call" - the call stack may indicate of a proxied API call to mask the true source    "sensitive_api" - executable non-image memory is unexpectedly calling a sensitive API    "shellcode" - suspicious executable non-image memory is calling a sensitive API    "image_hooked" - an entry in the callstack appears to have been hooked    "image_indirect_call" - an entry in the callstack was preceded by a call to a dynamically resolved function    "image_rop" - no call instruction preceded an entry in the call stack    "image_rwx" - an entry in the callstack is writable    "unbacked_rwx" - an entry in the callstack is non-image and writable    "truncated_stack" - call stack is unexpected truncated due to malicious tampering or system load    "allocate_shellcode" - a region of non-image executable memory allocated more executable memory    "execute_fluctuation" - the PAGE_EXECUTE protection is unexpectedly fluctuating    "write_fluctuation" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating    "hook_api" - a change to the memory protection of a small executable image memory region was made    "hollow_image" - a change to the memory protection of a large executable image memory region was made    "hook_unbacked" - a change to the memory protection of a small executable non-image memory was made    "hollow_unbacked" - a change to the memory protection of a large executable non-image memory was made    "guarded_code" - executable memory was unexpectedly marked as PAGE_GUARD    "hidden_code" - executable memory was unexpectedly marked as PAGE_NOACCESS    "execute_shellcode" - a region of non-image executable memory was unexpectedly transferred control    "hardware_breakpoint_set" - a hardware breakpoint was set    "rapid_background_polling" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed    "multiple_polling_processes" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed    "pid_spoofing" - The acting process details may have been spoofed to hide the true origin    "legacy_api" - a deprecated or superseded API was called</td></tr>
-<tr><td>Example</td><td><code>[ "cross-process", "rapid_background_polling", "multiple_polling_processes", "native_api", "shellcode" ]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.client_is_local`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.client_machine`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Client process's machine name (provided by the client and potentially untrustworthy).</td></tr>
-<tr><td>Example</td><td><code>DESKTOP-EXAMPLE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.client_machine_fqdn`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Client process's machine name FQDN (provided by the client and potentially untrustworthy).</td></tr>
-<tr><td>Example</td><td><code>DESKTOP-EXAMPLE.elastic.co</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.metadata.client_process_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Client process id</td></tr>
-<tr><td>Example</td><td><code>3600</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name of the API, usually the name of the function or system call.</td></tr>
-<tr><td>Example</td><td><code>VirtualAlloc</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.consumer_details`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.consumer_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.</td></tr>
-<tr><td>Example</td><td><code>ExampleConsumer</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.consumer_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An example list of consumer type.    "ActiveScriptEventConsumer" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.    "CommandLineEventConsumer" - Launches an arbitrary process in the local system context when an event is delivered to it.    "LogFileEventConsumer" - Writes customized strings to a text log file when events are delivered to it.    "NTEventLogEventConsumer" - Logs a specific message to the Windows event log when an event is delivered to it.    "SMTPEventConsumer" - Sends an email message using SMTP each time an event is delivered to it.</td></tr>
-<tr><td>Example</td><td><code>CommandLineEventConsumer</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.event_filter_details`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Provide an overview of the query that define when an event should be triggered.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.event_filter_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.</td></tr>
-<tr><td>Example</td><td><code>ExampleFilter</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>WMI namespace to which the connection is made.</td></tr>
-<tr><td>Example</td><td><code>root\Microsoft\Windows\DeviceGuard</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.parameters.operation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Specifies the connection or request to WMI</td></tr>
-<tr><td>Example</td><td><code>Win32_Process::Create</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.api.summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The summary of the API call and its parameters.</td></tr>
-<tr><td>Example</td><td><code>VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/linux/linux_file_create.md b/custom_documentation/doc/new_output/file/linux/linux_file_create.md
deleted file mode 100644
index 864bb08d5..000000000
--- a/custom_documentation/doc/new_output/file/linux/linux_file_create.md
+++ /dev/null
@@ -1,698 +0,0 @@
-# Linux File Create
-
-## Description
-
-This event is generated when a file is created.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "creation"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/linux/linux_file_delete.md b/custom_documentation/doc/new_output/file/linux/linux_file_delete.md
deleted file mode 100644
index 5cef18b3a..000000000
--- a/custom_documentation/doc/new_output/file/linux/linux_file_delete.md
+++ /dev/null
@@ -1,687 +0,0 @@
-# Linux File Delete
-
-## Description
-
-This event is generated when a file is deleted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "deletion"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/linux/linux_file_endpoint_unquarantine.md b/custom_documentation/doc/new_output/file/linux/linux_file_endpoint_unquarantine.md
deleted file mode 100644
index 96e9f95c2..000000000
--- a/custom_documentation/doc/new_output/file/linux/linux_file_endpoint_unquarantine.md
+++ /dev/null
@@ -1,497 +0,0 @@
-# Linux Malware Unquarantine
-
-## Description
-
-This event is generated when Endpoint restores a file from the malware quarantine.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "endpoint_unquarantine"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.Ext.correlation.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/linux/linux_file_rename.md b/custom_documentation/doc/new_output/file/linux/linux_file_rename.md
deleted file mode 100644
index a00aae414..000000000
--- a/custom_documentation/doc/new_output/file/linux/linux_file_rename.md
+++ /dev/null
@@ -1,731 +0,0 @@
-# Linux File Rename
-
-## Description
-
-This event is generated when a file is renamed.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "linux" and event.action : "rename"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file extension prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file name prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/macos/macos_file_access.md b/custom_documentation/doc/new_output/file/macos/macos_file_access.md
deleted file mode 100644
index 841efa4bf..000000000
--- a/custom_documentation/doc/new_output/file/macos/macos_file_access.md
+++ /dev/null
@@ -1,606 +0,0 @@
-# macOS File Rename
-
-## Description
-
-This event is generated when a file is accessed.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "open"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.inode`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td>Example</td><td><code>256383</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/macos/macos_file_delete.md b/custom_documentation/doc/new_output/file/macos/macos_file_delete.md
deleted file mode 100644
index f203d5040..000000000
--- a/custom_documentation/doc/new_output/file/macos/macos_file_delete.md
+++ /dev/null
@@ -1,783 +0,0 @@
-# macOS File Delete
-
-## Description
-
-This event is generated when a file is deleted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "deletion"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.inode`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td>Example</td><td><code>256383</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/macos/macos_file_endpoint_unquarantine.md b/custom_documentation/doc/new_output/file/macos/macos_file_endpoint_unquarantine.md
deleted file mode 100644
index 7cf69c607..000000000
--- a/custom_documentation/doc/new_output/file/macos/macos_file_endpoint_unquarantine.md
+++ /dev/null
@@ -1,497 +0,0 @@
-# macOS Malware Unquarantine
-
-## Description
-
-This event is generated when Endpoint restores a file from the malware quarantine.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "endpoint_unquarantine"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.Ext.correlation.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/macos/macos_file_extended_attributes_delete.md b/custom_documentation/doc/new_output/file/macos/macos_file_extended_attributes_delete.md
deleted file mode 100644
index 8e41054ef..000000000
--- a/custom_documentation/doc/new_output/file/macos/macos_file_extended_attributes_delete.md
+++ /dev/null
@@ -1,782 +0,0 @@
-# macOS File Extended Attributes Delete
-
-## Description
-
-This event is generated when extended file attributes are deleted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "extended_attributes_delete"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of file attributes.  Attributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.</td></tr>
-<tr><td>Example</td><td><code>["readonly", "system"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.inode`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td>Example</td><td><code>256383</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/macos/macos_file_launch_daemon.md b/custom_documentation/doc/new_output/file/macos/macos_file_launch_daemon.md
deleted file mode 100644
index dab2dc295..000000000
--- a/custom_documentation/doc/new_output/file/macos/macos_file_launch_daemon.md
+++ /dev/null
@@ -1,754 +0,0 @@
-# macOS Launch Daemon
-
-## Description
-
-This event includes information about a macOS Launch Daemon.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "launch_daemon"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Persistence.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Arguments used to execute the persistence item</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Persistence.keepalive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Keep alive option boolean</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Persistence.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The persistence item's name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Persistence.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The file's path</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Persistence.runatload`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Run at load option boolean</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/macos/macos_file_modification.md b/custom_documentation/doc/new_output/file/macos/macos_file_modification.md
deleted file mode 100644
index 7e8ab07bb..000000000
--- a/custom_documentation/doc/new_output/file/macos/macos_file_modification.md
+++ /dev/null
@@ -1,805 +0,0 @@
-# macOS File Modification
-
-## Description
-
-This event is generated when a file is modified.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "modification"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.header_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.inode`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td>Example</td><td><code>256383</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/macos/macos_file_mount.md b/custom_documentation/doc/new_output/file/macos/macos_file_mount.md
deleted file mode 100644
index dfe8edfc3..000000000
--- a/custom_documentation/doc/new_output/file/macos/macos_file_mount.md
+++ /dev/null
@@ -1,746 +0,0 @@
-# macOS Mount
-
-## Description
-
-This event is generated when a file system is mounted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "mount"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.inode`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td>Example</td><td><code>256383</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/macos/macos_file_rename.md b/custom_documentation/doc/new_output/file/macos/macos_file_rename.md
deleted file mode 100644
index 9856fb450..000000000
--- a/custom_documentation/doc/new_output/file/macos/macos_file_rename.md
+++ /dev/null
@@ -1,816 +0,0 @@
-# macOS File Rename
-
-## Description
-
-This event is generated when a file is renamed.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "macos" and event.action : "rename"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file extension prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.inode`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Inode representing the file in the filesystem.</td></tr>
-<tr><td>Example</td><td><code>256383</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/windows/windows_file_create.md b/custom_documentation/doc/new_output/file/windows/windows_file_create.md
deleted file mode 100644
index 147f45c5a..000000000
--- a/custom_documentation/doc/new_output/file/windows/windows_file_create.md
+++ /dev/null
@@ -1,829 +0,0 @@
-# Windows File Create
-
-## Description
-
-This event is generated when a file is created.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "creation"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.entropy`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.header_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.monotonic_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File event monotonic ID.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.windows.zone_identifier`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Windows zone identifier for a file</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.origin_referrer_url`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The url of the webpage that linked to the file.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.origin_url`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The url where the file is hosted.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/windows/windows_file_delete.md b/custom_documentation/doc/new_output/file/windows/windows_file_delete.md
deleted file mode 100644
index 54040450e..000000000
--- a/custom_documentation/doc/new_output/file/windows/windows_file_delete.md
+++ /dev/null
@@ -1,774 +0,0 @@
-# Windows File Delete
-
-## Description
-
-This event is generated when a file is deleted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "deletion"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.entropy`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.monotonic_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File event monotonic ID.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/windows/windows_file_endpoint_unquarantine.md b/custom_documentation/doc/new_output/file/windows/windows_file_endpoint_unquarantine.md
deleted file mode 100644
index c5160c49d..000000000
--- a/custom_documentation/doc/new_output/file/windows/windows_file_endpoint_unquarantine.md
+++ /dev/null
@@ -1,497 +0,0 @@
-# Windows Malware Unquarantine
-
-## Description
-
-This event is generated when Endpoint restores a file from the malware quarantine.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "endpoint_unquarantine"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.Ext.correlation.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/windows/windows_file_modification.md b/custom_documentation/doc/new_output/file/windows/windows_file_modification.md
deleted file mode 100644
index b17a6c91a..000000000
--- a/custom_documentation/doc/new_output/file/windows/windows_file_modification.md
+++ /dev/null
@@ -1,784 +0,0 @@
-# Windows File Modification
-
-## Description
-
-This event is generated when a file is modified.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "modification"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.entropy`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.header_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.monotonic_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File event monotonic ID.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/windows/windows_file_open.md b/custom_documentation/doc/new_output/file/windows/windows_file_open.md
deleted file mode 100644
index 7f5e3e168..000000000
--- a/custom_documentation/doc/new_output/file/windows/windows_file_open.md
+++ /dev/null
@@ -1,796 +0,0 @@
-# Windows File Open
-
-## Description
-
-This event is generated when a file is opened.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "open"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.entropy`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.header_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.monotonic_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File event monotonic ID.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/windows/windows_file_overwrite.md b/custom_documentation/doc/new_output/file/windows/windows_file_overwrite.md
deleted file mode 100644
index 32a414374..000000000
--- a/custom_documentation/doc/new_output/file/windows/windows_file_overwrite.md
+++ /dev/null
@@ -1,784 +0,0 @@
-# Windows File Overwrite
-
-## Description
-
-This event is generated when a file is overwritten
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "overwrite"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.entropy`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.header_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.monotonic_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File event monotonic ID.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/file/windows/windows_file_rename.md b/custom_documentation/doc/new_output/file/windows/windows_file_rename.md
deleted file mode 100644
index b7766f48e..000000000
--- a/custom_documentation/doc/new_output/file/windows/windows_file_rename.md
+++ /dev/null
@@ -1,829 +0,0 @@
-# Windows File Rename
-
-## Description
-
-This event is generated when a file is renamed.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.file-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.file" and event.module : "endpoint" and host.os.type : "windows" and event.action : "rename"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.entropy`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Entropy calculation of file's header and footer used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.header_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>First 16 bytes of file used to check file integrity.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.monotonic_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File event monotonic ID.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file extension prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file name prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.Ext.original.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original file path prior to a modification event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.extension`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File extension, excluding the leading dot.  Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz").</td></tr>
-<tr><td>Example</td><td><code>png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the file including the extension, without the directory.</td></tr>
-<tr><td>Example</td><td><code>example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>File size in bytes.  Only relevant when `file.type` is "file".</td></tr>
-<tr><td>Example</td><td><code>16384</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Thread ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/library/macos/macos_library_load.md b/custom_documentation/doc/new_output/library/macos/macos_library_load.md
deleted file mode 100644
index 6ac69c933..000000000
--- a/custom_documentation/doc/new_output/library/macos/macos_library_load.md
+++ /dev/null
@@ -1,815 +0,0 @@
-# Windows Library Load
-
-## Description
-
-This event is generated when a dynlib is loaded.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.library-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.library" and event.module : "endpoint" and host.os.type : "macos" and event.action : "load"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Size of DLL</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full file path of the library.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/library/windows/windows_library_load.md b/custom_documentation/doc/new_output/library/windows/windows_library_load.md
deleted file mode 100644
index 59a1e53fb..000000000
--- a/custom_documentation/doc/new_output/library/windows/windows_library_load.md
+++ /dev/null
@@ -1,887 +0,0 @@
-# Windows Library Load
-
-## Description
-
-This event is generated when a DLL or driver is loaded.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.library-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.library" and event.module : "endpoint" and host.os.type : "windows" and event.action : "load"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.defense_evasions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.load_index`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.  The first load index is 1.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.relative_file_creation_time`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.relative_file_name_modify_time`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.Ext.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Size of DLL</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the library.  This generally maps to the name of the file on disk.</td></tr>
-<tr><td>Example</td><td><code>kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full file path of the library.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\kernel32.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.pe.file_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal version of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>6.3.9600.17415</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.pe.imphash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
-<tr><td>Example</td><td><code>0c6803c4e922103c4dca5963aad36ddf</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dll.pe.original_file_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/metadata/metadata.md b/custom_documentation/doc/new_output/metadata/metadata.md
deleted file mode 100644
index ebee6220c..000000000
--- a/custom_documentation/doc/new_output/metadata/metadata.md
+++ /dev/null
@@ -1,540 +0,0 @@
-# Endpoint Metadata
-
-## Description
-
-This is a relatively small state management document that includes details about an installed Endpoint.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux, macOS, Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>metrics-endpoint.metadata-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.metadata" and event.module : "endpoint" and event.action : "endpoint_metadata"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.capabilities`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Enabled capabilities</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.configuration.isolation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Configuration setting for Host Isolation from the network</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the status of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.state.isolation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Current network isolation state of the host</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.state.tamper_protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The current status of the endpoint e.g. enrolled, unenrolled.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/metrics/metrics.md b/custom_documentation/doc/new_output/metrics/metrics.md
deleted file mode 100644
index 1c521cd60..000000000
--- a/custom_documentation/doc/new_output/metrics/metrics.md
+++ /dev/null
@@ -1,2086 +0,0 @@
-# Endpoint Metrics
-
-## Description
-
-This is an internal state management document that includes metrics on Endpoint's performance.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux, macOS, Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>metrics-endpoint.metrics-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.metrics" and event.module : "endpoint" and event.action : "endpoint_metrics"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.behavior.rtt`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.behavior.timeout_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.malware_score.rtt`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.malware_score.timeout_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.rtt`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.memory_signature.timeout_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.ransomware.rtt`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.ransomware.timeout_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.rtt`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.reputation_rule.timeout_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.shell_code.rtt`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cloud_services.reputation_lookups.shell_code.timeout_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cpu.endpoint.histogram.counts`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cpu.endpoint.histogram.values`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cpu.endpoint.latest`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Average CPU over the last sample interval</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.cpu.endpoint.mean`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Average CPU load used by the endpoint</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.disks.device`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Device name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.disks.endpoint_drive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This field will be present and set to true only for the drive that holds the installed endpoint</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.disks.free`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The number of bytes marked as free on the disk</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.disks.fstype`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The file system type for the drive</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.disks.mount`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The disks mount location</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.disks.total`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The size of the disk in bytes</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.alerts.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.alerts.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.alerts.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.alerts.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.api_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of API Event sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.api_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent API Event documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.api_events.sources.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of API Event sent documents from source</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.api_events.sources.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent API Event documents from source</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.api_events.sources.source`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>API Event document source name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.api_events.sources.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed API Event documents from source</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.api_events.sources.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed API Event documents from source</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.api_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed API Event documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.api_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed API Event documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.device_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.device_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.device_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.device_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.diagnostic_alerts.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.diagnostic_alerts.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.diagnostic_alerts.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.dns_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.dns_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.dns_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.dns_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.file_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.file_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.file_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.file_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.library_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.library_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.library_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.library_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.network_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.network_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.network_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.network_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.overall.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.overall.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.overall.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.overall.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.process_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.process_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.process_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.process_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.registry_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.registry_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.registry_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.registry_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.security_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.security_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of sent documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.security_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Total size of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.security_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of suppressed documents</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.volume_device_events.sent_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.volume_device_events.sent_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.volume_device_events.suppressed_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.documents_volume.volume_device_events.suppressed_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.event_filter.active_global_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The number of active global event filters</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.event_filter.active_user_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The number of active user event filters</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.malicious_behavior_rules.endpoint_uptime_percent`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Perfect of Endpoint's update spent running the rule</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.malicious_behavior_rules.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The rule id</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.memory.endpoint.private.latest`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The memory usage by the endpoint for the last sample interval</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.memory.endpoint.private.mean`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Average memory usage by the endpoint since its start</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.amsi_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.amsi_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.attack_surface_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.attack_surface_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.authentication_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing authentication events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.authentication_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on authentication events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.behavior_protection.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.behavior_protection.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.cred_access_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.cred_access_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.diagnostic_behavior_protection.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.dns_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing DNS events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.dns_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on DNS events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.file_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing file events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.file_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on file events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.kernel_api_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.kernel_api_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.library_load_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing library load events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.library_load_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on library load events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.malware.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing malware scanning due to the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.malware.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on malware scanning due to the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.memory_scan.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.memory_scan.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.network_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing network events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.network_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on network events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.overall.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing activity for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.overall.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent monitoring the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>'The identifier used to sign the binary.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>'The team identifier used to sign the binary.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Path to the process executable for the impact entry</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing process events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on process events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process_injection.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.process_injection.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.ransomware.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.ransomware.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.registry_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing registry events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.registry_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on registry events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.tcpip_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.tcpip_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.threat_intelligence_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.threat_intelligence_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.volume_device_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.volume_device_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.win32k_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.win32k_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.wmi_events.week_idle_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.system_impact.wmi_events.week_ms`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.threads.cpu.mean`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The thread's average CPU use</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.threads.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The thread name</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.top_process_trees.values.event_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.top_process_trees.values.last_seen`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.top_process_trees.values.sample.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.top_process_trees.values.sample.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.top_process_trees.values.sample.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.top_process_trees.values.sample.parent_command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.top_process_trees.window_end`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.top_process_trees.window_start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.uptime.endpoint`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of seconds since the endpoint was started</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.metrics.uptime.system`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of seconds since the system was started</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/network/linux/linux_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/new_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
deleted file mode 100644
index d4c1f8c37..000000000
--- a/custom_documentation/doc/new_output/network/linux/linux_network_attempted_accepted_and_disconnect.md
+++ /dev/null
@@ -1,824 +0,0 @@
-# Linux Network Connection Attempted, Connection Accepted, and Disconnect
-
-## Description
-
-This event is generated when a network session is accepted, attempted or terminated.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "linux" and event.action : "connection_attempted" or "connection_accepted" or "disconnect_received"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Bytes sent from the destination to the source.</td></tr>
-<tr><td>Example</td><td><code>184</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the destination.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.direction`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td></tr>
-<tr><td>Example</td><td><code>inbound</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.transport`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>tcp</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>ipv4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.effective`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.permitted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Bytes sent from the source to the destination.</td></tr>
-<tr><td>Example</td><td><code>184</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the source.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/network/linux/linux_network_dns_lookup_result.md b/custom_documentation/doc/new_output/network/linux/linux_network_dns_lookup_result.md
deleted file mode 100644
index 2c1ebe4aa..000000000
--- a/custom_documentation/doc/new_output/network/linux/linux_network_dns_lookup_result.md
+++ /dev/null
@@ -1,622 +0,0 @@
-# Linux DNS Lookup Result
-
-## Description
-
-This event is generated when results are returned for a DNS lookup request.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "linux" and event.action : "lookup_result"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the destination.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.question.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
-<tr><td>Example</td><td><code>www.example.com</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.question.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The type of record being queried.</td></tr>
-<tr><td>Example</td><td><code>AAAA</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.resolved_ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
-<tr><td>Example</td><td><code>["10.10.10.10", "10.10.10.11"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.protocol`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>http</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.transport`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>tcp</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.effective`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.permitted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the source.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/network/macos/macos_network_connection_attempted_and_disconnect.md b/custom_documentation/doc/new_output/network/macos/macos_network_connection_attempted_and_disconnect.md
deleted file mode 100644
index 3247bdfb4..000000000
--- a/custom_documentation/doc/new_output/network/macos/macos_network_connection_attempted_and_disconnect.md
+++ /dev/null
@@ -1,801 +0,0 @@
-# macOS Network Connection Attempted and Disconnect Received
-
-## Description
-
-This event is generated when a connection is attempted or a request to terminate a network connection occurs.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "macos" and event.action : "connection_attempted" or "disconnect_received"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Bytes sent from the destination to the source.</td></tr>
-<tr><td>Example</td><td><code>184</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The domain name of the destination system.  This value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.</td></tr>
-<tr><td>Example</td><td><code>foo.example.com</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the destination.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.transport`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>tcp</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>ipv4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Bytes sent from the source to the destination.</td></tr>
-<tr><td>Example</td><td><code>184</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the source.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/network/macos/macos_network_dns_lookup_result.md b/custom_documentation/doc/new_output/network/macos/macos_network_dns_lookup_result.md
deleted file mode 100644
index f33250493..000000000
--- a/custom_documentation/doc/new_output/network/macos/macos_network_dns_lookup_result.md
+++ /dev/null
@@ -1,835 +0,0 @@
-# macOS DNS Lookup Result
-
-## Description
-
-This event is generated when results are returned for a DNS lookup request.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "macos" and event.action : "lookup_result"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the destination.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.Ext.options`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.Ext.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>DNS status field, uint32</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.question.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
-<tr><td>Example</td><td><code>www.example.com</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.question.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The type of record being queried.</td></tr>
-<tr><td>Example</td><td><code>AAAA</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.resolved_ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
-<tr><td>Example</td><td><code>["10.10.10.10", "10.10.10.11"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.protocol`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>http</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.transport`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>tcp</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>ipv4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the source.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/network/windows/windows_network_attempted_accepted_and_disconnect.md b/custom_documentation/doc/new_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
deleted file mode 100644
index 5718edec4..000000000
--- a/custom_documentation/doc/new_output/network/windows/windows_network_attempted_accepted_and_disconnect.md
+++ /dev/null
@@ -1,758 +0,0 @@
-# Windows Network Connection Attempted, Connection Accepted and Disconnect Received
-
-## Description
-
-This event is generated when a connection is attempted, a connection is accepted, or a request to terminate a network session is received.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "connection_attempted" or "connection_accepted" or "disconnect_received"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Bytes sent from the destination to the source.</td></tr>
-<tr><td>Example</td><td><code>184</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the destination (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the destination.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.direction`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Direction of the network traffic.  When mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values "ingress" or "egress".  When mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values "inbound", "outbound", "internal" or "external".  Note that "internal" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that "external" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.</td></tr>
-<tr><td>Example</td><td><code>inbound</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.transport`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>tcp</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>ipv4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.uptime`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Seconds the process has been up.</td></tr>
-<tr><td>Example</td><td><code>1325</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.  Then it should be duplicated to `.ip` or `.domain`, depending on which one it is.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Bytes sent from the source to the destination.</td></tr>
-<tr><td>Example</td><td><code>184</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `source.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the source.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_requested.md b/custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_requested.md
deleted file mode 100644
index 26904d43a..000000000
--- a/custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_requested.md
+++ /dev/null
@@ -1,688 +0,0 @@
-# Windows DNS Lookup Request
-
-## Description
-
-This event is generated when a DNS lookup request is initiated.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "lookup_requested"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the destination.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.Ext.options`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.Ext.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>DNS status field, uint32</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.question.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
-<tr><td>Example</td><td><code>www.example.com</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.protocol`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>http</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_result.md b/custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_result.md
deleted file mode 100644
index d4f4ab234..000000000
--- a/custom_documentation/doc/new_output/network/windows/windows_network_dns_lookup_result.md
+++ /dev/null
@@ -1,700 +0,0 @@
-# Windows DNS Lookup Result
-
-## Description
-
-This event is generated when results are returned for a DNS lookup request.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.network-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.network" and event.module : "endpoint" and host.os.type : "windows" and event.action : "lookup_result"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Port of the destination.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.Ext.options`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>DNS options field, uint64, representing as a keyword to avoid overflows in ES</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.Ext.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>DNS status field, uint32</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.question.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The name being queried.  If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively.</td></tr>
-<tr><td>Example</td><td><code>www.example.com</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `dns.resolved_ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array containing all IPs seen in `answers.data`.  The `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.</td></tr>
-<tr><td>Example</td><td><code>["10.10.10.10", "10.10.10.11"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.destination.port`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `network.protocol`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.  The field value must be normalized to lowercase for querying.</td></tr>
-<tr><td>Example</td><td><code>http</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/policy/policy_response.md b/custom_documentation/doc/new_output/policy/policy_response.md
deleted file mode 100644
index 5a482ae23..000000000
--- a/custom_documentation/doc/new_output/policy/policy_response.md
+++ /dev/null
@@ -1,992 +0,0 @@
-# Endpoint Policy Response
-
-## Description
-
-This is a state management document that is generated every time Endpoint refreshes it's policy. It contains details of what Endpoint features are and are not in a healthy state.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux, macOS, Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>metrics-endpoint.policy-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.policy" and event.module : "endpoint" and event.action : "endpoint_policy_response"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.configuration.isolation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Configuration setting for Host Isolation from the network</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.actions.message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>message about the application of the action to further qualify the status of the action</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.actions.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>name of the action that was applied</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.actions.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the status of the action</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.actions.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the status of the action</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.channel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The channel of the linux artifact.</td></tr>
-<tr><td>Example</td><td><code>stable</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of global artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.snapshot`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the snapshot date of applied global artifacts or 'latest'</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.update_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>number of days since global artifacts were made up-to-date</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.global.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of global artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of user artifact applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.identifiers.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the sha256 of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.artifacts.user.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of user artifacts applied.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.endpoint_policy_version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the id of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the name of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.antivirus_registration.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for antivirus registration</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.antivirus_registration.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.attack_surface_reduction.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for attack surface reduction</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.attack_surface_reduction.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.behavior_protection.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for behavior_protection</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.behavior_protection.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.events.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for event collection</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.events.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.host_isolation.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for host isolation</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.host_isolation.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.logging.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for logging</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.logging.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.malware.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for malware</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.malware.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.memory_protection.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for memory_protection</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.memory_protection.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.ransomware.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for ransomware</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.ransomware.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.response_actions.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.response_actions.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.streaming.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for data streaming</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.configurations.streaming.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.diagnostic.behavior_protection.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for the diagnostic configuration of behavior protection</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.diagnostic.behavior_protection.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.diagnostic.malware.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for the diagnostic configuration of malware</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.diagnostic.malware.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.diagnostic.memory_protection.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for the diagnostic configuration of memory protection</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.diagnostic.memory_protection.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.diagnostic.ransomware.concerned_actions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>all actions that were taken for the diagnostic configuration of ransomware</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.response.diagnostic.ransomware.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the status of the applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.policy.applied.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>the version of this applied policy</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.state.isolation`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Current network isolation state of the host</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Endpoint.state.tamper_protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.build.original`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Extended build information for the agent.  This field is intended to contain any build information that a data source may provide, no specific formatting is required.</td></tr>
-<tr><td>Example</td><td><code>metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/linux/linux_process_already_running.md b/custom_documentation/doc/new_output/process/linux/linux_process_already_running.md
deleted file mode 100644
index 83765000e..000000000
--- a/custom_documentation/doc/new_output/process/linux/linux_process_already_running.md
+++ /dev/null
@@ -1,2201 +0,0 @@
-# Linux Already Running Process
-
-## Description
-
-This event is generated for a process that was already running before Endpoint's process collection was enabled.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "already_running"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.account.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td>Example</td><td><code>666777888999</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.effective`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.permitted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/linux/linux_process_fork_exec_exit.md b/custom_documentation/doc/new_output/process/linux/linux_process_fork_exec_exit.md
deleted file mode 100644
index a196ada1a..000000000
--- a/custom_documentation/doc/new_output/process/linux/linux_process_fork_exec_exit.md
+++ /dev/null
@@ -1,2248 +0,0 @@
-# Linux Process Fork, Exec, and Exit
-
-## Description
-
-This event is generated when a process calls `fork()`, `exec()`, exits, or an aggregation of the previous.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "fork" or "exec" or "end"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.account.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td>Example</td><td><code>666777888999</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted_descendant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.end`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process ended.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.env_vars`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.exit_code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td>Example</td><td><code>137</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.effective`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.permitted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/linux/linux_process_gid_change.md b/custom_documentation/doc/new_output/process/linux/linux_process_gid_change.md
deleted file mode 100644
index 0832743c8..000000000
--- a/custom_documentation/doc/new_output/process/linux/linux_process_gid_change.md
+++ /dev/null
@@ -1,2225 +0,0 @@
-# Linux Process Group ID Change
-
-## Description
-
-This event is generated when the group id changes for a process.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "gid_change"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.account.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td>Example</td><td><code>666777888999</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted_descendant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.end`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process ended.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.exit_code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td>Example</td><td><code>137</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.effective`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.permitted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/linux/linux_process_memfd_create.md b/custom_documentation/doc/new_output/process/linux/linux_process_memfd_create.md
deleted file mode 100644
index 2e0636889..000000000
--- a/custom_documentation/doc/new_output/process/linux/linux_process_memfd_create.md
+++ /dev/null
@@ -1,2271 +0,0 @@
-# Linux memfd Creation Events
-
-## Description
-
-This event is generated when when a memfd anonymous file is created.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "memfd_create"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.account.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td>Example</td><td><code>666777888999</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted_descendant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memfd.flag_hugetlb`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The anonymous file will be created in the hugetlbfs filesystem using huge pages.</td></tr>
-<tr><td>Example</td><td><code>false</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memfd.flag_allow_seal`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Allow sealing operations on this file.</td></tr>
-<tr><td>Example</td><td><code>false</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memfd.flags`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Flags passed to the memfd operation.</td></tr>
-<tr><td>Example</td><td><code>2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memfd.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Filename for the created file. Appears in /proc/self/fd.</td></tr>
-<tr><td>Example</td><td><code>anon.txt</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memfd.flag_exec`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Exec flag is set for file.</td></tr>
-<tr><td>Example</td><td><code>false</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memfd.flag_cloexec`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sets the the close-on-exec flag on the new file descriptor.</td></tr>
-<tr><td>Example</td><td><code>false</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.memfd.flag_noexec_seal`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sets both NOEXEC and MFD_ALLOW_SEALING.</td></tr>
-<tr><td>Example</td><td><code>false</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.end`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process ended.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.exit_code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td>Example</td><td><code>137</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/linux/linux_process_ptrace.md b/custom_documentation/doc/new_output/process/linux/linux_process_ptrace.md
deleted file mode 100644
index fb0a1cdbf..000000000
--- a/custom_documentation/doc/new_output/process/linux/linux_process_ptrace.md
+++ /dev/null
@@ -1,2221 +0,0 @@
-# Linux ptrace_attach Creation Events
-
-## Description
-
-This event is generated when when a process calls ptrace_attach on another process.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "ptrace"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.account.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td>Example</td><td><code>666777888999</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted_descendant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ptrace.child_pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>PID of the ptrace target.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ptrace.request`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ptrace request.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.end`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process ended.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.env_vars`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.exit_code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td>Example</td><td><code>137</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/linux/linux_process_session_id_change.md b/custom_documentation/doc/new_output/process/linux/linux_process_session_id_change.md
deleted file mode 100644
index e77ff310a..000000000
--- a/custom_documentation/doc/new_output/process/linux/linux_process_session_id_change.md
+++ /dev/null
@@ -1,2179 +0,0 @@
-# Linux Session ID Change
-
-## Description
-
-This event is generated when a process's session id changes.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "session_id_change"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.account.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td>Example</td><td><code>666777888999</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.effective`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.permitted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/linux/linux_process_shmget.md b/custom_documentation/doc/new_output/process/linux/linux_process_shmget.md
deleted file mode 100644
index b9712acf7..000000000
--- a/custom_documentation/doc/new_output/process/linux/linux_process_shmget.md
+++ /dev/null
@@ -1,2221 +0,0 @@
-# Linux shmget Creation Events
-
-## Description
-
-This event is generated when when a process calls shmget().
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "shmget"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.account.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td>Example</td><td><code>666777888999</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted_descendant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.shmget.size`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Requested size.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.shmget.flags`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>flags passed to shmget.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.shmget.key`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Key passed to the shmget request.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.end`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process ended.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.env_vars`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.exit_code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td>Example</td><td><code>137</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/linux/linux_process_text_output.md b/custom_documentation/doc/new_output/process/linux/linux_process_text_output.md
deleted file mode 100644
index 6af534905..000000000
--- a/custom_documentation/doc/new_output/process/linux/linux_process_text_output.md
+++ /dev/null
@@ -1,2244 +0,0 @@
-# Linux Process Text Output
-
-## Description
-
-This event is generated when a process generates text output.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "text_output"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.io.bytes_skipped.length`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.io.bytes_skipped.offset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.io.max_bytes_per_process_exceeded`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.io.text`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A chunk of output or input sanitized to UTF-8.  Best efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.io.total_bytes_captured`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total number of bytes captured in this event.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.io.total_bytes_skipped`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.io.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.effective`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.permitted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.columns`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The number of character columns per line. e.g terminal width  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td></tr>
-<tr><td>Example</td><td><code>80</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.rows`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The number of character rows in the terminal. e.g terminal height  Terminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'</td></tr>
-<tr><td>Example</td><td><code>24</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/linux/linux_process_uid_change.md b/custom_documentation/doc/new_output/process/linux/linux_process_uid_change.md
deleted file mode 100644
index 2839c1011..000000000
--- a/custom_documentation/doc/new_output/process/linux/linux_process_uid_change.md
+++ /dev/null
@@ -1,2235 +0,0 @@
-# Linux Process User ID Change
-
-## Description
-
-This event is generated when the user id changes for a process.
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Linux</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "linux" and event.action : "uid_change"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.account.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud account or organization id used to identify different entities in a multi-tenant environment.  Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.</td></tr>
-<tr><td>Example</td><td><code>666777888999</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.instance.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Instance name of the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.project.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The cloud project identifier.  Examples: Google Cloud Project id, Azure Project id.</td></tr>
-<tr><td>Example</td><td><code>my-project</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.provider`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.</td></tr>
-<tr><td>Example</td><td><code>aws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `cloud.region`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Region in which this host, resource, or service is located.</td></tr>
-<tr><td>Example</td><td><code>us-east-1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique container id.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.hash.all`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.</td></tr>
-<tr><td>Example</td><td><code>[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the image the container was built on.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.image.tag`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container image tags.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `container.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Container name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.cluster.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the cluster.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Namespace in which the action is taking place.</td></tr>
-<tr><td>Example</td><td><code>kube-system</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>test-pod-cdcws</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.parent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).</td></tr>
-<tr><td>Example</td><td><code>DaemonSet</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `orchestrator.resource.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of resource being acted upon.</td></tr>
-<tr><td>Example</td><td><code>service</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted_descendant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.end`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process ended.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.source.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>IP address of the source (IPv4 or IPv6).</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.entry_meta.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console  Note: This field is only set on process.session_leader.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entry_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.exit_code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td>Example</td><td><code>137</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.group_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.previous.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.interactive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether the process is connected to an interactive shell.  Process interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.  Note: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.real_user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.same_as_process`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This boolean is used to identify if a leader process is the same as the top level process.  For example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.  This field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)  Instead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`  Note: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.session_leader.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.start`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The time the process started.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.supplemental_groups.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.effective`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is the set of capabilities used by the kernel to perform permission checks for the thread.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.thread.capabilities.permitted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is a limiting superset for the effective capabilities that the thread may assume.</td></tr>
-<tr><td>Example</td><td><code>["CAP_BPF", "CAP_SYS_ADMIN"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.major`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as "ttyS0" and "pts/0". For more details, please refer to the Linux kernel documentation.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.tty.char_device.minor`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.</td></tr>
-<tr><td>Example</td><td><code>1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/macos/macos_process_already_running.md b/custom_documentation/doc/new_output/process/macos/macos_process_already_running.md
deleted file mode 100644
index 9186b2f07..000000000
--- a/custom_documentation/doc/new_output/process/macos/macos_process_already_running.md
+++ /dev/null
@@ -1,791 +0,0 @@
-# macOS Already Running Process
-
-## Description
-
-This event is generated for a process that was already running before Endpoint's process event collection was enabled.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "already_running"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.env_vars`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/macos/macos_process_fork_exec_exit.md b/custom_documentation/doc/new_output/process/macos/macos_process_fork_exec_exit.md
deleted file mode 100644
index ff2b3c373..000000000
--- a/custom_documentation/doc/new_output/process/macos/macos_process_fork_exec_exit.md
+++ /dev/null
@@ -1,1005 +0,0 @@
-# macOS Process Fork, Exec, and Exit
-
-## Description
-
-This event is generated when a process calls `fork()`, `exec()`, or exits.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "fork" or "exec" or "end"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted_descendant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.env_vars`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.exit_code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td>Example</td><td><code>137</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/macos/macos_process_remote_thread.md b/custom_documentation/doc/new_output/process/macos/macos_process_remote_thread.md
deleted file mode 100644
index 7c5904ee5..000000000
--- a/custom_documentation/doc/new_output/process/macos/macos_process_remote_thread.md
+++ /dev/null
@@ -1,946 +0,0 @@
-# macOS Remote Thread
-
-## Description
-
-This event is generated when a remote thread is created.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "macos" and event.action : "remote_thread"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the group on the system/platform.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `group.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the group.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.env_vars`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["PATH=/usr/local/bin:/usr/bin", "USER=ubuntu"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>One or multiple unique identifiers of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.Ext.real.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/windows/windows_process_already_running.md b/custom_documentation/doc/new_output/process/windows/windows_process_already_running.md
deleted file mode 100644
index c7d85917a..000000000
--- a/custom_documentation/doc/new_output/process/windows/windows_process_already_running.md
+++ /dev/null
@@ -1,1084 +0,0 @@
-# Windows Already Running Process
-
-## Description
-
-This event is generated for a process that was already running before Endpoint's process collection was enabled.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "windows" and event.action : "already_running"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.mitigation_policies`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.relative_file_creation_time`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.authentication_package`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.client_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Client's IPv4 or IPv6 address as a string, if available.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.logon_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.relative_logon_time`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process creation time, relative to logon time, in seconds.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.relative_password_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process creation time, relative to the last time the password was changed, in seconds.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.user_flags`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation_level`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>What level of elevation the token has</td></tr>
-<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.security_attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td></tr>
-<tr><td>Example</td><td><code>TSA://ProcUnique, LUA://DecHdAutoAp</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.imphash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
-<tr><td>Example</td><td><code>0c6803c4e922103c4dca5963aad36ddf</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.original_file_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/process/windows/windows_process_create_and_exit.md b/custom_documentation/doc/new_output/process/windows/windows_process_create_and_exit.md
deleted file mode 100644
index 6becb05e4..000000000
--- a/custom_documentation/doc/new_output/process/windows/windows_process_create_and_exit.md
+++ /dev/null
@@ -1,1366 +0,0 @@
-# Windows Process Create And Exit
-
-## Description
-
-This event is generated when a process is created or exits.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.process-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.process" and event.module : "endpoint" and host.os.type : "windows" and event.action : "start" or "end"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.created_suspended`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.defense_evasions`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.device.bus_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.device.dos_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,...</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.device.file_system_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Volume device file system type.  Following are examples of the most frequently seen volume device file system types: NTFS UDF</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.device.nt_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>NT name of the device. NT device name is in the format such as: \Device\HarddiskVolume2</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.device.product_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ProductID of the device. It is provided by the vendor of the device if any.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.device.vendor_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>VendorID of the device. It is provided by the vendor of the device.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.device.volume_device_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Volume device type.  Following are examples of the most frequently seen volume device types: Disk File System CD-ROM File System</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.effective_parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.mitigation_policies`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.relative_file_creation_time`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.relative_file_name_modify_time`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.authentication_package`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.client_address`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Client's IPv4 or IPv6 address as a string, if available.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.logon_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.relative_logon_time`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process creation time, relative to logon time, in seconds.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.relative_password_age`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process creation time, relative to the last time the password was changed, in seconds.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.user_flags`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.elevation_level`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>What level of elevation the token has</td></tr>
-<tr><td>Example</td><td><code>one of "default", "full", "limited"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.integrity_level_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Human readable integrity level.</td></tr>
-<tr><td>Example</td><td><code>one of "system", "high", "medium", "low", "untrusted"</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.token.security_attributes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.</td></tr>
-<tr><td>Example</td><td><code>TSA://ProcUnique, LUA://DecHdAutoAp</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.trusted_descendant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Whether or not the process is a descendent of a trusted application</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.exit_code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The exit code of the process, if this is a termination event.  The field should be absent if there is no exit code for the event (e.g. process start).</td></tr>
-<tr><td>Example</td><td><code>137</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.md5`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>MD5 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha1`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA1 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.hash.sha256`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>SHA256 hash.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.real.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.real.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For process.parent this will be the ppid of the process that actually spawned the current process.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Array of process arguments, starting with the absolute path to the executable.  May be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>["/usr/bin/ssh", "-l", "user", "10.0.0.16"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.args_count`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Length of the process.args array.  This field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.</td></tr>
-<tr><td>Example</td><td><code>4</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.command_line`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full command line that started the process, including the absolute path to the executable, and all arguments.  Some arguments may be filtered to protect sensitive information.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh -l user 10.0.0.16</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.Ext.command_line_truncated`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.thread.Ext.call_stack.callsite_leading_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hex opcode bytes preceding the callsite</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.thread.Ext.call_stack.callsite_trailing_bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hex opcode bytes after the callsite (where control will return to)</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.thread.Ext.call_stack.protection`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Protection of the page containing this instruction.  This is `R-X' by default if omitted.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.thread.Ext.call_stack.symbol_info`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The nearest symbol for `instruction_pointer`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.thread.Ext.call_stack_contains_unbacked`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Indicates whether the creating thread's stack contains frames pointing outside any known executable image.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.parent.thread.Ext.call_stack_summary`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Concatentation of the non-repeated modules in the call stack.</td></tr>
-<tr><td>Example</td><td><code>ntdll.dll|example.exe|kernel32.dll|ntdll.dll</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.imphash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.  Learn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.</td></tr>
-<tr><td>Example</td><td><code>0c6803c4e922103c4dca5963aad36ddf</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pe.original_file_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Internal name of the file, provided at compile-time.</td></tr>
-<tr><td>Example</td><td><code>MSPAINT.EXE</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.working_directory`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The working directory of the process.</td></tr>
-<tr><td>Example</td><td><code>/home/alice</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/registry/windows/windows_registry_modification.md b/custom_documentation/doc/new_output/registry/windows/windows_registry_modification.md
deleted file mode 100644
index c53f87215..000000000
--- a/custom_documentation/doc/new_output/registry/windows/windows_registry_modification.md
+++ /dev/null
@@ -1,752 +0,0 @@
-# Windows Registry Modification
-
-## Description
-
-This event is generated when the registry is modified.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.registry-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.registry" and event.module : "endpoint" and host.os.type : "windows" and event.action : "modification"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.data.bytes`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Original bytes written with base64 encoding.  For Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.</td></tr>
-<tr><td>Example</td><td><code>ZQBuAC0AVQBTAAAAZQBuAAAAAAA=</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.data.strings`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Content when writing string types.  Populated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `"1"`).</td></tr>
-<tr><td>Example</td><td><code>["C:\rta\red_ttp\bin\myapp.exe"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.data.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Standard registry type for encoding contents</td></tr>
-<tr><td>Example</td><td><code>REG_SZ</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.hive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Abbreviated name for the hive.</td></tr>
-<tr><td>Example</td><td><code>HKLM</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.key`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hive-relative path of keys.</td></tr>
-<tr><td>Example</td><td><code>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path, including hive, key and value</td></tr>
-<tr><td>Example</td><td><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.value`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the value written.</td></tr>
-<tr><td>Example</td><td><code>Debugger</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/registry/windows/windows_registry_query.md b/custom_documentation/doc/new_output/registry/windows/windows_registry_query.md
deleted file mode 100644
index 576c61bda..000000000
--- a/custom_documentation/doc/new_output/registry/windows/windows_registry_query.md
+++ /dev/null
@@ -1,728 +0,0 @@
-# Windows Registry Query
-
-## Description
-
-This event is generated when the Windows registry is queried.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.registry-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.registry" and event.module : "endpoint" and host.os.type : "windows" and event.action : "query"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the effective process.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Executable name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>C:\Windows\System32\wbem\WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name for the effective process.</td></tr>
-<tr><td>Example</td><td><code>WMIC.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Effective_process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process ID.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.data.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Standard registry type for encoding contents</td></tr>
-<tr><td>Example</td><td><code>REG_SZ</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.hive`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Abbreviated name for the hive.</td></tr>
-<tr><td>Example</td><td><code>HKLM</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.key`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hive-relative path of keys.</td></tr>
-<tr><td>Example</td><td><code>SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path, including hive, key and value</td></tr>
-<tr><td>Example</td><td><code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winword.exe\Debugger</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `registry.value`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the value written.</td></tr>
-<tr><td>Example</td><td><code>Debugger</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/security/macos/macos_security_gatekeeper_override.md b/custom_documentation/doc/new_output/security/macos/macos_security_gatekeeper_override.md
deleted file mode 100644
index 629a9446a..000000000
--- a/custom_documentation/doc/new_output/security/macos/macos_security_gatekeeper_override.md
+++ /dev/null
@@ -1,794 +0,0 @@
-# macOS Gatekeeper Override Exception
-
-## Description
-
-This event is generated when a user grants a gatekeeper exception
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "gatekeeper_override"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `file.path`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Full path to the file, including the file name. It should include the drive letter, when appropriate.</td></tr>
-<tr><td>Example</td><td><code>/home/alice/example.png</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.logon_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.email`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User email address.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.full_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User's full name, if available.</td></tr>
-<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.hash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/security/macos/macos_security_log_on.md b/custom_documentation/doc/new_output/security/macos/macos_security_log_on.md
deleted file mode 100644
index ae2e88ced..000000000
--- a/custom_documentation/doc/new_output/security/macos/macos_security_log_on.md
+++ /dev/null
@@ -1,758 +0,0 @@
-# macOS User Log On
-
-## Description
-
-This event is generated when a user logs on to the computer.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "log_on"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.logon_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.email`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User email address.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.full_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User's full name, if available.</td></tr>
-<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.hash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/security/macos/macos_security_rdp_log_on.md b/custom_documentation/doc/new_output/security/macos/macos_security_rdp_log_on.md
deleted file mode 100644
index d010ac2db..000000000
--- a/custom_documentation/doc/new_output/security/macos/macos_security_rdp_log_on.md
+++ /dev/null
@@ -1,758 +0,0 @@
-# macOS Screensharing Log On
-
-## Description
-
-This event is generated when a user logs on to the computer with screensharing.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "rdp_log_on"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.logon_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.email`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User email address.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.full_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User's full name, if available.</td></tr>
-<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.hash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/security/macos/macos_security_ssh_log_on.md b/custom_documentation/doc/new_output/security/macos/macos_security_ssh_log_on.md
deleted file mode 100644
index 941bba110..000000000
--- a/custom_documentation/doc/new_output/security/macos/macos_security_ssh_log_on.md
+++ /dev/null
@@ -1,758 +0,0 @@
-# macOS SSH Log On
-
-## Description
-
-This event is generated when a user logs on to the computer with SSH.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>macOS</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "macos" and event.action : "ssh_log_on"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.logon_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.signing_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The identifier used to sign the process.  This is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>com.apple.xpc.proxy</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.team_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The team identifier used to sign the process.  This is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.</td></tr>
-<tr><td>Example</td><td><code>EQHXZ8M8AV</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.email`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User email address.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.full_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User's full name, if available.</td></tr>
-<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.hash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/security/windows/windows_security_log_off.md b/custom_documentation/doc/new_output/security/windows/windows_security_log_off.md
deleted file mode 100644
index 5c488c5ee..000000000
--- a/custom_documentation/doc/new_output/security/windows/windows_security_log_off.md
+++ /dev/null
@@ -1,699 +0,0 @@
-# Windows User Log Off
-
-## Description
-
-This event is generated when a user logs off of the computer.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "windows" and event.action : "log_off"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.logon_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.email`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User email address.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.full_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User's full name, if available.</td></tr>
-<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.hash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/security/windows/windows_security_log_on.md b/custom_documentation/doc/new_output/security/windows/windows_security_log_on.md
deleted file mode 100644
index 252e6ae91..000000000
--- a/custom_documentation/doc/new_output/security/windows/windows_security_log_on.md
+++ /dev/null
@@ -1,734 +0,0 @@
-# Windows User Log On
-
-## Description
-
-This event is generated when a user logs on to the computer.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.security-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.security" and event.module : "endpoint" and host.os.type : "windows" and event.action : "log_on"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `Target.process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.code`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Identification code for this event, if one exists.  Some event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.</td></tr>
-<tr><td>Example</td><td><code>4648</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.authentication_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process authentication ID</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.session_info.logon_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Session logon type.  Examples include Interactive, Network, and Service.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.email`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User email address.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.full_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>User's full name, if available.</td></tr>
-<tr><td>Example</td><td><code>Albert Einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.hash`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique user hash to correlate information for a user in anonymized form.  Useful if `user.id` or `user.name` contain confidential information and cannot be used.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.effective.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `winlog.event_data.PrivilegeList`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of sensitive privileges, assigned to the new logon.</td></tr>
-<tr><td>Example</td><td><code>SeTcbPrivilege, SeSecurityPrivilege</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_mount.md b/custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_mount.md
deleted file mode 100644
index feea63c1e..000000000
--- a/custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_mount.md
+++ /dev/null
@@ -1,708 +0,0 @@
-# Windows Device Mount
-
-## Description
-
-This event is generated when a device is mounted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.volume_device-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.volume_device" and event.module : "endpoint" and host.os.type : "windows" and event.action : "mount"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.exists`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Boolean to capture if a signature is present.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.status`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Additional information about the certificate status.  This is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.</td></tr>
-<tr><td>Example</td><td><code>ERROR_UNTRUSTED_ROOT</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.subject_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Subject name of the code signer</td></tr>
-<tr><td>Example</td><td><code>Microsoft Corporation</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.code_signature.trusted`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Stores the trust status of the certificate chain.  Validating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.</td></tr>
-<tr><td>Example</td><td><code>true</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.executable`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Absolute path to the process executable.</td></tr>
-<tr><td>Example</td><td><code>/usr/bin/ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.bus_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.device_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.dos_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.file_system_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.nt_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.product_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.serial_number`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.vendor_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
diff --git a/custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_unmount.md b/custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_unmount.md
deleted file mode 100644
index 9716cedda..000000000
--- a/custom_documentation/doc/new_output/volume_device/windows/windows_volume_device_unmount.md
+++ /dev/null
@@ -1,600 +0,0 @@
-# Windows Device Unmount
-
-## Description
-
-This event is generated when a device is unmounted.
-
-
-## Overview
-
-<table>
-<tr>
-<td><strong>OS</strong></td>
-<td>Windows</td>
-</tr>
-<tr>
-<td><strong>Data Stream</strong></td>
-<td>logs-endpoint.events.volume_device-*</td>
-</tr>
-<tr>
-<td><strong>KQL Query</strong></td>
-<td><code>event.dataset : "endpoint.events.volume_device" and event.module : "endpoint" and host.os.type : "windows" and event.action : "unmount"</code></td>
-</tr>
-</table>
-
-## Fields
-
-<br>
-
-### `@timestamp`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Date/time when the event originated.  This is the date/time extracted from the event, typically representing when the event was generated by the source.  If the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.  Required field for all events.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.853Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this agent (if one exists).  Example: For Beats this would be beat.id.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Type of the agent.  The agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.</td></tr>
-<tr><td>Example</td><td><code>filebeat</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `agent.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Version of the agent.</td></tr>
-<tr><td>Example</td><td><code>6.0.0-rc2</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream dataset name.</td></tr>
-<tr><td>Example</td><td><code>nginx.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.namespace`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream namespace.</td></tr>
-<tr><td>Example</td><td><code>production</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `data_stream.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Data stream type.</td></tr>
-<tr><td>Example</td><td><code>logs</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `ecs.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.  When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.</td></tr>
-<tr><td>Example</td><td><code>1.0.0</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `elastic.agent.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of this elastic agent (if one exists).</td></tr>
-<tr><td>Example</td><td><code>c2a9093e-e289-4c0a-aa44-8c32a414fa7a</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.action`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>The action captured by the event.  This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.</td></tr>
-<tr><td>Example</td><td><code>user-password-change</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.category`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.  `event.category` represents the "big buckets" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.  This field is an array. This will allow proper categorization of some events that fall in multiple categories.</td></tr>
-<tr><td>Example</td><td><code>authentication</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.created`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.  This field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.  In most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.  In case the two timestamps are identical, `@timestamp` should be used.</td></tr>
-<tr><td>Example</td><td><code>2016-05-23T08:05:34.857Z</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.dataset`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the dataset.  If an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.  It's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.</td></tr>
-<tr><td>Example</td><td><code>apache.access</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique ID to describe the event.</td></tr>
-<tr><td>Example</td><td><code>8a4f500d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.kind`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.  `event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.  The value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.</td></tr>
-<tr><td>Example</td><td><code>alert</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.module`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the module this data is coming from.  If your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.</td></tr>
-<tr><td>Example</td><td><code>apache</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.outcome`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.  `event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.  Note that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.  Also note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.  Further note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.</td></tr>
-<tr><td>Example</td><td><code>success</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.sequence`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Sequence number of the event.  The sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `event.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.  `event.type` represents a categorization "sub-bucket" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.  This field is an array. This will allow proper categorization of some events that fall in multiple event types.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.architecture`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system architecture.</td></tr>
-<tr><td>Example</td><td><code>x86_64</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.hostname`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Hostname of the host.  It normally contains what the `hostname` command returns on the host machine.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique host id.  As hostname is not always unique, use values that are meaningful in your environment.  Example: The current usage of `beat.name`.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.ip`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host ip addresses.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.mac`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Host MAC addresses.  The notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.</td></tr>
-<tr><td>Example</td><td><code>["00-00-5E-00-53-23", "00-00-5E-00-53-24"]</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the host.  It can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.Ext.variant`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.</td></tr>
-<tr><td>Example</td><td><code>Ubuntu</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.family`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>OS family (such as redhat, debian, freebsd, windows).</td></tr>
-<tr><td>Example</td><td><code>debian</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.full`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, including the version or code name.</td></tr>
-<tr><td>Example</td><td><code>Mac OS Mojave</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.kernel`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system kernel version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>4.4.0-112-generic</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system name, without the version.</td></tr>
-<tr><td>Example</td><td><code>Mac OS X</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.platform`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system platform (such centos, ubuntu, windows).</td></tr>
-<tr><td>Example</td><td><code>darwin</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Use the `os.type` field to categorize the operating system into one of the broad commercial families.  If the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.</td></tr>
-<tr><td>Example</td><td><code>macos</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `host.os.version`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Operating system version as a raw string.</td></tr>
-<tr><td>Example</td><td><code>10.14.1</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `message`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>For log events the message field contains the log message, optimized for viewing in a log viewer.  For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.  If multiple messages exist, they can be combined into one message.</td></tr>
-<tr><td>Example</td><td><code>Hello World</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.Ext.ancestry`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>An array of entity_ids indicating the ancestors for this event</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.entity_id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier for the process.  The implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.  Constructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.</td></tr>
-<tr><td>Example</td><td><code>c2c455d9f99375d</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process name.  Sometimes called program name or similar.</td></tr>
-<tr><td>Example</td><td><code>ssh</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `process.pid`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Process id.</td></tr>
-<tr><td>Example</td><td><code>4242</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.domain`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Name of the directory the user is a member of.  For example, an LDAP or Active Directory domain name.</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.id`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Unique identifier of the user.</td></tr>
-<tr><td>Example</td><td><code>S-1-5-21-202424912787-2692429404-2351956786-1000</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `user.name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>Short name or login of the user.</td></tr>
-<tr><td>Example</td><td><code>a.einstein</code></td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.bus_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.device_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.dos_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.file_system_type`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.nt_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.product_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.serial_number`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-
-### `volume.vendor_name`
-
-<div style='margin-left: 20px;'>
-<table>
-<tr><td>Description</td><td>No Description Found</td></tr>
-</table>
-
-<br>
-
-</div>
-

From 3ea7f6e8d6aed3ddabd7c6d4eaa878b56a728a15 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 28 Mar 2025 21:17:29 +0000
Subject: [PATCH 20/25] cleanup

---
 .../doc/endpoint/metadata/metadata.md         |     2 +-
 scripts/generate-docs/packages.json           | 36484 ----------------
 2 files changed, 1 insertion(+), 36485 deletions(-)
 delete mode 100644 scripts/generate-docs/packages.json

diff --git a/custom_documentation/doc/endpoint/metadata/metadata.md b/custom_documentation/doc/endpoint/metadata/metadata.md
index 22a7fc799..2894306df 100644
--- a/custom_documentation/doc/endpoint/metadata/metadata.md
+++ b/custom_documentation/doc/endpoint/metadata/metadata.md
@@ -44,7 +44,7 @@ This is a relatively small state management document that includes details about
 | host.ip |
 | host.mac |
 | host.name |
-| host.os.Ext.variant <br> **Description**: The product name of the host os<br>**Possible Values**<ul><li>windows: The product name from the registry</li><li>linux: the distribution name (ubuntu, red hat, etc)</li><li>macos: this value is always "macOS"</li>
+| host.os.Ext.variant |
 | host.os.family |
 | host.os.full |
 | host.os.kernel |
diff --git a/scripts/generate-docs/packages.json b/scripts/generate-docs/packages.json
deleted file mode 100644
index c181fcdd3..000000000
--- a/scripts/generate-docs/packages.json
+++ /dev/null
@@ -1,36484 +0,0 @@
-{
-    "packages": [
-        {
-            "name": "alerts",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "Events",
-                    "level": "custom",
-                    "type": "object",
-                    "description": "events array"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Endpoint",
-                    "title": "Endpoint",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
-                    "fields": [
-                        {
-                            "name": "policy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The policy fields are used to hold information about applied policy."
-                        },
-                        {
-                            "name": "policy.applied",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about the policy that is applied"
-                        },
-                        {
-                            "name": "policy.applied.artifacts",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about global protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.channel",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "global artifacts rollout channel"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "the identifiers of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of global artifact applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the sha256 of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.snapshot",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the snapshot date of applied global artifacts or 'latest'"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.update_age",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "number of days since global artifacts were made up-to-date"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about user protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "the identifiers of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of user artifact applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the sha256 of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the id of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of this applied policy"
-                        },
-                        {
-                            "name": "policy.applied.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of this applied policy"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Memory_protection",
-                    "title": "Memory Protection",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information specific to Memory Protection alerts.",
-                    "fields": [
-                        {
-                            "name": "cross_session",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Is this process injecting across operating system sessions?"
-                        },
-                        {
-                            "name": "feature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory Protection feature which triggered the alert.",
-                            "example": "shellcode_thread"
-                        },
-                        {
-                            "name": "parent_to_child",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Is this process injecting into its child?"
-                        },
-                        {
-                            "name": "self_injection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Is this alert about a process injecting into itself?"
-                        },
-                        {
-                            "name": "thread_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The number of threads that this alert applies to. If several alerts occur in a short period of time, they can be combined into a single alert with thread_count > 1."
-                        },
-                        {
-                            "name": "unique_key_v1",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A unique key created by hashing several characteristics of this alert."
-                        },
-                        {
-                            "name": "unique_key_v2",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A unique key created by hashing several characteristics of this alert.",
-                            "example": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Ransomware",
-                    "title": "Ransomware",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information specific to ransomware alerts.",
-                    "fields": [
-                        {
-                            "name": "child_processes.executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "child_processes.feature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ransomware feature which triggered the alert."
-                        },
-                        {
-                            "name": "child_processes.files",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Information about each file event attributed to the ransomware. Expected to be an array."
-                        },
-                        {
-                            "name": "child_processes.files.data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File header or MBR bytes."
-                        },
-                        {
-                            "name": "child_processes.files.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy of file contents."
-                        },
-                        {
-                            "name": "child_processes.files.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot."
-                        },
-                        {
-                            "name": "child_processes.files.metrics",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Suspicious ransomware behaviours associated with the file event."
-                        },
-                        {
-                            "name": "child_processes.files.operation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operation applied to file."
-                        },
-                        {
-                            "name": "child_processes.files.original.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file extension prior to the file event."
-                        },
-                        {
-                            "name": "child_processes.files.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to the file event."
-                        },
-                        {
-                            "name": "child_processes.files.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name."
-                        },
-                        {
-                            "name": "child_processes.files.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Ransomware score for this particular file event."
-                        },
-                        {
-                            "name": "child_processes.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "child_processes.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Total ransomware score for aggregated file events."
-                        },
-                        {
-                            "name": "child_processes.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ransomware artifact version."
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "feature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ransomware feature which triggered the alert."
-                        },
-                        {
-                            "name": "files",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Information about each file event attributed to the ransomware. Expected to be an array."
-                        },
-                        {
-                            "name": "files.data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File header or MBR bytes."
-                        },
-                        {
-                            "name": "files.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy of file contents."
-                        },
-                        {
-                            "name": "files.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot."
-                        },
-                        {
-                            "name": "files.metrics",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Suspicious ransomware behaviours associated with the file event."
-                        },
-                        {
-                            "name": "files.operation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operation applied to file."
-                        },
-                        {
-                            "name": "files.original.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file extension prior to the file event."
-                        },
-                        {
-                            "name": "files.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to the file event."
-                        },
-                        {
-                            "name": "files.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name."
-                        },
-                        {
-                            "name": "files.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Ransomware score for this particular file event."
-                        },
-                        {
-                            "name": "pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Total ransomware score for aggregated file events."
-                        },
-                        {
-                            "name": "version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ransomware artifact version."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Responses",
-                    "title": "Responses",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "responses array contains rule response action results",
-                    "fields": [
-                        {
-                            "name": "@timestamp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp in which action was taken",
-                            "format": "string"
-                        },
-                        {
-                            "name": "action",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Dictionary representing requested response action"
-                        },
-                        {
-                            "name": "action.action",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Response action name"
-                        },
-                        {
-                            "name": "action.field",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Field in the triggering event to use as input for action"
-                        },
-                        {
-                            "name": "action.file.attributes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Destination file attributes"
-                        },
-                        {
-                            "name": "action.file.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Destination file path"
-                        },
-                        {
-                            "name": "action.file.reason",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Combined USN file modification reason"
-                        },
-                        {
-                            "name": "action.key.actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Actions taken by Registry Rollback for key"
-                        },
-                        {
-                            "name": "action.key.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT path of registry key recovered by Rollback"
-                        },
-                        {
-                            "name": "action.key.values",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Values modified"
-                        },
-                        {
-                            "name": "action.key.values.actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Actions taken by Registry Rollback for value"
-                        },
-                        {
-                            "name": "action.key.values.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Value name recovered by Rollback"
-                        },
-                        {
-                            "name": "action.process.message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Status message for Process Rollback"
-                        },
-                        {
-                            "name": "action.process.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path of process killed by Process Rollback"
-                        },
-                        {
-                            "name": "action.process.result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Result code for Process Rollback"
-                        },
-                        {
-                            "name": "action.source.attributes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source file attributes"
-                        },
-                        {
-                            "name": "action.source.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source file path"
-                        },
-                        {
-                            "name": "action.state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Index of event in events array to use for field lookup"
-                        },
-                        {
-                            "name": "action.tree",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Indicates whether or not an action was taken against an entire process tree"
-                        },
-                        {
-                            "name": "message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Result message"
-                        },
-                        {
-                            "name": "process",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Dictionary representing process information"
-                        },
-                        {
-                            "name": "process.entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Entity id of actionable process"
-                        },
-                        {
-                            "name": "process.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of actionable process"
-                        },
-                        {
-                            "name": "process.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "pid of actionable process"
-                        },
-                        {
-                            "name": "result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Response action result code"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Target",
-                    "title": "Target",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
-                    "fields": [
-                        {
-                            "name": "dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "dll.Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "process.Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "process.Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        },
-                        {
-                            "name": "process.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "process.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "process.Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "process.Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "process.Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory allocation containing the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Original memory size requested when the memory was allocated.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-                            "example": "PRIVATE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The address where bytes_compressed begins.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether bytes_compressed is present in this event.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A sequence of signature names matched.",
-                            "example": "Windows.EICAR.Not-a-virus"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature identifier"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The first matching details."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The first matching details.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of file matching signature."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of file matching signature."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the first yara rule matched."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the first yara rule matched."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature version"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
-                            "example": "C:\\Windows\\System32\\mshtml.dll"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the file at mapped_path is an executable.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether an executable file was found in memory.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of the memory region.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_start_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 64 bytes at the region base address.",
-                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-                            "example": "COMMIT"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.strings",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Array of strings found within the memory region.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "process.Ext.services",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Services running in this process."
-                        },
-                        {
-                            "name": "process.Ext.session",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Session information for the current process"
-                        },
-                        {
-                            "name": "process.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "process.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "process.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "process.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "process.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "process.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "process.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "process.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "process.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "process.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "process.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "process.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "process.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "process.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "process.Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "process.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "process.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "process.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "process.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "process.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "process.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "process.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "process.exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "process.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "process.parent.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.parent.Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.parent.Ext.dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.parent.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "process.parent.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
-                        },
-                        {
-                            "name": "process.parent.Ext.real.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "process.parent.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "process.parent.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "process.parent.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "process.parent.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "process.parent.Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "process.parent.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "process.parent.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "process.parent.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "process.parent.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.parent.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "process.parent.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.parent.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "process.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "process.parent.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "process.parent.exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "process.parent.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.parent.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.parent.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.parent.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.parent.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "process.parent.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.parent.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.parent.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.parent.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.parent.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.parent.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.parent.pgid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.parent.ppid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "process.parent.thread.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.parent.thread.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "process.parent.title",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ]
-                        },
-                        {
-                            "name": "process.parent.uptime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "process.parent.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "process.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.pgid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.ppid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "process.thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.instruction_pointer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The return address of this stack frame."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.memory_section.memory_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.memory_section.memory_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.memory_section.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.module_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The name of the DLL/module containing `instruction_pointer`.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.module_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path to the DLL/module containing `instruction_pointer`."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.rva",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The final non-win32 module in the call stack."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_user_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file name of the call_stack_final_user_module.",
-                            "example": "example.dll"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_final_user_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_user_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "process.thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "process.thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a trampoline was detected, this indicates the original content for the thread start address in memory.",
-                            "example": 4194304
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.",
-                            "example": "48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc"
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_bytes_disasm",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the disassembled code at the original thread start address.",
-                            "example": "mov rax, 0x4141414141414141\\njmp rax"
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_bytes_disasm_hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
-                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
-                        },
-                        {
-                            "name": "process.thread.Ext.original_start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.",
-                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
-                        },
-                        {
-                            "name": "process.thread.Ext.parameter",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a thread is created, this is the raw numerical value of its parameter."
-                        },
-                        {
-                            "name": "process.thread.Ext.parameter_bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.thread.Ext.parameter_bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether parameter_bytes_compressed is present in this event."
-                        },
-                        {
-                            "name": "process.thread.Ext.service",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Service associated with the thread.",
-                            "example": "VaultSvc"
-                        },
-                        {
-                            "name": "process.thread.Ext.start",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "The time the thread started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Memory address where the thread began execution.",
-                            "example": 4194304
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.",
-                            "example": "c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_bytes_disasm",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The bytes at the thread start address, disassembled into human-readable assembly code.",
-                            "example": "ret\\nint3"
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_bytes_disasm_hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
-                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
-                        },
-                        {
-                            "name": "process.thread.Ext.start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The dll/module where the thread began execution.",
-                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
-                        },
-                        {
-                            "name": "process.thread.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "process.thread.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "process.thread.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "process.thread.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "process.thread.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "process.thread.Ext.uptime",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Seconds since thread started."
-                        },
-                        {
-                            "name": "process.thread.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.thread.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "process.title",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ]
-                        },
-                        {
-                            "name": "process.uptime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "process.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "ephemeral_id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
-                            "example": "8a4f500f"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
-                            "example": "foo"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "cloud",
-                    "title": "Cloud",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to the cloud or infrastructure the events are coming from.",
-                    "fields": [
-                        {
-                            "name": "account.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
-                            "example": 666777888999
-                        },
-                        {
-                            "name": "instance.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Instance name of the host machine."
-                        },
-                        {
-                            "name": "project.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
-                            "example": "my-project"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
-                            "example": "aws"
-                        },
-                        {
-                            "name": "region",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region in which this host, resource, or service is located.",
-                            "example": "us-east-1"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information."
-                },
-                {
-                    "name": "container",
-                    "title": "Container",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique container id."
-                        },
-                        {
-                            "name": "image.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the image the container was built on."
-                        },
-                        {
-                            "name": "image.tag",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Container image tags."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Container name."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the destination (IPv4 or IPv6)."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dll",
-                    "title": "DLL",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dns",
-                    "title": "DNS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).",
-                    "fields": [
-                        {
-                            "name": "question.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
-                            "example": "www.example.com"
-                        },
-                        {
-                            "name": "question.type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of record being queried.",
-                            "example": "AAAA"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "elastic",
-                    "title": "Elastic",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Holds fields and properties of data points and concepts in the elastic domain or namespace.",
-                    "fields": [
-                        {
-                            "name": "agent",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
-                        },
-                        {
-                            "name": "agent.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this elastic agent (if one exists).",
-                            "example": "c2a9093e-e289-4c0a-aa44-8c32a414fa7a"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "risk_score",
-                            "level": "core",
-                            "type": "float",
-                            "description": "Risk score or priority of the event (e.g. security solutions). Use your system's original value here."
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "file",
-                    "title": "File",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.entry_modified",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
-                        },
-                        {
-                            "name": "Ext.macro.code_page",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Identifies the character encoding used for this macro.  https://docs.microsoft.com/en-us/windows/win32/intl/code-page-identifiers"
-                        },
-                        {
-                            "name": "Ext.macro.collection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object containing hashes for the macro collection."
-                        },
-                        {
-                            "name": "Ext.macro.collection.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.macro.collection.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.macro.collection.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.macro.collection.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.macro.errors",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Errors that occurred when parsing this document file."
-                        },
-                        {
-                            "name": "Ext.macro.errors.count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of times this error that occurred."
-                        },
-                        {
-                            "name": "Ext.macro.errors.error_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of parsing error that occurred."
-                        },
-                        {
-                            "name": "Ext.macro.file_extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The extension of the file containing this macro (e.g. .docm)"
-                        },
-                        {
-                            "name": "Ext.macro.project_file",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Metadata about the corresponding VBA project file"
-                        },
-                        {
-                            "name": "Ext.macro.project_file.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.macro.project_file.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.macro.project_file.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.macro.project_file.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Streams associated with the document."
-                        },
-                        {
-                            "name": "Ext.macro.stream.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.macro.stream.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the stream."
-                        },
-                        {
-                            "name": "Ext.macro.stream.raw_code",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 100KB of raw stream binary.  Can be useful to analyze false positives and malicious payloads."
-                        },
-                        {
-                            "name": "Ext.macro.stream.raw_code_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The original stream size.  Indicates whether stream.raw_code was truncated."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "Ext.original",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Original file information during a modification event."
-                        },
-                        {
-                            "name": "Ext.original.gid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "Ext.original.group",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "Ext.original.mode",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file mode prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file name prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.owner",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "Ext.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.uid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "Ext.quarantine_message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Message describing quarantine results."
-                        },
-                        {
-                            "name": "Ext.quarantine_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint the quarantined file was originally."
-                        },
-                        {
-                            "name": "Ext.quarantine_result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean representing whether or not file quarantine succeeded."
-                        },
-                        {
-                            "name": "Ext.temp_file_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
-                        },
-                        {
-                            "name": "Ext.windows",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Platform-specific Windows fields"
-                        },
-                        {
-                            "name": "Ext.windows.zone_identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Windows zone identifier for a file"
-                        },
-                        {
-                            "name": "accessed",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-                        },
-                        {
-                            "name": "attributes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
-                            "example": "[\"readonly\", \"system\"]"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "created",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "File creation time.\nNote that not all filesystems store the creation time."
-                        },
-                        {
-                            "name": "ctime",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-                        },
-                        {
-                            "name": "device",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device that is the source of the file.",
-                            "example": "sda"
-                        },
-                        {
-                            "name": "directory",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "drive_letter",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1,
-                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
-                            "example": "C"
-                        },
-                        {
-                            "name": "extension",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "gid",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "group",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "inode",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Inode representing the file in the filesystem.",
-                            "example": "256383"
-                        },
-                        {
-                            "name": "mime_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-                        },
-                        {
-                            "name": "mode",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode of the file in octal representation.",
-                            "example": "0640"
-                        },
-                        {
-                            "name": "mtime",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file content was modified."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "owner",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "size",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
-                            "example": 16384
-                        },
-                        {
-                            "name": "target_path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Target path for symlinks.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File type (file, dir, or symlink).",
-                            "example": "file"
-                        },
-                        {
-                            "name": "uid",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "boot.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
-                            "example": "88a1f0ed-5ae5-41ee-af6b-41921c311872"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "pid_ns_ino",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
-                            "example": 256383
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "user.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "user.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "user.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "user.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "user.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "user.email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "user.full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "user.group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "user.group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "user.group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "user.group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "user.group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "user.group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "user.group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "user.hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "user.id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "user.name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "orchestrator",
-                    "title": "Orchestrator",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields that describe the resources which container orchestrators manage or act upon.",
-                    "fields": [
-                        {
-                            "name": "cluster.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the cluster."
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Namespace in which the action is taking place.",
-                            "example": "kube-system"
-                        },
-                        {
-                            "name": "resource.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the resource being acted upon.",
-                            "example": "test-pod-cdcws"
-                        },
-                        {
-                            "name": "resource.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of resource being acted upon.",
-                            "example": "service"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.api.behaviors",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
-                            "example": "[ \"cross-process\", \"rapid_background_polling\", \"multiple_polling_processes\", \"native_api\", \"shellcode\" ]"
-                        },
-                        {
-                            "name": "Ext.api.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the API, usually the name of the function or system call.",
-                            "example": "VirtualAlloc"
-                        },
-                        {
-                            "name": "Ext.api.summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The summary of the API call and its parameters.",
-                            "example": "VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )"
-                        },
-                        {
-                            "name": "Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.created_suspended",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "Ext.dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.malware_classification.features",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Intermediate field included by adding option with subset",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory allocation containing the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Original memory size requested when the memory was allocated.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-                            "example": "PRIVATE"
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The address where bytes_compressed begins.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether bytes_compressed is present in this event.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A sequence of signature names matched.",
-                            "example": "Windows.EICAR.Not-a-virus"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature identifier"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The first matching details."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The first matching details.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of file matching signature."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of file matching signature."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the first yara rule matched."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the first yara rule matched."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature version"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
-                            "example": "C:\\Windows\\System32\\mshtml.dll"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the file at mapped_path is an executable.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether an executable file was found in memory.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.region_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.region_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "Ext.memory_region.region_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of the memory region.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.memory_region.region_start_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 64 bytes at the region base address.",
-                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
-                        },
-                        {
-                            "name": "Ext.memory_region.region_state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-                            "example": "COMMIT"
-                        },
-                        {
-                            "name": "Ext.memory_region.strings",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Array of strings found within the memory region.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "Ext.services",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Services running in this process."
-                        },
-                        {
-                            "name": "Ext.session",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Session information for the current process"
-                        },
-                        {
-                            "name": "Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "args",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "entry_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "entry_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "entry_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.entry_meta.source.ip",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the source (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "entry_leader.entry_meta.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
-                        },
-                        {
-                            "name": "entry_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "entry_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "entry_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "entry_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "entry_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "entry_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "entry_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "entry_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "env_vars",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"PATH=/usr/local/bin:/usr/bin\", \"USER=ubuntu\"]"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "group_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "group_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "group_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "group_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "group_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "group_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "group_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "group_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "group_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "group_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "group_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "group_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "group_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "parent.Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.compile_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp from when the module was compiled."
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "parent.Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.dll.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "parent.Ext.dll.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "parent.Ext.dll.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "parent.Ext.dll.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "parent.Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "parent.Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "parent.Ext.dll.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "parent.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "parent.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
-                        },
-                        {
-                            "name": "parent.Ext.real.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
-                        },
-                        {
-                            "name": "parent.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "parent.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "parent.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "parent.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "parent.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "parent.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "parent.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "parent.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "parent.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "parent.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "parent.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "parent.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "parent.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "parent.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "parent.Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "parent.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "parent.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "parent.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "parent.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "parent.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "parent.exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "parent.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.group_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.group_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "parent.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "parent.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "parent.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "parent.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "parent.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "parent.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "parent.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "parent.pgid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.ppid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "parent.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.thread.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.thread.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "parent.title",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ]
-                        },
-                        {
-                            "name": "parent.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "parent.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "parent.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "parent.uptime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "parent.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "pgid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "ppid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "previous.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "previous.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "previous.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "session_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "session_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "session_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "session_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "session_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "session_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "session_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "session_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "session_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.instruction_pointer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The return address of this stack frame."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.memory_section.memory_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Base address of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.BaseAddress`",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.memory_section.memory_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Size of the memory region containing `instruction_pointer`.  Corresponds to `MEMORY_BASIC_INFORMATION.RegionSize`",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.memory_section.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection flags of this memory region.  Corresponds to `MEMORY_BASIC_INFORMATION.Protect`"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.module_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The name of the DLL/module containing `instruction_pointer`.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.module_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path to the DLL/module containing `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.rva",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The relative virtual address of `instruction_pointer`.  Computed as `instruction_pointer - MEMORY_BASIC_INFORMATION.AllocationBase`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The module that installed the final API hook in the call stack."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_hook_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_hook_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_hook_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_hook_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The final non-win32 module in the call stack."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_user_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file name of the call_stack_final_user_module.",
-                            "example": "example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_user_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a trampoline was detected, this indicates the original content for the thread start address in memory.",
-                            "example": 4194304
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a trampoline was detected, this indicates the offset of original_start_address from the allocation base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the hex-encoded bytes at the original thread start address.",
-                            "example": "48b84141414141414141ffe000ccccccccccccccccccccccccccccccccccccccc"
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_bytes_disasm",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the disassembled code at the original thread start address.",
-                            "example": "mov rax, 0x4141414141414141\\njmp rax"
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_bytes_disasm_hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this holds the bytes at the original thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
-                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
-                        },
-                        {
-                            "name": "thread.Ext.original_start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "When a trampoline was detected, this indicates the original content for the dll/module where the thread began execution.",
-                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
-                        },
-                        {
-                            "name": "thread.Ext.parameter",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "When a thread is created, this is the raw numerical value of its parameter."
-                        },
-                        {
-                            "name": "thread.Ext.parameter_bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 512KB of raw data from the thread parameter, if it is a valid pointer. This is compressed with zlib. To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "thread.Ext.parameter_bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether parameter_bytes_compressed is present in this event."
-                        },
-                        {
-                            "name": "thread.Ext.service",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Service associated with the thread.",
-                            "example": "VaultSvc"
-                        },
-                        {
-                            "name": "thread.Ext.start",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "The time the thread started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "thread.Ext.start_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Memory address where the thread began execution.",
-                            "example": 4194304
-                        },
-                        {
-                            "name": "thread.Ext.start_address_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of start_address into the memory allocation. Equal to start_address - start_address_details.allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "thread.Ext.start_address_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A few (typically 32) raw opcode bytes at the thread start address, hex-encoded.",
-                            "example": "c3cc0000cccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
-                        },
-                        {
-                            "name": "thread.Ext.start_address_bytes_disasm",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The bytes at the thread start address, disassembled into human-readable assembly code.",
-                            "example": "ret\\nint3"
-                        },
-                        {
-                            "name": "thread.Ext.start_address_bytes_disasm_hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The bytes at the thread start address, with immediate values capped to 0x100, disassembled into human-readable assembly code, then hashed.",
-                            "example": "aacb1c801f9030f799e2f7350f053ebb760d42cbe81cd65021063c1c4d1a9c9c"
-                        },
-                        {
-                            "name": "thread.Ext.start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The dll/module where the thread began execution.",
-                            "example": "C:\\Program Files\\VMware\\VMware Tools\\vmtoolsd.exe"
-                        },
-                        {
-                            "name": "thread.Ext.token.domain",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of token user."
-                        },
-                        {
-                            "name": "thread.Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "thread.Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "thread.Ext.token.impersonation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Impersonation level. Only valid for impersonation tokens."
-                        },
-                        {
-                            "name": "thread.Ext.token.integrity_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Numeric integrity level."
-                        },
-                        {
-                            "name": "thread.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "thread.Ext.token.is_appcontainer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not this is an appcontainer token."
-                        },
-                        {
-                            "name": "thread.Ext.token.privileges",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Array describing the privileges associated with the token."
-                        },
-                        {
-                            "name": "thread.Ext.token.privileges.description",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Description of the privilege."
-                        },
-                        {
-                            "name": "thread.Ext.token.privileges.enabled",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the privilege is enabled."
-                        },
-                        {
-                            "name": "thread.Ext.token.privileges.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the privilege."
-                        },
-                        {
-                            "name": "thread.Ext.token.sid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Token user's Security Identifier (SID)."
-                        },
-                        {
-                            "name": "thread.Ext.token.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the token, either primary or impersonation."
-                        },
-                        {
-                            "name": "thread.Ext.token.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of token owner."
-                        },
-                        {
-                            "name": "thread.Ext.uptime",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Seconds since thread started."
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "title",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "working_directory",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "registry",
-                    "title": "Registry",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to Windows Registry operations.",
-                    "fields": [
-                        {
-                            "name": "data.strings",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "wildcard",
-                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
-                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path, including hive, key and value",
-                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
-                        },
-                        {
-                            "name": "value",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the value written.",
-                            "example": "Debugger"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "rule",
-                    "title": "Rule",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.",
-                    "fields": [
-                        {
-                            "name": "author",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name, organization, or pseudonym of the author or authors who created the rule used to generate this event.",
-                            "example": "[\"Star-Lord\"]"
-                        },
-                        {
-                            "name": "category",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A categorization value keyword used by the entity using the rule for detection of this event.",
-                            "example": "Attempted Information Leak"
-                        },
-                        {
-                            "name": "description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The description of the rule generating the event.",
-                            "example": "Block requests to public DNS over HTTPS / TLS protocols"
-                        },
-                        {
-                            "name": "id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
-                            "example": 101
-                        },
-                        {
-                            "name": "license",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the license under which the rule used to generate this event is made available.",
-                            "example": "Apache 2.0"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the rule or signature generating the event.",
-                            "example": "BLOCK_DNS_over_TLS"
-                        },
-                        {
-                            "name": "reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Reference URL to additional information about the rule used to generate this event.\nThe URL can point to the vendor's documentation about the rule. If that's not available, it can also be a link to a more general page describing this type of alert.",
-                            "example": "https://en.wikipedia.org/wiki/DNS_over_TLS"
-                        },
-                        {
-                            "name": "ruleset",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member.",
-                            "example": "Standard_Protocol_Filters"
-                        },
-                        {
-                            "name": "uuid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A rule ID that is unique within the scope of a set or group of agents, observers, or other entities using the rule for detection of this event.",
-                            "example": 1100110011
-                        },
-                        {
-                            "name": "version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version / revision of the rule being used for analysis.",
-                            "example": 1.1
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the source (IPv4 or IPv6)."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "threat",
-                    "title": "Threat",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields to classify events and alerts according to a threat taxonomy such as the MITRE ATT&CK® framework.\nThese fields are for users to classify alerts from all of their sources (e.g. IDS, NGFW, etc.) within a common taxonomy. The threat.tactic.* fields are meant to capture the high level category of the threat (e.g. \"impact\"). The threat.technique.* fields are meant to capture which kind of approach is used by this detected threat, to accomplish the goal (e.g. \"endpoint denial of service\").",
-                    "fields": [
-                        {
-                            "name": "enrichments",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "A list of associated indicators objects enriching the event, and the context of that association/enrichment."
-                        },
-                        {
-                            "name": "enrichments.indicator",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Object containing associated indicators enriching the event."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy calculation of file's header and footer used to check file integrity."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.entry_modified",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.header_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.header_data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of malware_signature fieldset."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "The concatenated names of all yara signatures"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Malware artifact identifier."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of bytes representing yara signature matches"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature sha256."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature id."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature name."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of malware signature matches"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature version."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.monotonic_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "File event monotonic ID."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Original file information during a modification event."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.gid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.group",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.mode",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file mode prior to a modification event"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file name prior to a modification event"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.owner",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to a modification event"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.original.uid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.quarantine_message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Message describing quarantine results."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.quarantine_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint the quarantined file was originally."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.quarantine_result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean representing whether or not file quarantine succeeded."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.temp_file_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.windows",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Platform-specific Windows fields"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.Ext.windows.zone_identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Windows zone identifier for a file"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.accessed",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.attributes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
-                            "example": "[\"readonly\", \"system\"]"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.created",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "File creation time.\nNote that not all filesystems store the creation time."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.ctime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.device",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device that is the source of the file.",
-                            "example": "sda"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.drive_letter",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1,
-                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
-                            "example": "C"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Machine architecture of the ELF file.",
-                            "example": "x86-64"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.byte_order",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Byte sequence of ELF file.",
-                            "example": "Little Endian"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.cpu_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU type of the ELF file.",
-                            "example": "Intel"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.creation_date",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.exports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of exported element names and types."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.abi_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the ELF Application Binary Interface (ABI)."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.class",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Header class of the ELF file."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.data",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Data table of the ELF header."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.entrypoint",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Header entrypoint of the ELF file.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.object_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "\"0x1\" for original ELF files."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.os_abi",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Application Binary Interface (ABI) of the Linux OS."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Header type of the ELF file."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.header.version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the ELF header."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.chi2",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Chi-square probability distribution of the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.flags",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List flags."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List name."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.physical_offset",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List offset."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List type."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.virtual_address",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List virtual address.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List virtual size.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.segments",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.segments.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF object segment sections."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.segments.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF object segment type."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.shared_libraries",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of shared libraries used by this ELF object."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.elf.telfhash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "telfhash symbol hash for ELF file."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.extension",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.gid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.group",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.inode",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Inode representing the file in the filesystem.",
-                            "example": "256383"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.mime_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.mode",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode of the file in octal representation.",
-                            "example": "0640"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.mtime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file content was modified."
-                        },
-                        {
-                            "name": "enrichments.indicator.file.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.owner",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
-                            "example": 16384
-                        },
-                        {
-                            "name": "enrichments.indicator.file.target_path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Target path for symlinks.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "enrichments.indicator.file.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File type (file, dir, or symlink).",
-                            "example": "file"
-                        },
-                        {
-                            "name": "enrichments.indicator.file.uid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "enrichments.indicator.first_seen",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source first reported sighting this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.city_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.continent_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.country_iso_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.country_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.location",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.region_iso_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.region_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "enrichments.indicator.geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "enrichments.indicator.ip",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "ip",
-                            "description": "Identifies a threat indicator as an IP address (irrespective of direction).",
-                            "example": "1.2.3.4"
-                        },
-                        {
-                            "name": "enrichments.indicator.last_seen",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source last reported sighting this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.marking.tlp",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Traffic Light Protocol sharing markings.",
-                            "example": "CLEAR"
-                        },
-                        {
-                            "name": "enrichments.indicator.modified_at",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source last modified information for this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.port",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Identifies a threat indicator as a port number (irrespective of direction).",
-                            "example": 443
-                        },
-                        {
-                            "name": "enrichments.indicator.provider",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the indicator's provider.",
-                            "example": "lrz_urlhaus"
-                        },
-                        {
-                            "name": "enrichments.indicator.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Reference URL linking to additional information about this indicator.",
-                            "example": "https://system.example.com/indicator/0001234"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.data.bytes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
-                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.data.strings",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "wildcard",
-                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
-                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.data.type",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Standard registry type for encoding contents",
-                            "example": "REG_SZ"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.hive",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Abbreviated name for the hive.",
-                            "example": "HKLM"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.key",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hive-relative path of keys.",
-                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.path",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path, including hive, key and value",
-                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
-                        },
-                        {
-                            "name": "enrichments.indicator.registry.value",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the value written.",
-                            "example": "Debugger"
-                        },
-                        {
-                            "name": "enrichments.indicator.scanner_stats",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Count of AV/EDR vendors that successfully detected malicious file or URL.",
-                            "example": 4
-                        },
-                        {
-                            "name": "enrichments.indicator.sightings",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Number of times this indicator was observed conducting threat activity.",
-                            "example": 20
-                        },
-                        {
-                            "name": "enrichments.indicator.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of indicator as represented by Cyber Observable in STIX 2.0.",
-                            "example": "ipv4-addr"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.",
-                            "example": "www.elastic.co"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.extension",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.fragment",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
-                        },
-                        {
-                            "name": "enrichments.indicator.url.full",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.original",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.password",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Password of the request."
-                        },
-                        {
-                            "name": "enrichments.indicator.url.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Path of the request, such as \"/search\"."
-                        },
-                        {
-                            "name": "enrichments.indicator.url.port",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Port of the request, such as 443.",
-                            "example": 443,
-                            "format": "string"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.query",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
-                        },
-                        {
-                            "name": "enrichments.indicator.url.registered_domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.scheme",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme.",
-                            "example": "https"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.subdomain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
-                            "example": "east"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.top_level_domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        },
-                        {
-                            "name": "enrichments.indicator.url.username",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of the request."
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.alternative_names",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.",
-                            "example": "*.elastic.co"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.common_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of common name (CN) of issuing certificate authority.",
-                            "example": "Example SHA2 High Assurance Server CA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.country",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of country \\(C) codes",
-                            "example": "US"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.distinguished_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguished name (DN) of issuing certificate authority.",
-                            "example": "C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.locality",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of locality names (L)",
-                            "example": "Mountain View"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.organization",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizations (O) of issuing certificate authority.",
-                            "example": "Example Inc"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.organizational_unit",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizational units (OU) of issuing certificate authority.",
-                            "example": "www.example.com"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.issuer.state_or_province",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of state or province names (ST, S, or P)",
-                            "example": "California"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.not_after",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Time at which the certificate is no longer considered valid.",
-                            "example": "2020-07-16T03:15:39Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.not_before",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Time at which the certificate is first considered valid.",
-                            "example": "2019-08-16T01:40:25Z"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.public_key_algorithm",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Algorithm used to generate the public key.",
-                            "example": "RSA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.public_key_curve",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The curve used by the elliptic curve public key algorithm. This is algorithm specific.",
-                            "example": "nistp521"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.public_key_exponent",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Exponent used to derive the public key. This is algorithm specific.",
-                            "example": 65537,
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.public_key_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The size of the public key space in bits.",
-                            "example": 2048
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.serial_number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.",
-                            "example": "55FBB9C7DEBF09809D12CCAA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.signature_algorithm",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.",
-                            "example": "SHA256-RSA"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.common_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of common names (CN) of subject.",
-                            "example": "shared.global.example.net"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.country",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of country \\(C) code",
-                            "example": "US"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.distinguished_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguished name (DN) of the certificate subject entity.",
-                            "example": "C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.locality",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of locality names (L)",
-                            "example": "San Francisco"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.organization",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizations (O) of subject.",
-                            "example": "Example, Inc."
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.organizational_unit",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizational units (OU) of subject."
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.subject.state_or_province",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of state or province names (ST, S, or P)",
-                            "example": "California"
-                        },
-                        {
-                            "name": "enrichments.indicator.x509.version_number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of x509 format.",
-                            "example": 3
-                        },
-                        {
-                            "name": "enrichments.matched.atomic",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the atomic indicator value that matched a local environment endpoint or network event.",
-                            "example": "bad-domain.com"
-                        },
-                        {
-                            "name": "enrichments.matched.field",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the field of the atomic indicator that matched a local environment endpoint or network event.",
-                            "example": "file.hash.sha256"
-                        },
-                        {
-                            "name": "enrichments.matched.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the _id of the indicator document enriching the event.",
-                            "example": "ff93aee5-86a1-4a61-b0e6-0cdc313d01b5"
-                        },
-                        {
-                            "name": "enrichments.matched.index",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the _index of the indicator document enriching the event.",
-                            "example": "filebeat-8.0.0-2021.05.23-000011"
-                        },
-                        {
-                            "name": "enrichments.matched.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the type of match that caused the event to be enriched with the given indicator",
-                            "example": "indicator_match_rule"
-                        },
-                        {
-                            "name": "framework",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the threat framework used to further categorize and classify the tactic and technique of the reported threat. Framework classification can be provided by detecting systems, evaluated at ingest time, or retrospectively tagged to events.",
-                            "example": "MITRE ATT&CK"
-                        },
-                        {
-                            "name": "group.alias",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The alias(es) of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group alias(es).",
-                            "example": "[ \"Magecart Group 6\" ]"
-                        },
-                        {
-                            "name": "group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group id.",
-                            "example": "G0037"
-                        },
-                        {
-                            "name": "group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group name.",
-                            "example": "FIN6"
-                        },
-                        {
-                            "name": "group.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference URL of the group for a set of related intrusion activity that are tracked by a common name in the security community.\nWhile not required, you can use a MITRE ATT&CK® group reference URL.",
-                            "example": "https://attack.mitre.org/groups/G0037/"
-                        },
-                        {
-                            "name": "indicator.as.number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
-                            "example": 15169
-                        },
-                        {
-                            "name": "indicator.as.organization.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Organization name.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "Google LLC"
-                        },
-                        {
-                            "name": "indicator.confidence",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies the vendor-neutral confidence rating using the None/Low/Medium/High scale defined in Appendix A of the STIX 2.1 framework. Vendor-specific confidence scales may be added as custom fields.",
-                            "example": "Medium"
-                        },
-                        {
-                            "name": "indicator.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Describes the type of action conducted by the threat.",
-                            "example": "IP x.x.x.x was observed delivering the Angler EK."
-                        },
-                        {
-                            "name": "indicator.email.address",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifies a threat indicator as an email address (irrespective of direction).",
-                            "example": "phish@example.com"
-                        },
-                        {
-                            "name": "indicator.file.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "indicator.file.Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "indicator.file.Ext.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy calculation of file's header and footer used to check file integrity."
-                        },
-                        {
-                            "name": "indicator.file.Ext.entry_modified",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Time of last status change.  See `st_ctim` member of `struct stat`."
-                        },
-                        {
-                            "name": "indicator.file.Ext.header_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "indicator.file.Ext.header_data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.features.data.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The features extracted from this file and evaluated by the model.  Usually an array of floats.  Likely zlib-encoded."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.features.data.decompressed_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "integer",
-                            "description": "The decompressed size of buffer."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.features.data.encoding",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The encoding of buffer (e.g. zlib)."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The model's unique identifier."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.score",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score produced by the classification model."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.threshold",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The score threshold for the model.  Files that score above this threshold are considered malicious."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.upx_packed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether UPX packing was detected."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_classification.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The version of the model used."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of malware_signature fieldset."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "The concatenated names of all yara signatures"
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Malware artifact identifier."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of bytes representing yara signature matches"
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature hash."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature sha256."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature id."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature name."
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of malware signature matches"
-                        },
-                        {
-                            "name": "indicator.file.Ext.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature version."
-                        },
-                        {
-                            "name": "indicator.file.Ext.monotonic_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "File event monotonic ID."
-                        },
-                        {
-                            "name": "indicator.file.Ext.original",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Original file information during a modification event."
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.gid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.group",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.mode",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file mode prior to a modification event"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file name prior to a modification event"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.owner",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to a modification event"
-                        },
-                        {
-                            "name": "indicator.file.Ext.original.uid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "indicator.file.Ext.quarantine_message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Message describing quarantine results."
-                        },
-                        {
-                            "name": "indicator.file.Ext.quarantine_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint the quarantined file was originally."
-                        },
-                        {
-                            "name": "indicator.file.Ext.quarantine_result",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean representing whether or not file quarantine succeeded."
-                        },
-                        {
-                            "name": "indicator.file.Ext.temp_file_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Path on endpoint where a copy of the file is being stored.  Used to make ephemeral files retrievable."
-                        },
-                        {
-                            "name": "indicator.file.Ext.windows",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Platform-specific Windows fields"
-                        },
-                        {
-                            "name": "indicator.file.Ext.windows.zone_identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Windows zone identifier for a file"
-                        },
-                        {
-                            "name": "indicator.file.accessed",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-                        },
-                        {
-                            "name": "indicator.file.attributes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
-                            "example": "[\"readonly\", \"system\"]"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "indicator.file.created",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "File creation time.\nNote that not all filesystems store the creation time."
-                        },
-                        {
-                            "name": "indicator.file.ctime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-                        },
-                        {
-                            "name": "indicator.file.device",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device that is the source of the file.",
-                            "example": "sda"
-                        },
-                        {
-                            "name": "indicator.file.directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "indicator.file.drive_letter",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1,
-                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
-                            "example": "C"
-                        },
-                        {
-                            "name": "indicator.file.elf.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Machine architecture of the ELF file.",
-                            "example": "x86-64"
-                        },
-                        {
-                            "name": "indicator.file.elf.byte_order",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Byte sequence of ELF file.",
-                            "example": "Little Endian"
-                        },
-                        {
-                            "name": "indicator.file.elf.cpu_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU type of the ELF file.",
-                            "example": "Intel"
-                        },
-                        {
-                            "name": "indicator.file.elf.creation_date",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Extracted when possible from the file's metadata. Indicates when it was built or compiled. It can also be faked by malware creators."
-                        },
-                        {
-                            "name": "indicator.file.elf.exports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of exported element names and types."
-                        },
-                        {
-                            "name": "indicator.file.elf.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in an ELF file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "indicator.file.elf.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "indicator.file.elf.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.abi_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the ELF Application Binary Interface (ABI)."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.class",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Header class of the ELF file."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.data",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Data table of the ELF header."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.entrypoint",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Header entrypoint of the ELF file.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "indicator.file.elf.header.object_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "\"0x1\" for original ELF files."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.os_abi",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Application Binary Interface (ABI) of the Linux OS."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Header type of the ELF file."
-                        },
-                        {
-                            "name": "indicator.file.elf.header.version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the ELF header."
-                        },
-                        {
-                            "name": "indicator.file.elf.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in an ELF file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is an ELF implementation of the Windows PE imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "indicator.file.elf.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "indicator.file.elf.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.sections.*`."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.chi2",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Chi-square probability distribution of the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.flags",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List flags."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List name."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.physical_offset",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List offset."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF Section List type."
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.virtual_address",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List virtual address.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "indicator.file.elf.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "ELF Section List virtual size.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "indicator.file.elf.segments",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each segment of the ELF file.\nThe keys that should be present in these objects are defined by sub-fields underneath `elf.segments.*`."
-                        },
-                        {
-                            "name": "indicator.file.elf.segments.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF object segment sections."
-                        },
-                        {
-                            "name": "indicator.file.elf.segments.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ELF object segment type."
-                        },
-                        {
-                            "name": "indicator.file.elf.shared_libraries",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of shared libraries used by this ELF object."
-                        },
-                        {
-                            "name": "indicator.file.elf.telfhash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "telfhash symbol hash for ELF file."
-                        },
-                        {
-                            "name": "indicator.file.extension",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "indicator.file.gid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "indicator.file.group",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "indicator.file.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "indicator.file.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "indicator.file.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "indicator.file.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "indicator.file.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "indicator.file.inode",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Inode representing the file in the filesystem.",
-                            "example": "256383"
-                        },
-                        {
-                            "name": "indicator.file.mime_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-                        },
-                        {
-                            "name": "indicator.file.mode",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode of the file in octal representation.",
-                            "example": "0640"
-                        },
-                        {
-                            "name": "indicator.file.mtime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file content was modified."
-                        },
-                        {
-                            "name": "indicator.file.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "indicator.file.owner",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "indicator.file.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "indicator.file.pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "indicator.file.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "indicator.file.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "indicator.file.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "indicator.file.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "indicator.file.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "indicator.file.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "indicator.file.size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
-                            "example": 16384
-                        },
-                        {
-                            "name": "indicator.file.target_path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Target path for symlinks.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "indicator.file.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File type (file, dir, or symlink).",
-                            "example": "file"
-                        },
-                        {
-                            "name": "indicator.file.uid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "indicator.first_seen",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source first reported sighting this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "indicator.geo.city_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "indicator.geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "indicator.geo.continent_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "indicator.geo.country_iso_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "indicator.geo.country_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "indicator.geo.location",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "indicator.geo.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "indicator.geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "indicator.geo.region_iso_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "indicator.geo.region_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "indicator.geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "indicator.ip",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "ip",
-                            "description": "Identifies a threat indicator as an IP address (irrespective of direction).",
-                            "example": "1.2.3.4"
-                        },
-                        {
-                            "name": "indicator.last_seen",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source last reported sighting this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "indicator.marking.tlp",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Traffic Light Protocol sharing markings.",
-                            "example": "CLEAR"
-                        },
-                        {
-                            "name": "indicator.modified_at",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The date and time when intelligence source last modified information for this indicator.",
-                            "example": "2020-11-05T17:25:47.000Z"
-                        },
-                        {
-                            "name": "indicator.port",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Identifies a threat indicator as a port number (irrespective of direction).",
-                            "example": 443
-                        },
-                        {
-                            "name": "indicator.provider",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the indicator's provider.",
-                            "example": "lrz_urlhaus"
-                        },
-                        {
-                            "name": "indicator.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Reference URL linking to additional information about this indicator.",
-                            "example": "https://system.example.com/indicator/0001234"
-                        },
-                        {
-                            "name": "indicator.registry.data.bytes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
-                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
-                        },
-                        {
-                            "name": "indicator.registry.data.strings",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "wildcard",
-                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
-                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
-                        },
-                        {
-                            "name": "indicator.registry.data.type",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Standard registry type for encoding contents",
-                            "example": "REG_SZ"
-                        },
-                        {
-                            "name": "indicator.registry.hive",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Abbreviated name for the hive.",
-                            "example": "HKLM"
-                        },
-                        {
-                            "name": "indicator.registry.key",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hive-relative path of keys.",
-                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
-                        },
-                        {
-                            "name": "indicator.registry.path",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path, including hive, key and value",
-                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
-                        },
-                        {
-                            "name": "indicator.registry.value",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the value written.",
-                            "example": "Debugger"
-                        },
-                        {
-                            "name": "indicator.scanner_stats",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Count of AV/EDR vendors that successfully detected malicious file or URL.",
-                            "example": 4
-                        },
-                        {
-                            "name": "indicator.sightings",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Number of times this indicator was observed conducting threat activity.",
-                            "example": 20
-                        },
-                        {
-                            "name": "indicator.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of indicator as represented by Cyber Observable in STIX 2.0.",
-                            "example": "ipv4-addr"
-                        },
-                        {
-                            "name": "indicator.url.domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Domain of the url, such as \"www.elastic.co\".\nIn some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field.\nIf the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field.",
-                            "example": "www.elastic.co"
-                        },
-                        {
-                            "name": "indicator.url.extension",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The field contains the file extension from the original request url, excluding the leading dot.\nThe file extension is only set if it exists, as not every url has a file extension.\nThe leading period must not be included. For example, the value must be \"png\", not \".png\".\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "indicator.url.fragment",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Portion of the url after the `#`, such as \"top\".\nThe `#` is not part of the fragment."
-                        },
-                        {
-                            "name": "indicator.url.full",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "If full URLs are important to your use case, they should be stored in `url.full`, whether this field is reconstructed or present in the event source.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top"
-                        },
-                        {
-                            "name": "indicator.url.original",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Unmodified original url as seen in the event source.\nNote that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path.\nThis field is meant to represent the URL as it was observed, complete or not.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "https://www.elastic.co:443/search?q=elasticsearch#top or /search?q=elasticsearch"
-                        },
-                        {
-                            "name": "indicator.url.password",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Password of the request."
-                        },
-                        {
-                            "name": "indicator.url.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Path of the request, such as \"/search\"."
-                        },
-                        {
-                            "name": "indicator.url.port",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Port of the request, such as 443.",
-                            "example": 443,
-                            "format": "string"
-                        },
-                        {
-                            "name": "indicator.url.query",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The query field describes the query string of the request, such as \"q=elasticsearch\".\nThe `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases."
-                        },
-                        {
-                            "name": "indicator.url.registered_domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered url domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "indicator.url.scheme",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Scheme of the request, such as \"https\".\nNote: The `:` is not part of the scheme.",
-                            "example": "https"
-                        },
-                        {
-                            "name": "indicator.url.subdomain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The subdomain portion of a fully qualified domain name includes all of the names except the host name under the registered_domain.  In a partially qualified domain, or if the the qualification level of the full name cannot be determined, subdomain contains all of the names below the registered domain.\nFor example the subdomain portion of \"www.east.mydomain.co.uk\" is \"east\". If the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
-                            "example": "east"
-                        },
-                        {
-                            "name": "indicator.url.top_level_domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        },
-                        {
-                            "name": "indicator.url.username",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Username of the request."
-                        },
-                        {
-                            "name": "indicator.x509.alternative_names",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of subject alternative names (SAN). Name types vary by certificate authority and certificate type but commonly contain IP addresses, DNS names (and wildcards), and email addresses.",
-                            "example": "*.elastic.co"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.common_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of common name (CN) of issuing certificate authority.",
-                            "example": "Example SHA2 High Assurance Server CA"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.country",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of country \\(C) codes",
-                            "example": "US"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.distinguished_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguished name (DN) of issuing certificate authority.",
-                            "example": "C=US, O=Example Inc, OU=www.example.com, CN=Example SHA2 High Assurance Server CA"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.locality",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of locality names (L)",
-                            "example": "Mountain View"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.organization",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizations (O) of issuing certificate authority.",
-                            "example": "Example Inc"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.organizational_unit",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizational units (OU) of issuing certificate authority.",
-                            "example": "www.example.com"
-                        },
-                        {
-                            "name": "indicator.x509.issuer.state_or_province",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of state or province names (ST, S, or P)",
-                            "example": "California"
-                        },
-                        {
-                            "name": "indicator.x509.not_after",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Time at which the certificate is no longer considered valid.",
-                            "example": "2020-07-16T03:15:39Z"
-                        },
-                        {
-                            "name": "indicator.x509.not_before",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Time at which the certificate is first considered valid.",
-                            "example": "2019-08-16T01:40:25Z"
-                        },
-                        {
-                            "name": "indicator.x509.public_key_algorithm",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Algorithm used to generate the public key.",
-                            "example": "RSA"
-                        },
-                        {
-                            "name": "indicator.x509.public_key_curve",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The curve used by the elliptic curve public key algorithm. This is algorithm specific.",
-                            "example": "nistp521"
-                        },
-                        {
-                            "name": "indicator.x509.public_key_exponent",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Exponent used to derive the public key. This is algorithm specific.",
-                            "example": 65537,
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "indicator.x509.public_key_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The size of the public key space in bits.",
-                            "example": 2048
-                        },
-                        {
-                            "name": "indicator.x509.serial_number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique serial number issued by the certificate authority. For consistency, if this value is alphanumeric, it should be formatted without colons and uppercase characters.",
-                            "example": "55FBB9C7DEBF09809D12CCAA"
-                        },
-                        {
-                            "name": "indicator.x509.signature_algorithm",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identifier for certificate signature algorithm. We recommend using names found in Go Lang Crypto library. See https://github.com/golang/go/blob/go1.14/src/crypto/x509/x509.go#L337-L353.",
-                            "example": "SHA256-RSA"
-                        },
-                        {
-                            "name": "indicator.x509.subject.common_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of common names (CN) of subject.",
-                            "example": "shared.global.example.net"
-                        },
-                        {
-                            "name": "indicator.x509.subject.country",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of country \\(C) code",
-                            "example": "US"
-                        },
-                        {
-                            "name": "indicator.x509.subject.distinguished_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguished name (DN) of the certificate subject entity.",
-                            "example": "C=US, ST=California, L=San Francisco, O=Example, Inc., CN=shared.global.example.net"
-                        },
-                        {
-                            "name": "indicator.x509.subject.locality",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of locality names (L)",
-                            "example": "San Francisco"
-                        },
-                        {
-                            "name": "indicator.x509.subject.organization",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizations (O) of subject.",
-                            "example": "Example, Inc."
-                        },
-                        {
-                            "name": "indicator.x509.subject.organizational_unit",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of organizational units (OU) of subject."
-                        },
-                        {
-                            "name": "indicator.x509.subject.state_or_province",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of state or province names (ST, S, or P)",
-                            "example": "California"
-                        },
-                        {
-                            "name": "indicator.x509.version_number",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of x509 format.",
-                            "example": 3
-                        },
-                        {
-                            "name": "software.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software id.",
-                            "example": "S0552"
-                        },
-                        {
-                            "name": "software.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software name.",
-                            "example": "AdFind"
-                        },
-                        {
-                            "name": "software.platforms",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The platforms of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use MITRE ATT&CK® software platform values.",
-                            "example": "[ \"Windows\" ]"
-                        },
-                        {
-                            "name": "software.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference URL of the software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software reference URL.",
-                            "example": "https://attack.mitre.org/software/S0552/"
-                        },
-                        {
-                            "name": "software.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of software used by this threat to conduct behavior commonly modeled using MITRE ATT&CK®.\nWhile not required, you can use a MITRE ATT&CK® software type.",
-                            "example": "Tool"
-                        },
-                        {
-                            "name": "tactic.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )",
-                            "example": "TA0002"
-                        },
-                        {
-                            "name": "tactic.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the type of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/)",
-                            "example": "Execution"
-                        },
-                        {
-                            "name": "tactic.reference",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference url of tactic used by this threat. You can use a MITRE ATT&CK® tactic, for example. (ex. https://attack.mitre.org/tactics/TA0002/ )",
-                            "example": "https://attack.mitre.org/tactics/TA0002/"
-                        },
-                        {
-                            "name": "technique.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
-                            "example": "T1059"
-                        },
-                        {
-                            "name": "technique.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Command and Scripting Interpreter"
-                        },
-                        {
-                            "name": "technique.reference",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference url of technique used by this threat. You can use a MITRE ATT&CK® technique, for example. (ex. https://attack.mitre.org/techniques/T1059/)",
-                            "example": "https://attack.mitre.org/techniques/T1059/"
-                        },
-                        {
-                            "name": "technique.subtechnique.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The full id of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
-                            "example": "T1059.001"
-                        },
-                        {
-                            "name": "technique.subtechnique.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "PowerShell"
-                        },
-                        {
-                            "name": "technique.subtechnique.reference",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The reference url of subtechnique used by this threat. You can use a MITRE ATT&CK® subtechnique, for example. (ex. https://attack.mitre.org/techniques/T1059/001/)",
-                            "example": "https://attack.mitre.org/techniques/T1059/001/"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "build": {
-                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-                    },
-                    "id": "2b1eb7f7-bd61-436a-98af-c2b182043476",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "container": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "image": {
-                        "name": "docker.io/library/nginx",
-                        "tag": "latest"
-                    },
-                    "name": "nginx"
-                },
-                "cloud": {
-                    "account": {
-                        "id": "1234"
-                    },
-                    "instance": {
-                        "name": "webserver-12"
-                    },
-                    "project": {
-                        "id": "1234"
-                    },
-                    "provider": "aws",
-                    "region": "us-east-1"
-                },
-                "orchestrator": {
-                    "cluster": {
-                        "name": "webservers"
-                    },
-                    "namespace": "webapp",
-                    "resource": {
-                        "name": "webservers",
-                        "type": "kubernetes"
-                    }
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw"
-                        ],
-                        "protection": "PsProtectedSignerWinSystem",
-                        "user": "SYSTEM",
-                        "architecture": "x86_64",
-                        "token": {
-                            "elevation": true,
-                            "integrity_level_name": "system",
-                            "domain": "NT AUTHORITY",
-                            "user": "SYSTEM",
-                            "elevation_type": "default",
-                            "sid": "S-1-5-18"
-                        },
-                        "memory_region": {
-                            "region_size": 4096,
-                            "region_protection": "RWX",
-                            "allocation_base": 2401471234048,
-                            "allocation_type": "PRIVATE",
-                            "bytes_allocation_offset": 0,
-                            "region_state": "COMMIT",
-                            "bytes_compressed_present": false,
-                            "region_start_bytes": "58354f2150254041505b345c505a58353428505e2937434329377d2445494341522d5354414e444152442d414e544956495255532d544553542d46494c452124",
-                            "allocation_protection": "RW-",
-                            "region_base": 2401471238144,
-                            "allocation_size": 8192,
-                            "bytes_address": 2401471234048
-                        }
-                    },
-                    "parent": {
-                        "Ext": {
-                            "protection": "",
-                            "user": "",
-                            "architecture": "unknown"
-                        },
-                        "name": "System Idle Process",
-                        "start": "2022-04-04T12:15:41.4606245Z",
-                        "pid": 0,
-                        "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTAtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
-                        "command_line": "",
-                        "executable": "",
-                        "ppid": 0,
-                        "uptime": 822
-                    },
-                    "pe": {},
-                    "name": "System",
-                    "start": "2022-04-04T12:15:41.4606245Z",
-                    "pid": 4,
-                    "entity_id": "MmIxZWI3ZjctYmQ2MS00MzZhLTk4YWYtYzJiMTgyMDQzNDc2LTQtMTMyOTM1NDczMTkuOTk5Mjc0NjAw",
-                    "command_line": "",
-                    "executable": "",
-                    "thread": {
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "instruction_pointer": 140705188471348,
-                                    "memory_section": {
-                                        "memory_address": 140705187827712,
-                                        "memory_size": 1163264,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "ntdll.dll",
-                                    "module_path": "c:\\windows\\system32\\ntdll.dll",
-                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!NtAlpcSendWaitReceivePort+0x14"
-                                },
-                                {
-                                    "instruction_pointer": 140705158956066,
-                                    "memory_section": {
-                                        "memory_address": 140705158664192,
-                                        "memory_size": 921600,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "rpcrt4.dll",
-                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879048422"
-                                },
-                                {
-                                    "instruction_pointer": 140705158944113,
-                                    "memory_section": {
-                                        "memory_address": 140705158664192,
-                                        "memory_size": 921600,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "rpcrt4.dll",
-                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF879045571"
-                                },
-                                {
-                                    "instruction_pointer": 140705158854463,
-                                    "memory_section": {
-                                        "memory_address": 140705158664192,
-                                        "memory_size": 921600,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "rpcrt4.dll",
-                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF87902F73F"
-                                },
-                                {
-                                    "instruction_pointer": 140705155101013,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9B155"
-                                },
-                                {
-                                    "instruction_pointer": 140705155097096,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C9A208"
-                                },
-                                {
-                                    "instruction_pointer": 140705155090820,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C98984"
-                                },
-                                {
-                                    "instruction_pointer": 140705155093243,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C992FB"
-                                },
-                                {
-                                    "instruction_pointer": 140705155073556,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878C94614"
-                                },
-                                {
-                                    "instruction_pointer": 140705155277630,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC633E"
-                                },
-                                {
-                                    "instruction_pointer": 140705158666224,
-                                    "memory_section": {
-                                        "memory_address": 140705158664192,
-                                        "memory_size": 921600,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "rpcrt4.dll",
-                                    "module_path": "c:\\windows\\system32\\rpcrt4.dll",
-                                    "symbol_info": "c:\\windows\\system32\\rpcrt4.dll!0x7FF8790017F0"
-                                },
-                                {
-                                    "instruction_pointer": 140705155255496,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878CC0CC8"
-                                },
-                                {
-                                    "instruction_pointer": 140705155775858,
-                                    "memory_section": {
-                                        "memory_address": 140705154535424,
-                                        "memory_size": 2334720,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "combase.dll",
-                                    "module_path": "c:\\windows\\system32\\combase.dll",
-                                    "symbol_info": "c:\\windows\\system32\\combase.dll!0x7FF878D3FD72"
-                                },
-                                {
-                                    "instruction_pointer": 140704876148243,
-                                    "memory_section": {
-                                        "memory_address": 140704875483136,
-                                        "memory_size": 708608,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "fastprox.dll",
-                                    "module_path": "c:\\windows\\system32\\wbem\\fastprox.dll",
-                                    "symbol_info": "c:\\windows\\system32\\wbem\\fastprox.dll!0x7FF868293613"
-                                },
-                                {
-                                    "instruction_pointer": 140699640718787,
-                                    "memory_section": {
-                                        "memory_address": 140699634241536,
-                                        "memory_size": 9220096,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "alertstests.exe",
-                                    "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
-                                    "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301AE5C3"
-                                },
-                                {
-                                    "instruction_pointer": 140699640807495,
-                                    "memory_section": {
-                                        "memory_address": 140699634241536,
-                                        "memory_size": 9220096,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "alertstests.exe",
-                                    "module_path": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe",
-                                    "symbol_info": "c:\\users\\vagrant\\endpoint-dev\\build\\_ws-vs2019-x64-dbg\\alertstests\\debug\\alertstests.exe!0x7FF7301C4047"
-                                },
-                                {
-                                    "instruction_pointer": 140705160001044,
-                                    "memory_section": {
-                                        "memory_address": 140705159909376,
-                                        "memory_size": 520192,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "kernel32.dll",
-                                    "module_path": "c:\\windows\\system32\\kernel32.dll",
-                                    "symbol_info": "c:\\windows\\system32\\kernel32.dll!BaseThreadInitThunk+0x14"
-                                },
-                                {
-                                    "instruction_pointer": 140705188161185,
-                                    "memory_section": {
-                                        "memory_address": 140705187827712,
-                                        "memory_size": 1163264,
-                                        "protection": "R-X"
-                                    },
-                                    "module_name": "ntdll.dll",
-                                    "module_path": "c:\\windows\\system32\\ntdll.dll",
-                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                }
-                            ],
-                            "call_stack_final_hook_module": {
-                                "code_signature": [
-                                    {
-                                        "exists": true,
-                                        "status": "trusted",
-                                        "subject_name": "Microsoft Corporation",
-                                        "trusted": true
-                                    }
-                                ],
-                                "hash": {
-                                    "sha256": "e5bfc1a2967fa513177a0327770927d9a2efa5a4f33ac18f716bae7c3f857994"
-                                },
-                                "path": "c:\\program files (x86)\\microsoft\\edgewebview\\application\\131.0.2903.112\\msedge_elf.dll"
-                            },
-                            "call_stack_final_user_module": {
-                                "code_signature": [
-                                    {
-                                        "exists": true,
-                                        "status": "trusted",
-                                        "subject_name": "Microsoft Windows",
-                                        "trusted": true
-                                    }
-                                ],
-                                "hash": {
-                                    "sha256": "8c9740e7fe9c97d5782b8d3db102c7880c40f0b27f20d3ec9f334fe0161b7e55"
-                                },
-                                "name": "rpcrt4.dll",
-                                "path": "c:\\windows\\system32\\rpcrt4.dll"
-                            },
-                            "call_stack_summary": "ntdll.dll, rpcrt4.dll, combase.dll, rpcrt4.dll, combase.dll, fastprox.dll, alertstests.exe, kernel32.dll, ntdll.dll",
-                            "hardware_breakpoint_set": true,
-                            "start_address": 140699640807104,
-                            "start_address_module": "C:\\Users\\vagrant\\endpoint-dev\\Build\\_WS-vs2019-x64-dbg\\AlertsTests\\Debug\\AlertsTests.exe"
-                        },
-                        "id": 5752
-                    },
-                    "uptime": 822
-                },
-                "rule": {
-                    "ruleset": "production"
-                },
-                "message": "Malware Prevention Alert",
-                "@timestamp": "2022-04-04T12:15:41.5944062Z",
-                "file": {
-                    "Ext": {
-                        "temp_file_path": "C:\\Windows\\TEMP\\90edbe42-fe6c-4965-8a6b-222aa2b15cf2",
-                        "code_signature": [
-                            {
-                                "exists": false
-                            }
-                        ],
-                        "quarantine_path": "C:\\.equarantine\\20a65f043449c96f10e538a860a415b55ff46c93",
-                        "quarantine_message": "Success",
-                        "quarantine_result": true,
-                        "malware_classification": {
-                            "identifier": "endpointpe-v4-model",
-                            "score": 0.692318737506866,
-                            "threshold": 0.58,
-                            "version": "4.0.19000"
-                        }
-                    },
-                    "owner": "Administrators",
-                    "extension": "dll",
-                    "drive_letter": "C",
-                    "created": "2022-04-04T12:15:41.4606245Z",
-                    "accessed": "2022-04-04T12:15:41.4606245Z",
-                    "mtime": "2022-04-04T12:15:41.4606245Z",
-                    "directory": "C:\\sysmon",
-                    "path": "C:\\sysmon\\9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
-                    "code_signature": {
-                        "exists": false
-                    },
-                    "size": 4608,
-                    "pe": {
-                        "file_version": "0.0.0.0",
-                        "description": " ",
-                        "original_file_name": "5t5mpwxc.dll",
-                        "Ext": {
-                            "dotnet": true,
-                            "streams": [
-                                {
-                                    "name": "#~",
-                                    "hash": {
-                                        "md5": "debf08c09d49337fbe7acde4d3749242",
-                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
-                                    }
-                                },
-                                {
-                                    "name": "#Blob",
-                                    "hash": {
-                                        "md5": "debf08c09d49337fbe7acde4d3749242",
-                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
-                                    }
-                                }
-                            ],
-                            "sections": [
-                                {
-                                    "name": ".reloc",
-                                    "hash": {
-                                        "md5": "debf08c09d49337fbe7acde4d3749242",
-                                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53"
-                                    }
-                                }
-                            ]
-                        }
-                    },
-                    "name": "9C0E42A47D34240A9A4101CC5D3BC5787DC5AD73DEBF08C09D49337FBE7ACDE4D374924290143DFB2E3210F18E1BCC50EB6C3961D11071E3EC024215B8835E468FA63E53DAE02F32A21E03CE65412F6E56942DAA.dll",
-                    "hash": {
-                        "sha1": "9c0e42a47d34240a9a4101cc5d3bc5787dc5ad73",
-                        "sha256": "90143dfb2e3210f18e1bcc50eb6c3961d11071e3ec024215b8835e468fa63e53",
-                        "md5": "debf08c09d49337fbe7acde4d3749242"
-                    }
-                },
-                "Endpoint": {
-                    "policy": {
-                        "applied": {
-                            "artifacts": {
-                                "global": {
-                                    "identifiers": [
-                                        {
-                                            "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
-                                            "name": "diagnostic-configuration-v1"
-                                        },
-                                        {
-                                            "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
-                                            "name": "diagnostic-endpointpe-v4-blocklist"
-                                        },
-                                        {
-                                            "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
-                                            "name": "diagnostic-endpointpe-v4-exceptionlist"
-                                        },
-                                        {
-                                            "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
-                                            "name": "diagnostic-endpointpe-v4-model"
-                                        },
-                                        {
-                                            "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
-                                            "name": "diagnostic-malware-signature-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
-                                            "name": "diagnostic-ransomware-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
-                                            "name": "diagnostic-rules-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
-                                            "name": "endpointpe-v4-blocklist"
-                                        },
-                                        {
-                                            "sha256": "d784c2aa70a2216dd5bfeecfdd67a83ff5b656e9321bd70cf345a8667a63fb2e",
-                                            "name": "endpointpe-v4-exceptionlist"
-                                        },
-                                        {
-                                            "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
-                                            "name": "endpointpe-v4-model"
-                                        },
-                                        {
-                                            "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
-                                            "name": "global-configuration-v1"
-                                        },
-                                        {
-                                            "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
-                                            "name": "global-exceptionlist-windows"
-                                        },
-                                        {
-                                            "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
-                                            "name": "global-trustlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
-                                            "name": "production-malware-signature-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
-                                            "name": "production-ransomware-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
-                                            "name": "production-rules-windows-v1"
-                                        }
-                                    ],
-                                    "update_age": 0,
-                                    "snapshot": "2023-09-26",
-                                    "version": "1.0.260"
-                                },
-                                "user": {
-                                    "identifiers": [
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-blocklist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-eventfilterlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-exceptionlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-hostisolationexceptionlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-trustlist-windows-v1"
-                                        }
-                                    ],
-                                    "version": "1.0.0"
-                                }
-                            }
-                        }
-                    }
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.alerts"
-                },
-                "elastic": {
-                    "agent": {
-                        "id": "2b1eb7f7-bd61-436a-98af-c2b182043476"
-                    }
-                },
-                "host": {
-                    "hostname": "security-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.34",
-                        "fe80::4850:4f4f:4b53:8103",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "security-win-1",
-                    "id": "bbea673e-eae6-4b03-8724-2183f79da331",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "severity": 73,
-                    "code": "malicious_file",
-                    "risk_score": 73,
-                    "created": "2022-04-04T12:15:41.5944062Z",
-                    "kind": "alert",
-                    "module": "endpoint",
-                    "type": [
-                        "info",
-                        "change",
-                        "denied"
-                    ],
-                    "agent_id_status": "verified",
-                    "sequence": 29414,
-                    "ingested": "2022-04-04T12:19:33Z",
-                    "action": "rename",
-                    "id": "MYfSjQEEEFe1o09b+++++D5Q",
-                    "category": [
-                        "malware",
-                        "intrusion_detection",
-                        "file"
-                    ],
-                    "dataset": "endpoint.alerts",
-                    "outcome": "success"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM"
-                },
-                "Memory_protection": {
-                    "cross_session": false,
-                    "feature": "shellcode_thread",
-                    "parent_to_child": false,
-                    "self_injection": false,
-                    "unique_key_v2": "00633d00b651c48e61a94589db67e00fd454a5a905409e38de4e48c183105f67"
-                },
-                "Responses": [
-                    {
-                        "@timestamp": "2023-04-13T16:15:16.0Z",
-                        "action": {
-                            "action": "file_rollback",
-                            "file": {
-                                "attributes": [
-                                    "invalid"
-                                ],
-                                "path": "",
-                                "reason": 2147484160
-                            },
-                            "source": {
-                                "attributes": [
-                                    "archive"
-                                ],
-                                "path": "\\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy55\\git\\endpoint-dev\\Python\\runtime\\failed_test_logs\\20230413_181248\\EndpointRollbackTestCase\\test_rollback_trigger_malware_1_prevent\\tmp\\TRA14KA5Z2\\ExceptionlistTester-Windows.1d1phoq97d"
-                            }
-                        },
-                        "message": "Successful production rollback",
-                        "result": 0
-                    },
-                    {
-                        "@timestamp": "2023-04-13T16:15:16.0Z",
-                        "action": {
-                            "action": "registry_rollback",
-                            "key": {
-                                "actions": [
-                                    "Deleted"
-                                ],
-                                "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback\\1"
-                            }
-                        },
-                        "message": "Successful production registry rollback",
-                        "result": 0
-                    },
-                    {
-                        "@timestamp": "2023-04-13T16:15:16.0Z",
-                        "action": {
-                            "action": "registry_rollback",
-                            "key": {
-                                "actions": [
-                                    "Modified"
-                                ],
-                                "path": "\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432Node\\TestRollback.valuetest",
-                                "values": [
-                                    {
-                                        "actions": [
-                                            "Deleted"
-                                        ],
-                                        "name": "SomeValue"
-                                    }
-                                ]
-                            }
-                        }
-                    },
-                    {
-                        "@timestamp": "2023-07-19T14:21:05.0Z",
-                        "action": {
-                            "action": "process_rollback",
-                            "process": {
-                                "path": "C:\\Users\\Pawel Mirski\\AppData\\Local\\Programs\\Python\\Python38-32\\python.exe"
-                            }
-                        },
-                        "message": "Successful production process rollback",
-                        "result": 0
-                    }
-                ]
-            }
-        },
-        {
-            "name": "policy",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Endpoint",
-                    "title": "Endpoint",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
-                    "fields": [
-                        {
-                            "name": "configuration",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
-                        },
-                        {
-                            "name": "configuration.isolation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Configuration setting for Host Isolation from the network"
-                        },
-                        {
-                            "name": "policy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The policy fields are used to hold information about applied policy."
-                        },
-                        {
-                            "name": "policy.applied",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about the policy that is applied"
-                        },
-                        {
-                            "name": "policy.applied.actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "actions applied during the application of the policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.actions.message",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "message about the application of the action to further qualify the status of the action"
-                        },
-                        {
-                            "name": "policy.applied.actions.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "name of the action that was applied"
-                        },
-                        {
-                            "name": "policy.applied.actions.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the status of the action"
-                        },
-                        {
-                            "name": "policy.applied.artifacts",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about global protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.channel",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "global artifacts rollout channel"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "the identifiers of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of global artifact applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.identifiers.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the sha256 of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.snapshot",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the snapshot date of applied global artifacts or 'latest'"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.update_age",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "number of days since global artifacts were made up-to-date"
-                        },
-                        {
-                            "name": "policy.applied.artifacts.global.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of global artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about user protection artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "the identifiers of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of user artifact applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.identifiers.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the sha256 of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.artifacts.user.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of user artifacts applied."
-                        },
-                        {
-                            "name": "policy.applied.endpoint_policy_version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of this applied policy"
-                        },
-                        {
-                            "name": "policy.applied.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the id of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of this applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "the response of actions that failed in the applied policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.response.configurations",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "the configurations of the applied policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.antivirus_registration",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall antivirus registration configuration and status of the applied policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.antivirus_registration.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for antivirus registration"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.antivirus_registration.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of antivirus registration, this is correlated to the status of concerned actions but  not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.attack_surface_reduction.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for attack surface reduction"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.attack_surface_reduction.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of attack surface reduction, this is correlated to the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.behavior_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for behavior_protection"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.behavior_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of behavior_protection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.events",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall event collection configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.events.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for event collection"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.events.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of event collection, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.host_isolation.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for host isolation"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.host_isolation.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of host isolation, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.logging",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall logging configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.logging.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for logging"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.logging.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of logging, this is correlated to the status of concerned actions but  not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.malware",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall malware configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.malware.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for malware"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.malware.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of malware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.memory_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall memory_protection configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.memory_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for memory_protection"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.memory_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of memory_protection, this is correlated to the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.ransomware.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for ransomware"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.ransomware.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of ransomware, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.streaming",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "overall data streaming configuration and status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.streaming.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for data streaming"
-                        },
-                        {
-                            "name": "policy.applied.response.configurations.streaming.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of data streaming, this is correlated to the status of concerned actions  but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "the diagnostic configurations of the applied policy",
-                            "enabled": false
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.behavior_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of behavior protection"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.behavior_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of behavior protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.credential_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of credential protection"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.credential_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of credential protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.malware.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of malware"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.malware.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of malware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.memory_protection.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of memory protection"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.memory_protection.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of memory protection, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.memory_scan.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of memory scan"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.memory_scan.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of memory scan, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.ransomware.concerned_actions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "all actions that were taken for the diagnostic configuration of ransomware"
-                        },
-                        {
-                            "name": "policy.applied.response.diagnostic.ransomware.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the overall status of the diagnostic configuration of ransomware, this is correlated to  the status of concerned actions but not a simple sum of the actions"
-                        },
-                        {
-                            "name": "policy.applied.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the status of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the version of this applied policy"
-                        },
-                        {
-                            "name": "state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
-                        },
-                        {
-                            "name": "state.isolation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Current network isolation state of the host"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "build.original",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Extended build information for the agent.\nThis field is intended to contain any build information that a data source may provide, no specific formatting is required.",
-                            "example": "metricbeat version 7.6.0 (amd64), libbeat 7.6.0 [6a23e8f8f30f5001ba344e4e54d8d9cb82cb107c built 2020-02-05 23:10:10 +0000 UTC]"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "build": {
-                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-                    },
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "message": "Endpoint policy change",
-                "@timestamp": "2022-04-04T18:38:15.7178887Z",
-                "Endpoint": {
-                    "configuration": {
-                        "isolation": false
-                    },
-                    "state": {
-                        "isolation": false
-                    },
-                    "policy": {
-                        "applied": {
-                            "response": {
-                                "configurations": {
-                                    "behavior_protection": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "configure_file_events",
-                                            "configure_network_events",
-                                            "configure_process_events",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "configure_imageload_events",
-                                            "configure_dns_events",
-                                            "configure_security_events",
-                                            "configure_registry_events",
-                                            "configure_malicious_behavior"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "streaming": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "configure_output",
-                                            "workflow"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "malware": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "configure_malware",
-                                            "configure_kernel",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "connect_kernel",
-                                            "configure_user_notification",
-                                            "configure_alerts",
-                                            "detect_file_open_events",
-                                            "detect_sync_image_load_events"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "logging": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "configure_logging",
-                                            "workflow"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "antivirus_registration": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "configure_antivirus_registration",
-                                            "workflow"
-                                        ],
-                                        "status": "unsupported"
-                                    },
-                                    "host_isolation": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "configure_host_isolation",
-                                            "load_config",
-                                            "workflow",
-                                            "connect_kernel",
-                                            "configure_user_notification"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "events": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "detect_network_events",
-                                            "configure_file_events",
-                                            "configure_network_events",
-                                            "configure_process_events",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "detect_file_open_events",
-                                            "detect_file_access_events",
-                                            "detect_async_image_load_events",
-                                            "detect_registry_events",
-                                            "detect_registry_access_events",
-                                            "configure_imageload_events",
-                                            "configure_dns_events",
-                                            "configure_security_events",
-                                            "configure_registry_events"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "ransomware": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "configure_process_events",
-                                            "configure_file_events",
-                                            "configure_ransomware",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "configure_user_notification"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "memory_protection": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "configure_memory_threat",
-                                            "configure_process_events",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "workflow",
-                                            "load_config",
-                                            "detect_process_events",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "detect_thread_events"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "attack_surface_reduction": {
-                                        "concerned_actions": [
-                                            "agent_connectivity",
-                                            "configure_credential_hardening",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "workflow",
-                                            "load_config",
-                                            "configure_kernel",
-                                            "connect_kernel"
-                                        ],
-                                        "status": "success"
-                                    }
-                                },
-                                "diagnostic": {
-                                    "behavior_protection": {
-                                        "concerned_actions": [
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "configure_file_events",
-                                            "configure_network_events",
-                                            "configure_process_events",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "configure_imageload_events",
-                                            "configure_dns_events",
-                                            "configure_security_events",
-                                            "configure_registry_events",
-                                            "configure_diagnostic_rollback",
-                                            "detect_process_handle_events",
-                                            "configure_diagnostic_malicious_behavior"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "malware": {
-                                        "concerned_actions": [
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "configure_diagnostic_malware",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "connect_kernel",
-                                            "configure_kernel",
-                                            "detect_file_open_events",
-                                            "detect_sync_image_load_events",
-                                            "configure_diagnostic_rollback"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "ransomware": {
-                                        "concerned_actions": [
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "detect_process_events",
-                                            "detect_file_write_events",
-                                            "configure_process_events",
-                                            "configure_file_events",
-                                            "configure_diagnostic_ransomware",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "configure_diagnostic_rollback"
-                                        ],
-                                        "status": "success"
-                                    },
-                                    "memory_protection": {
-                                        "concerned_actions": [
-                                            "load_config",
-                                            "workflow",
-                                            "download_global_artifacts",
-                                            "download_user_artifacts",
-                                            "detect_process_events",
-                                            "configure_process_events",
-                                            "configure_diagnostic_memory_threat",
-                                            "configure_kernel",
-                                            "connect_kernel",
-                                            "detect_thread_events",
-                                            "configure_diagnostic_rollback"
-                                        ],
-                                        "status": "success"
-                                    }
-                                }
-                            },
-                            "name": "endpoint-1",
-                            "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
-                            "actions": [
-                                {
-                                    "name": "configure_antivirus_registration",
-                                    "message": "Antivirus registration is not possible on servers",
-                                    "status": "unsupported"
-                                },
-                                {
-                                    "name": "configure_ransomware",
-                                    "message": "Successfully enabled ransomware prevention with mbr enabled and canaries enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_memory_threat",
-                                    "message": "Successfully enabled memory threat prevention with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_memory_threat",
-                                    "message": "Successfully enabled memory threat detection with memory scanning enabled and shellcode protection enabled including trampoline monitoring",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_host_isolation",
-                                    "message": "Host is not isolated",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_malicious_behavior",
-                                    "message": "Enabled 152 out of 152 malicious behavior rules",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_malicious_behavior",
-                                    "message": "Enabled 196 out of 196 diagnostic malicious behavior rules",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_user_notification",
-                                    "message": "Successfully configured user notification",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_malware",
-                                    "message": "Successfully enabled malware prevention",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_malware",
-                                    "message": "Successfully enabled malware detection",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_rollback",
-                                    "message": "Diagnostic system rollback is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_kernel",
-                                    "message": "Successfully configured kernel",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_output",
-                                    "message": "Successfully configured output connection",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_alerts",
-                                    "message": "Successfully configured alerts",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_logging",
-                                    "message": "Successfully configured logging",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "load_config",
-                                    "message": "Successfully parsed configuration",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "download_user_artifacts",
-                                    "message": "Successfully downloaded user artifacts",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "download_global_artifacts",
-                                    "message": "Global artifacts are available for use",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "connect_kernel",
-                                    "message": "Successfully connected to kernel",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_process_events",
-                                    "message": "Successfully started process event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_sync_image_load_events",
-                                    "message": "Successfully started sync image load event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_async_image_load_events",
-                                    "message": "Successfully started async image load event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_file_write_events",
-                                    "message": "Successfully started file write event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_file_open_events",
-                                    "message": "Successfully stopped file open event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_network_events",
-                                    "message": "Successfully started network event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_registry_events",
-                                    "message": "Successfully started registry event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_thread_events",
-                                    "message": "Successfully configured thread events",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_file_access_events",
-                                    "message": "Successfully configured file access event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_registry_access_events",
-                                    "message": "Successfully configured registry access event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "detect_process_handle_events",
-                                    "message": "Successfully started process handle event reporting",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_file_events",
-                                    "message": "Success enabling file events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_network_events",
-                                    "message": "Success enabling network events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_process_events",
-                                    "message": "Success enabling process events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_imageload_events",
-                                    "message": "Success enabling image load events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_dns_events",
-                                    "message": "Success enabling dns events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_registry_events",
-                                    "message": "Success enabling registry events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_security_events",
-                                    "message": "Success enabling security events; current state is enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_diagnostic_ransomware",
-                                    "message": "Successfully enabled ransomware detection with mbr enabled and canaries enabled",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "agent_connectivity",
-                                    "message": "Successfully connected to Agent",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "workflow",
-                                    "message": "Successfully executed all workflows",
-                                    "status": "success"
-                                },
-                                {
-                                    "name": "configure_credential_hardening",
-                                    "message": "Successfully configured credential hardening",
-                                    "status": "success"
-                                }
-                            ],
-                            "endpoint_policy_version": "1",
-                            "version": "2",
-                            "artifacts": {
-                                "global": {
-                                    "channel": "stable",
-                                    "identifiers": [
-                                        {
-                                            "sha256": "e57a7d5638060e9655c64ac1d02f7949b87e5f5f27f2074329608db1e06d645b",
-                                            "name": "diagnostic-configuration-v1"
-                                        },
-                                        {
-                                            "sha256": "c33693fcadb720d4d37706cd2ca77b28a8c59a424ab3f251b2b07ac7975eb2f4",
-                                            "name": "diagnostic-endpointpe-v4-blocklist"
-                                        },
-                                        {
-                                            "sha256": "d47bfd600e3a8f79e290dfb0306e8abe7be11b75b36ba98132f46b8971f7f071",
-                                            "name": "diagnostic-endpointpe-v4-exceptionlist"
-                                        },
-                                        {
-                                            "sha256": "8609faa372f8761bf199a03325f56577d2fd47630d6dba386b6eb33562aef6e3",
-                                            "name": "diagnostic-endpointpe-v4-model"
-                                        },
-                                        {
-                                            "sha256": "52bc8b59292b5017bb091f97fa395881b127b07dec6182f91c4b84074ae6e7bc",
-                                            "name": "diagnostic-malware-signature-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "dcbaa744fc672d8db32010a1422aafa6e0cf86816d34b1d4df9f273f106be425",
-                                            "name": "diagnostic-ransomware-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "b680beed0f3ca83ae78802e972bf4bb12ecea2b1649a7aafd16e6fec8c9a0ede",
-                                            "name": "diagnostic-rules-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "1d591a12ce8ae215ebdcdabc81fc912cd51162e7a8e35bcdc1676bc3125cebbf",
-                                            "name": "endpointpe-v4-blocklist"
-                                        },
-                                        {
-                                            "sha256": "b49fdcd8bf63af07ab1e74352137eb20f1e3710640dfcb1bfff3f7273ee14a7f",
-                                            "name": "endpointpe-v4-exceptionlist"
-                                        },
-                                        {
-                                            "sha256": "c05c025cce1c2b5808c180dc4986eb519c0affd30d7c27f67fdd14bde3224638",
-                                            "name": "endpointpe-v4-model"
-                                        },
-                                        {
-                                            "sha256": "b98dc812e3cd9c9aa21462bb8b2bac86158d6d2d97ea4aac6731c069f6babb4d",
-                                            "name": "global-configuration-v1"
-                                        },
-                                        {
-                                            "sha256": "7acbe147698a40c817775d471ea30c2fe4dfa7a9f54271e6dbc073131c5a3bcb",
-                                            "name": "global-exceptionlist-windows"
-                                        },
-                                        {
-                                            "sha256": "dfb2b428357b756d9f5b593c02dce99b026c9e2afeb76cdb8e8c76c6db78290a",
-                                            "name": "global-trustlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "611a02c398c58ebe2f6d9d63621778de96263ef7fa885098ce62a22c411d67bc",
-                                            "name": "production-malware-signature-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "363cb9d7bbc013d9bc171a6a29fdfe486f1c987ef2c0cdfa3c283fc4c5a4a595",
-                                            "name": "production-ransomware-v1-windows"
-                                        },
-                                        {
-                                            "sha256": "b07cf3beacd69e6922d344448a8c6d03e96ae6d5ec1e540415fe2f4804bcb631",
-                                            "name": "production-rules-windows-v1"
-                                        }
-                                    ],
-                                    "update_age": 0,
-                                    "snapshot": "2023-09-26",
-                                    "version": "1.0.261"
-                                },
-                                "user": {
-                                    "identifiers": [
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-blocklist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-eventfilterlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-exceptionlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-hostisolationexceptionlist-windows-v1"
-                                        },
-                                        {
-                                            "sha256": "d801aa1fb7ddcc330a5e3173372ea6af4a3d08ec58074478e85aa5603e926658",
-                                            "name": "endpoint-trustlist-windows-v1"
-                                        }
-                                    ],
-                                    "version": "1.0.0"
-                                }
-                            },
-                            "status": "success"
-                        }
-                    }
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "metrics",
-                    "dataset": "endpoint.policy"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 35122,
-                    "ingested": "2022-04-04T18:38:16Z",
-                    "created": "2022-04-04T18:38:15.7178887Z",
-                    "kind": "state",
-                    "module": "endpoint",
-                    "action": "endpoint_policy_response",
-                    "id": "MYfZG00oEwD2/fqT+++++Bye",
-                    "category": [
-                        "host"
-                    ],
-                    "type": [
-                        "change"
-                    ],
-                    "dataset": "endpoint.policy"
-                }
-            }
-        },
-        {
-            "name": "registry",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Effective_process",
-                    "title": "Effective_process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
-                    "fields": [
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the effective process.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Executable name for the effective process.",
-                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name for the effective process.",
-                            "example": "WMIC.exe"
-                        },
-                        {
-                            "name": "pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process ID.",
-                            "example": 4242
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": true
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "registry",
-                    "title": "Registry",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to Windows Registry operations.",
-                    "fields": [
-                        {
-                            "name": "data.bytes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original bytes written with base64 encoding.\nFor Windows registry operations, such as SetValueEx and RegQueryValueEx, this corresponds to the data pointed by `lp_data`. This is optional but provides better recoverability and should be populated for REG_BINARY encoded values.",
-                            "example": "ZQBuAC0AVQBTAAAAZQBuAAAAAAA="
-                        },
-                        {
-                            "name": "data.strings",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "wildcard",
-                            "description": "Content when writing string types.\nPopulated as an array when writing string data to the registry. For single string registry types (REG_SZ, REG_EXPAND_SZ), this should be an array with one string. For sequences of string with REG_MULTI_SZ, this array will be variable length. For numeric data, such as REG_DWORD and REG_QWORD, this should be populated with the decimal representation (e.g `\"1\"`).",
-                            "example": "[\"C:\\rta\\red_ttp\\bin\\myapp.exe\"]"
-                        },
-                        {
-                            "name": "data.type",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Standard registry type for encoding contents",
-                            "example": "REG_SZ"
-                        },
-                        {
-                            "name": "hive",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Abbreviated name for the hive.",
-                            "example": "HKLM"
-                        },
-                        {
-                            "name": "key",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hive-relative path of keys.",
-                            "example": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path, including hive, key and value",
-                            "example": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\winword.exe\\Debugger"
-                        },
-                        {
-                            "name": "value",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the value written.",
-                            "example": "Debugger"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "registry": {
-                    "hive": "HKLM",
-                    "path": "HKLM\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
-                    "data": {
-                        "strings": [],
-                        "type": "REG_NONE"
-                    },
-                    "value": "Enabled",
-                    "key": "SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
-                },
-                "agent": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "Effective_process": {
-                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
-                    "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
-                    "name": "WMIC.exe",
-                    "pid": 2732
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-                        ],
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows Publisher",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ]
-                    },
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows Publisher",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "name": "svchost.exe",
-                    "pid": 2772,
-                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
-                    "executable": "C:\\Windows\\System32\\svchost.exe",
-                    "thread": {
-                        "id": 340,
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "allocation_private_bytes": 16384,
-                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "protection": "RWX",
-                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                }
-                            ],
-                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                            "hardware_breakpoint_set": true
-                        }
-                    }
-                },
-                "message": "Endpoint registry event",
-                "@timestamp": "2022-04-04T18:53:09.1283846Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.registry"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 36271,
-                    "ingested": "2022-04-04T18:53:18Z",
-                    "created": "2022-04-04T18:53:09.1283846Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "query",
-                    "id": "MYfZG00oEwD2/fqT+++++CMy",
-                    "category": [
-                        "registry"
-                    ],
-                    "type": [
-                        "access"
-                    ],
-                    "dataset": "endpoint.events.registry"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                }
-            }
-        },
-        {
-            "name": "process",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "ephemeral_id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Ephemeral identifier of this agent (if one exists).\nThis id normally changes across restarts, but `agent.id` does not.",
-                            "example": "8a4f500f"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
-                            "example": "foo"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "cloud",
-                    "title": "Cloud",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to the cloud or infrastructure the events are coming from.",
-                    "fields": [
-                        {
-                            "name": "account.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The cloud account or organization id used to identify different entities in a multi-tenant environment.\nExamples: AWS account id, Google Cloud ORG Id, or other unique identifier.",
-                            "example": 666777888999
-                        },
-                        {
-                            "name": "instance.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Instance name of the host machine."
-                        },
-                        {
-                            "name": "project.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The cloud project identifier.\nExamples: Google Cloud Project id, Azure Project id.",
-                            "example": "my-project"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean.",
-                            "example": "aws"
-                        },
-                        {
-                            "name": "region",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region in which this host, resource, or service is located.",
-                            "example": "us-east-1"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.\nThe cloud fields may be self-nested under cloud.origin.* and cloud.target.* to describe origin or target service's cloud information in the context of incoming or outgoing requests, respectively. However, the fieldsets cloud.origin.* and cloud.target.* must not be confused with the root cloud fieldset that is used to describe the cloud context of the actual service under observation. The fieldset cloud.origin.* may only be used in the context of incoming requests or events to provide the originating service's cloud information. The fieldset cloud.target.* may only be used in the context of outgoing requests or events to describe the target service's cloud information."
-                },
-                {
-                    "name": "container",
-                    "title": "Container",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Container fields are used for meta information about the specific container that is the source of information.\nThese fields help correlate data based containers from any runtime.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique container id."
-                        },
-                        {
-                            "name": "image.hash.all",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of digests of the image the container was built on. Each digest consists of the hash algorithm and value in this format: `algorithm:value`. Algorithm names should align with the field names in the ECS hash field set.",
-                            "example": "[sha256:f8fefc80e3273dc756f288a63945820d6476ad64883892c771b5e2ece6bf1b26]"
-                        },
-                        {
-                            "name": "image.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the image the container was built on."
-                        },
-                        {
-                            "name": "image.tag",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Container image tags."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Container name."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "boot.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Linux boot uuid taken from /proc/sys/kernel/random/boot_id. Note the boot_id value from /proc may or may not be the same in containers as on the host. Some container runtimes will bind mount a new boot_id value onto the proc file in each container.",
-                            "example": "88a1f0ed-5ae5-41ee-af6b-41921c311872"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "pid_ns_ino",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is the inode number of the namespace in the namespace file system (nsfs). Unsigned int inum in include/linux/ns_common.h.",
-                            "example": 256383
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "orchestrator",
-                    "title": "Orchestrator",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields that describe the resources which container orchestrators manage or act upon.",
-                    "fields": [
-                        {
-                            "name": "cluster.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID of the cluster."
-                        },
-                        {
-                            "name": "cluster.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the cluster."
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Namespace in which the action is taking place.",
-                            "example": "kube-system"
-                        },
-                        {
-                            "name": "resource.ip",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "ip",
-                            "description": "IP address assigned to the resource associated with the event being observed. In the case of a Kubernetes Pod, this array would contain only one element: the IP of the Pod (as opposed to the Node on which the Pod is running)."
-                        },
-                        {
-                            "name": "resource.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the resource being acted upon.",
-                            "example": "test-pod-cdcws"
-                        },
-                        {
-                            "name": "resource.parent.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type or kind of the parent resource associated with the event being observed. In Kubernetes, this will be the name of a built-in workload resource (e.g., Deployment, StatefulSet, DaemonSet).",
-                            "example": "DaemonSet"
-                        },
-                        {
-                            "name": "resource.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of resource being acted upon.",
-                            "example": "service"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "package",
-                    "title": "Package",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about an installed software package. It contains general information about a package, such as name, version or size. It also contains installation details, such as time or location.",
-                    "fields": [
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Package name",
-                            "example": "go"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.created_suspended",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.defense_evasions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of defense evasions found in this process. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include Process Doppelganging and Process Herpaderping."
-                        },
-                        {
-                            "name": "Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "Ext.dll.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.mapped_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The base address where this module is loaded."
-                        },
-                        {
-                            "name": "Ext.dll.Ext.mapped_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size of this module's memory mapping, in bytes."
-                        },
-                        {
-                            "name": "Ext.dll.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "Ext.dll.path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "Ext.effective_parent.entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the effective process.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "Ext.effective_parent.executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Executable name for the effective process.",
-                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
-                        },
-                        {
-                            "name": "Ext.effective_parent.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name for the effective process.",
-                            "example": "WMIC.exe"
-                        },
-                        {
-                            "name": "Ext.effective_parent.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process ID.",
-                            "example": 4242
-                        },
-                        {
-                            "name": "Ext.memfd",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for memfd events."
-                        },
-                        {
-                            "name": "Ext.memfd.flag_allow_seal",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Allow sealing operations on this file.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flag_cloexec",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Sets the the close-on-exec flag on the new file descriptor.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flag_exec",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Exec flag is set for file.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flag_hugetlb",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "The anonymous file will be created in the hugetlbfs filesystem using huge pages.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flag_noexec_seal",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Sets both NOEXEC and MFD_ALLOW_SEALING.",
-                            "example": "false"
-                        },
-                        {
-                            "name": "Ext.memfd.flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Flags passed to the memfd operation.",
-                            "example": "2"
-                        },
-                        {
-                            "name": "Ext.memfd.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Filename for the created file. Appears in /proc/self/fd.",
-                            "example": "anon.txt"
-                        },
-                        {
-                            "name": "Ext.mitigation_policies",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process mitigation policies include SignaturePolicy, DynamicCodePolicy, UserShadowStackPolicy, ControlFlowGuardPolicy, etc. Examples include Microsoft only, CF Guard, User Shadow Stack enabled"
-                        },
-                        {
-                            "name": "Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "Ext.ptrace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for ptrace events."
-                        },
-                        {
-                            "name": "Ext.ptrace.child_pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "PID of the ptrace target."
-                        },
-                        {
-                            "name": "Ext.ptrace.request",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "ptrace request."
-                        },
-                        {
-                            "name": "Ext.relative_file_creation_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Number of seconds since the process's file was created. This number may be negative if the file's timestamp is in the future."
-                        },
-                        {
-                            "name": "Ext.relative_file_name_modify_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Number of seconds since the process's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
-                        },
-                        {
-                            "name": "Ext.session",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Session information for the current process"
-                        },
-                        {
-                            "name": "Ext.session_info.authentication_package",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of authentication package used to log on, such as NTLM, Kerberos, or CloudAP"
-                        },
-                        {
-                            "name": "Ext.session_info.client_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Client's IPv4 or IPv6 address as a string, if available."
-                        },
-                        {
-                            "name": "Ext.session_info.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Session ID"
-                        },
-                        {
-                            "name": "Ext.session_info.logon_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Session logon type.  Examples include Interactive, Network, and Service."
-                        },
-                        {
-                            "name": "Ext.session_info.relative_logon_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Process creation time, relative to logon time, in seconds."
-                        },
-                        {
-                            "name": "Ext.session_info.relative_password_age",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Process creation time, relative to the last time the password was changed, in seconds."
-                        },
-                        {
-                            "name": "Ext.session_info.user_flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of user flags associated with this logon session. Examples include LOGON_NTLMV2_ENABLED and LOGON_WINLOGON."
-                        },
-                        {
-                            "name": "Ext.shmget",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for shmget events."
-                        },
-                        {
-                            "name": "Ext.shmget.flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "flags passed to shmget."
-                        },
-                        {
-                            "name": "Ext.shmget.key",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Key passed to the shmget request."
-                        },
-                        {
-                            "name": "Ext.shmget.size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Requested size."
-                        },
-                        {
-                            "name": "Ext.token.elevation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the token is elevated or not"
-                        },
-                        {
-                            "name": "Ext.token.elevation_level",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "Ext.token.elevation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "What level of elevation the token has",
-                            "example": "one of \"default\", \"full\", \"limited\""
-                        },
-                        {
-                            "name": "Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "Ext.token.security_attributes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of security attributes of the token, retrieved via the  TokenSecurityAttributes class.",
-                            "example": "TSA://ProcUnique, LUA://DecHdAutoAp"
-                        },
-                        {
-                            "name": "Ext.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the process is a trusted application"
-                        },
-                        {
-                            "name": "Ext.trusted_descendant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether or not the process is a descendent of a trusted application"
-                        },
-                        {
-                            "name": "args",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "end",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process ended.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "entry_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "entry_leader.attested_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.attested_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.attested_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "entry_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.entry_meta.source.ip",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the source (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "entry_leader.entry_meta.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The entry type for the entry session leader. Values include: init(e.g systemd), sshd, ssm, kubelet, teleport, terminal, console\nNote: This field is only set on process.session_leader."
-                        },
-                        {
-                            "name": "entry_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "entry_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "entry_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "entry_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.parent.session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "entry_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "entry_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "entry_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "entry_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "entry_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "entry_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "entry_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "entry_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "entry_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "entry_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "env_vars",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of environment variable bindings. Captured from a snapshot of the environment at the time of execution.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"PATH=/usr/local/bin:/usr/bin\", \"USER=ubuntu\"]"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "group_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "group_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "group_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "group_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "group_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "group_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "group_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "group_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "group_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "group_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "group_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "group_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "group_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "group_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "io",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "A chunk of input or output (IO) from a single process.\nThis field only appears on the top level process object, which is the process that wrote the output or read the input."
-                        },
-                        {
-                            "name": "io.max_bytes_per_process_exceeded",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "If true, the process producing the output has exceeded the max_kilobytes_per_process configuration setting."
-                        },
-                        {
-                            "name": "io.text",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "A chunk of output or input sanitized to UTF-8.\nBest efforts are made to ensure complete lines are captured in these events. Assumptions should NOT be made that multiple lines will appear in the same event. TTY output may contain terminal control codes such as for cursor movement, so some string queries may not match due to terminal codes inserted between characters of a word."
-                        },
-                        {
-                            "name": "io.total_bytes_captured",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The total number of bytes captured in this event."
-                        },
-                        {
-                            "name": "io.total_bytes_skipped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The total number of bytes that were not captured due to implementation restrictions such as buffer size limits. Implementors should strive to ensure this value is always zero"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "parent.Ext.architecture",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process architecture.  It can differ from host architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "parent.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The field set containing process info in case of any pid spoofing. This is mainly useful for process.parent."
-                        },
-                        {
-                            "name": "parent.Ext.real.pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "For process.parent this will be the ppid of the process that actually spawned the current process."
-                        },
-                        {
-                            "name": "parent.Ext.user",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User associated with the running process."
-                        },
-                        {
-                            "name": "parent.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "parent.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "parent.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "parent.code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "parent.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "parent.code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "parent.exit_code",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The exit code of the process, if this is a termination event.\nThe field should be absent if there is no exit code for the event (e.g. process start).",
-                            "example": 137
-                        },
-                        {
-                            "name": "parent.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.group_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.group_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "parent.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "parent.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "parent.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "parent.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "parent.pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "parent.pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "parent.pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "parent.pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "parent.pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "parent.pgid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.ppid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "parent.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "parent.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "parent.thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": true
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack_contains_unbacked",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
-                        },
-                        {
-                            "name": "parent.thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "parent.thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "parent.thread.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "parent.thread.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "parent.title",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ]
-                        },
-                        {
-                            "name": "parent.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "parent.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "parent.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "parent.uptime",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "parent.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "parent.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "parent.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "pgid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Deprecated for removal in next major version release. This field is superseded by `process.group_leader.pid`.\nIdentifier of the group of processes the process belongs to.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "ppid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "previous.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "previous.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "previous.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.args",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of process arguments, starting with the absolute path to the executable.\nMay be filtered to protect sensitive information.",
-                            "example": "[\"/usr/bin/ssh\", \"-l\", \"user\", \"10.0.0.16\"]"
-                        },
-                        {
-                            "name": "session_leader.args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "session_leader.command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "session_leader.group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.interactive",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Whether the process is connected to an interactive shell.\nProcess interactivity is inferred from the processes file descriptors. If the character device for the controlling tty is the same as stdin and stderr for the process, the process is considered interactive.\nNote: A non-interactive process can belong to an interactive session and is simply one that does not have open file descriptors reading the controlling TTY on FD 0 (stdin) or writing to the controlling TTY on FD 2 (stderr). A backgrounded process is still considered interactive if stdin and stderr are connected to the controlling TTY.",
-                            "example": true
-                        },
-                        {
-                            "name": "session_leader.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "session_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.parent.session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.parent.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.real_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.real_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.real_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.real_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.same_as_process",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "This boolean is used to identify if a leader process is the same as the top level process.\nFor example, if `process.group_leader.same_as_process = true`, it means the process event in question is the leader of its process group. Details under `process.*` like `pid` would be the same under `process.group_leader.*` The same applies for both `process.session_leader` and `process.entry_leader`.\nThis field exists to the benefit of EQL and other rule engines since it's not possible to compare equality between two fields in a single document. e.g `process.entity_id` = `process.group_leader.entity_id` (top level process is the process group leader) OR `process.entity_id` = `process.entry_leader.entity_id` (top level process is the entry session leader)\nInstead these rules could be written like: `process.group_leader.same_as_process: true` OR `process.entry_leader.same_as_process: true`\nNote: This field is only set on `process.entry_leader`, `process.session_leader` and `process.group_leader`.",
-                            "example": true
-                        },
-                        {
-                            "name": "session_leader.saved_group.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.saved_group.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.saved_user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.saved_user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.start",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "session_leader.supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "session_leader.supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "session_leader.tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "session_leader.tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "session_leader.tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "session_leader.user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "session_leader.user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "session_leader.working_directory",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "The time the process started.",
-                            "example": "2016-05-23T08:05:34.853Z"
-                        },
-                        {
-                            "name": "supplemental_groups.id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "supplemental_groups.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "thread.capabilities.effective",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is the set of capabilities used by the kernel to perform permission checks for the thread.",
-                            "example": "[\"CAP_BPF\", \"CAP_SYS_ADMIN\"]",
-                            "pattern": "^(CAP_[A-Z_]+|\\d+)$"
-                        },
-                        {
-                            "name": "thread.capabilities.permitted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is a limiting superset for the effective capabilities that the thread may assume.",
-                            "example": "[\"CAP_BPF\", \"CAP_SYS_ADMIN\"]",
-                            "pattern": "^(CAP_[A-Z_]+|\\d+)$"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Thread name.",
-                            "example": "thread-0"
-                        },
-                        {
-                            "name": "title",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process title.\nThe proctitle, some times the same as process name. Can also be different: for example a browser setting its title to the web page currently opened.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "tty",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "object",
-                            "description": "Information about the controlling TTY device. If set, the process belongs to an interactive session."
-                        },
-                        {
-                            "name": "tty.char_device.major",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The major number identifies the driver associated with the device. The character device's major and minor numbers can be algorithmically combined to produce the more familiar terminal identifiers such as \"ttyS0\" and \"pts/0\". For more details, please refer to the Linux kernel documentation.",
-                            "example": 4
-                        },
-                        {
-                            "name": "tty.char_device.minor",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The minor number is used only by the driver specified by the major number; other parts of the kernel don’t use it, and merely pass it along to the driver. It is common for a driver to control several devices; the minor number provides a way for the driver to differentiate among them.",
-                            "example": 1
-                        },
-                        {
-                            "name": "tty.columns",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The number of character columns per line. e.g terminal width\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'",
-                            "example": 80
-                        },
-                        {
-                            "name": "tty.rows",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "The number of character rows in the terminal. e.g terminal height\nTerminal sizes can change, so this value reflects the maximum value for a given IO event. i.e. where event.action = 'text_output'",
-                            "example": 24
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the process has been up.",
-                            "example": 1325
-                        },
-                        {
-                            "name": "user.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "user.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "working_directory",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The working directory of the process.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "container": {
-                    "id": "8d38b2f18290e973c5ea8f9ee207e970a8aa9191fa89bf3d4ea2a126f2f010a6",
-                    "image": {
-                        "name": "gke.gcr.io/csi-node-driver-registrar:v2.5.0-gke.1",
-                        "tag": [
-                            "v2.5.0-gke.1"
-                        ],
-                        "hash": {
-                            "all": [
-                                "sha256:f7988fb6c02e0ce69257d9bd9cf37ae20a60f1df7563c3a2a6abe24160306b8d"
-                            ]
-                        }
-                    },
-                    "name": "csi-driver-registrar"
-                },
-                "cloud": {
-                    "account": {
-                        "id": "1234"
-                    },
-                    "instance": {
-                        "name": "webserver-12"
-                    },
-                    "project": {
-                        "id": "1234"
-                    },
-                    "provider": "aws",
-                    "region": "us-east-1"
-                },
-                "orchestrator": {
-                    "cluster": {
-                        "id": "f0cd61d5-327b-43e0-bc94-d9ea922fb4b5",
-                        "name": "webservers"
-                    },
-                    "namespace": "webapp",
-                    "resource": {
-                        "ip": [
-                            "10.1.237.155"
-                        ],
-                        "name": "pdcsi-node-6zh4j",
-                        "type": "pod",
-                        "parent": {
-                            "type": "DaemonSet"
-                        }
-                    }
-                },
-                "process": {
-                    "entry_leader": {
-                        "attested_user": {
-                            "id": "123",
-                            "name": "userA"
-                        },
-                        "attested_groups": {
-                            "name": "groupA"
-                        }
-                    },
-                    "Ext": {
-                        "ancestry": [
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-                        ],
-                        "memfd": {
-                            "flag_hugetlb": false,
-                            "flag_allow_seal": true,
-                            "flags": 2,
-                            "name": "test_memfd",
-                            "flag_exec": false,
-                            "flag_cloexec": false,
-                            "flag_noexec_seal": false
-                        },
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows Publisher",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "created_suspended": true,
-                        "mitigation_policies": [
-                            "Microsoft only, Opt-in to restrict to Microsoft, Windows Store and WHQL",
-                            "CET dynamic APIs can only be called out of proc",
-                            "CF Guard"
-                        ],
-                        "protection": "PsProtectedSignerAntimalware-Light",
-                        "device": {
-                            "volume_device_type": "Disk File System"
-                        },
-                        "authentication_id": "0x3e7",
-                        "token": {
-                            "integrity_level_name": "system",
-                            "security_attributes": [
-                                "TSA://ProcUnique"
-                            ],
-                            "elevation_level": "default"
-                        },
-                        "effective_parent": {
-                            "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
-                            "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
-                            "name": "WMIC.exe",
-                            "pid": 2732
-                        },
-                        "relative_file_creation_time": 48628704.4029488,
-                        "relative_file_name_modify_time": 48628704.4029488,
-                        "session_info": {
-                            "logon_type": "Interactive",
-                            "client_address": "127.0.0.1",
-                            "id": 1,
-                            "authentication_package": "NTLM",
-                            "relative_logon_time": 0.1,
-                            "relative_password_age": 2592000.123,
-                            "user_flags": [
-                                "LOGON_EXTRA_SIDS",
-                                "LOGON_NTLMV2_ENABLED",
-                                "LOGON_WINLOGON"
-                            ]
-                        }
-                    },
-                    "parent": {
-                        "args": [],
-                        "name": "services.exe",
-                        "pid": 600,
-                        "args_count": 0,
-                        "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                        "command_line": "",
-                        "executable": "C:\\Windows\\System32\\services.exe",
-                        "thread": {
-                            "Ext": {
-                                "call_stack": [
-                                    {
-                                        "allocation_private_bytes": 16384,
-                                        "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                        "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                        "protection": "RWX",
-                                        "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                    }
-                                ],
-                                "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                                "call_stack_contains_unbacked": true,
-                                "hardware_breakpoint_set": true
-                            }
-                        }
-                    },
-                    "pid": 2772,
-                    "working_directory": "C:\\Windows\\system32\\",
-                    "end": "2022-07-18T21:05:19.9419692Z",
-                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTI3NzItMTMyOTM1NzE5ODguNjU3ODk4NjAw",
-                    "executable": "C:\\Windows\\System32\\svchost.exe",
-                    "args": [
-                        "C:\\Windows\\System32\\svchost.exe",
-                        "-k",
-                        "WerSvcGroup"
-                    ],
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows Publisher",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "pe": {
-                        "original_file_name": "svchost.exe"
-                    },
-                    "name": "svchost.exe",
-                    "args_count": 3,
-                    "command_line": "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
-                    "hash": {
-                        "sha1": "4fbfc6004084d97032837c21d3f426892d868eac",
-                        "sha256": "cb19fd67b1d028e01f54c426a0924528c4a8d8ed8996cfe0ee0c6e45285436a1",
-                        "md5": "1b280ad032268a636ecfe6f9165431b7"
-                    },
-                    "tty": {
-                        "char_device": {
-                            "major": 4,
-                            "minor": 1
-                        },
-                        "rows": 24,
-                        "columns": 80
-                    },
-                    "io": {
-                        "text": "helloworld",
-                        "total_bytes_captured": 10,
-                        "total_bytes_skipped": 0,
-                        "max_bytes_per_process_exceeded": false
-                    },
-                    "env_vars": [
-                        "NICK=test",
-                        "OTHER=why"
-                    ]
-                },
-                "message": "Endpoint process event",
-                "@timestamp": "2022-04-04T18:53:08.6578986Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.process"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 36236,
-                    "ingested": "2022-04-04T18:53:18Z",
-                    "created": "2022-04-04T18:53:08.6578986Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "start",
-                    "id": "MYfZG00oEwD2/fqT+++++CLz",
-                    "category": [
-                        "process"
-                    ],
-                    "type": [
-                        "start"
-                    ],
-                    "dataset": "endpoint.events.process"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                }
-            }
-        },
-        {
-            "name": "security",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Target",
-                    "title": "Target",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
-                    "fields": [
-                        {
-                            "name": "process.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "file",
-                    "title": "File",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
-                    "fields": [
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.authentication_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process authentication ID"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "effective.domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "effective.email",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "effective.full_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "effective.hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "effective.id",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "effective.name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text"
-                                }
-                            ],
-                            "example": "a.einstein"
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "winlog",
-                    "title": "Winlog",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields provide detailed information regarding events logged in the Windows Event Log. The Windows Event Log is a centralized system used by Windows to record events related to system, application, and security activities. Each event log entry is categorized by a specific event type, and contains relevant metadata that can include the event source, event ID, timestamp, user details, and other associated data.",
-                    "fields": [
-                        {
-                            "name": "event_data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The event-specific data. This is a non-exhaustive list of parameters that are used in Windows events."
-                        },
-                        {
-                            "name": "event_data.PrivilegeList",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of sensitive privileges, assigned to the new logon.",
-                            "example": "SeTcbPrivilege, SeSecurityPrivilege"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "Target": {
-                    "process": {
-                        "Ext": {
-                            "authentication_id": "0x3e7"
-                        }
-                    }
-                },
-                "agent": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "file": {
-                    "path": "/User/admin/Downloads/application",
-                    "code_signature": {
-                        "signing_id": "com.developer.identifier",
-                        "team_id": "XYZABC"
-                    }
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-                        ],
-                        "authentication_id": "0x3e7",
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows Publisher",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ]
-                    },
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows Publisher",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "name": "C:\\Windows\\System32\\services.exe",
-                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                    "executable": "C:\\Windows\\System32\\services.exe"
-                },
-                "message": "Endpoint security event",
-                "@timestamp": "2022-04-04T18:53:08.6510289Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.security"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 36385,
-                    "ingested": "2022-04-04T18:53:18Z",
-                    "created": "2022-04-04T18:53:08.6510289Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "log_on",
-                    "id": "MYfZG00oEwD2/fqT+++++CQ/",
-                    "category": [
-                        "authentication",
-                        "session"
-                    ],
-                    "type": [
-                        "start"
-                    ],
-                    "dataset": "endpoint.events.security",
-                    "outcome": "success"
-                },
-                "user": {
-                    "domain": "DESKTOP-1TK590J",
-                    "effective": {
-                        "domain": "DESKTOP-1TK590J",
-                        "name": "EafTestLogon80589",
-                        "id": "S-1-5-18",
-                        "email": "EafTestLogon80589@DESKTOP-1TK590J.local",
-                        "full_name": "EafTestLogon80589",
-                        "hash": "f1297b0233914ec6ebf8fc01195e8712dfd8322f5e8d9d8bbe0083a0fc1860fd"
-                    },
-                    "id": "S-1-5-21-1749029863-1064264096-968553628-1001",
-                    "name": "Default"
-                },
-                "winlog": {
-                    "event_data": {
-                        "PrivilegeList": [
-                            "SeSecurityPrivilege",
-                            "SeTakeOwnershipPrivilege",
-                            "SeLoadDriverPrivilege",
-                            "SeBackupPrivilege",
-                            "SeRestorePrivilege",
-                            "SeDebugPrivilege",
-                            "SeSystemEnvironmentPrivilege",
-                            "SeImpersonatePrivilege",
-                            "SeDelegateSessionUserImpersonatePrivilege"
-                        ]
-                    }
-                }
-            }
-        },
-        {
-            "name": "metadata",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "Endpoint",
-                    "title": "Endpoint",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
-                    "fields": [
-                        {
-                            "name": "capabilities",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 128,
-                            "description": "Enabled capabilities",
-                            "doc_values": false
-                        },
-                        {
-                            "name": "configuration",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Configuration fields represent the intended and applied setting for fields not part of a Policy setting This reflects what a given field is configured to do. The actual state of that same field is found in Endpoint.state"
-                        },
-                        {
-                            "name": "configuration.isolation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Configuration setting for Host Isolation from the network"
-                        },
-                        {
-                            "name": "policy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The policy fields are used to hold information about applied policy."
-                        },
-                        {
-                            "name": "policy.applied",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "information about the policy that is applied"
-                        },
-                        {
-                            "name": "policy.applied.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the id of the applied policy"
-                        },
-                        {
-                            "name": "policy.applied.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the name of this applied policy"
-                        },
-                        {
-                            "name": "policy.applied.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "the status of the applied policy"
-                        },
-                        {
-                            "name": "state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Represents the current state of a non-policy setting These fields reflect the current status of a field, which may differ from what it is configured to be (see Endpoint.configuration)"
-                        },
-                        {
-                            "name": "state.isolation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Current network isolation state of the host"
-                        },
-                        {
-                            "name": "status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The current status of the endpoint e.g. enrolled, unenrolled."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Custom name of the agent.\nThis is a name that can be given to an agent. This can be helpful if for example two Filebeat instances are running on the same host but a human readable separation is needed on which Filebeat instance data is coming from.",
-                            "example": "foo"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "elastic",
-                    "title": "Elastic",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Holds fields and properties of data points and concepts in the elastic domain or namespace.",
-                    "fields": [
-                        {
-                            "name": "agent",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The agent fields contain data about the Elastic Agent. The Elastic Agent is the management agent that manages other agents or process on the host."
-                        },
-                        {
-                            "name": "agent.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this elastic agent (if one exists).",
-                            "example": "c2a9093e-e289-4c0a-aa44-8c32a414fa7a"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "build": {
-                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-                    },
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "@timestamp": "2022-04-04T12:33:36.6664577Z",
-                "Endpoint": {
-                    "capabilities": [
-                        "isolation"
-                    ],
-                    "configuration": {
-                        "isolation": false
-                    },
-                    "state": {
-                        "isolation": false
-                    },
-                    "policy": {
-                        "applied": {
-                            "name": "endpoint-1",
-                            "id": "b372bc3f-e9b3-4b2d-9dfe-ae677ed83933",
-                            "status": "success"
-                        }
-                    },
-                    "status": "enrolled"
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "metrics",
-                    "dataset": "endpoint.metadata"
-                },
-                "elastic": {
-                    "agent": {
-                        "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21"
-                    }
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 5054,
-                    "ingested": "2022-04-04T12:33:37Z",
-                    "created": "2022-04-04T12:33:36.6664577Z",
-                    "kind": "metric",
-                    "module": "endpoint",
-                    "action": "endpoint_metadata",
-                    "id": "MYfZG00oEwD2/fqT+++++/SC",
-                    "category": [
-                        "host"
-                    ],
-                    "type": [
-                        "info"
-                    ],
-                    "dataset": "endpoint.metadata"
-                }
-            }
-        },
-        {
-            "name": "action_responses",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "action_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The action id",
-                    "path": "EndpointActions.action_id"
-                },
-                {
-                    "name": "agent_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Alias field that maps to {agent: {id}}",
-                    "path": "agent.id"
-                },
-                {
-                    "name": "completed_at",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Request completion timestamp when the response is done executing. Usually matches with @timestamp.",
-                    "path": "EndpointActions.completed_at"
-                },
-                {
-                    "name": "data.alert_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "List of alert ids that triggered the action",
-                    "path": "EndpointActions.data.alert_id"
-                },
-                {
-                    "name": "data.command",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The action that is requested",
-                    "path": "EndpointActions.data.command"
-                },
-                {
-                    "name": "data.comment",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "A comment that describes the action that is requested",
-                    "path": "EndpointActions.data.comment"
-                },
-                {
-                    "name": "started_at",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Timestamp of start of request",
-                    "path": "EndpointActions.started_at"
-                },
-                {
-                    "name": "status",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The status of the request that distinguishes if the request is queued, running or completed.",
-                    "path": "EndpointActions.status"
-                },
-                {
-                    "name": "EndpointActions",
-                    "title": "Endpoint Actions",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields to describe the endpoint  action requests and responses.",
-                    "fields": [
-                        {
-                            "name": "action_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action id"
-                        },
-                        {
-                            "name": "completed_at",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Request completion timestamp when the response is done executing. Usually matches with @timestamp."
-                        },
-                        {
-                            "name": "data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The action request information"
-                        },
-                        {
-                            "name": "data.alert_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of alert ids that triggered the action"
-                        },
-                        {
-                            "name": "data.command",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action that is requested",
-                            "example": "isolate"
-                        },
-                        {
-                            "name": "data.comment",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "A comment that describes the action that is requested"
-                        },
-                        {
-                            "name": "started_at",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Timestamp of start of request"
-                        },
-                        {
-                            "name": "status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The status of the request that distinguishes if the request is queued, running or completed."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "error",
-                    "title": "Error",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.",
-                    "fields": [
-                        {
-                            "name": "code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Error code describing the error."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the error."
-                        },
-                        {
-                            "name": "message",
-                            "level": "core",
-                            "type": "match_only_text",
-                            "description": "Error message."
-                        },
-                        {
-                            "name": "stack_trace",
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "The stack trace of this error in plain text.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of the error, for example the class name of the exception.",
-                            "example": "java.lang.NullPointerException"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "end",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "EndpointActions": {
-                    "completed_at": "2022-04-04T20:44:14.0Z",
-                    "data": {
-                        "comment": "Action completed successfully",
-                        "command": "isolate"
-                    },
-                    "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
-                    "started_at": "2022-04-04T20:44:08.0Z"
-                },
-                "agent": {
-                    "id": "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
-                },
-                "@timestamp": "2022-04-04T20:44:14.0Z",
-                "data_stream": {
-                    "namespace": "default",
-                    "type": ".logs",
-                    "dataset": "endpoint.action.responses"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "ingested": "2022-04-04T20:44:45Z"
-                }
-            }
-        },
-        {
-            "name": "collection",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                }
-            ]
-        },
-        {
-            "name": "library",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Effective_process",
-                    "title": "Effective_process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
-                    "fields": [
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the effective process.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Executable name for the effective process.",
-                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name for the effective process.",
-                            "example": "WMIC.exe"
-                        },
-                        {
-                            "name": "pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process ID.",
-                            "example": 4242
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dll",
-                    "title": "DLL",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.defense_evasions",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of defense evasions found for this DLL. These defense evasions can make it harder to inspect a process and/or cause abnormal OS behavior. Examples tools that can cause defense evasions include KnownDlls hijacking and PPLDump."
-                        },
-                        {
-                            "name": "Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "Ext.load_index",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "A DLL can be loaded into a process multiple times. This field indicates the Nth time that this DLL has been loaded.\nThe first load index is 1."
-                        },
-                        {
-                            "name": "Ext.relative_file_creation_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Number of seconds since the DLL's file was created. This number may be negative if the file's timestamp is in the future."
-                        },
-                        {
-                            "name": "Ext.relative_file_name_modify_time",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Number of seconds since the DLL's name was modified. This information can come from the NTFS MFT. This number may be negative if the file's timestamp is in the future."
-                        },
-                        {
-                            "name": "Ext.size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of DLL"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the library.\nThis generally maps to the name of the file on disk.",
-                            "example": "kernel32.dll"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "file",
-                    "title": "File",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": true
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTYwMC0xMzI5MzU0OTExMC40NjgyMjI3MDA=",
-                            "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ3Mi0xMzI5MzU0OTExMC4xNzIwMjY5MDA="
-                        ],
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "protection": "PsProtectedSignerAntimalware-Light"
-                    },
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "name": "VSSVC.exe",
-                    "pid": 4528,
-                    "entity_id": "NGM5YzljYjMtZjgwZi00NGQ4LTljODktNjE2ODI0M2I3ZjIxLTQ1MjgtMTMyOTM1NzEwODYuNjI4MzM0NzAw",
-                    "executable": "C:\\Windows\\System32\\VSSVC.exe",
-                    "thread": {
-                        "id": 340,
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "allocation_private_bytes": 16384,
-                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "protection": "RWX",
-                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                }
-                            ],
-                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                            "hardware_breakpoint_set": true
-                        }
-                    }
-                },
-                "dll": {
-                    "Ext": {
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Microsoft Windows",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ],
-                        "device": {
-                            "volume_device_type": "Disk File System"
-                        },
-                        "load_index": 1,
-                        "relative_file_creation_time": 48628704.4029488,
-                        "relative_file_name_modify_time": 48628704.4029488,
-                        "size": 65536
-                    },
-                    "path": "C:\\Windows\\System32\\msxml3.dll",
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Microsoft Windows",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "pe": {
-                        "file_version": "8.110.17763.1911",
-                        "imphash": "2e1d1e35c17be5497d2de33f06dc41b4",
-                        "original_file_name": "MSXML3.dll"
-                    },
-                    "name": "msxml3.dll",
-                    "hash": {
-                        "sha1": "02488fb2dbf679a3282338178b451da635b79b54",
-                        "sha256": "a9698adcf789d9e30f37dd5e6c9be0441bc37662ba7402e85071ccec2135d36c",
-                        "md5": "65e4fd0564411bb60c600fae12cde2f9"
-                    }
-                },
-                "message": "Endpoint DLL load event",
-                "@timestamp": "2022-04-04T18:38:08.3185831Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.library"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 34339,
-                    "ingested": "2022-04-04T18:38:16Z",
-                    "created": "2022-04-04T18:38:08.3185831Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "load",
-                    "id": "MYfZG00oEwD2/fqT+++++BRi",
-                    "category": [
-                        "library"
-                    ],
-                    "type": [
-                        "start"
-                    ],
-                    "dataset": "endpoint.events.library"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                },
-                "Effective_process": {
-                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTU2NS0xNjk1MTkyOTQ3",
-                    "executable": "/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal",
-                    "name": "Terminal",
-                    "pid": 565
-                }
-            }
-        },
-        {
-            "name": "heartbeat",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "billable",
-                    "level": "custom",
-                    "type": "boolean",
-                    "description": "Whether document should be included in billing calculations"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "@timestamp": "2023-07-18T20:40:09.279939Z",
-                "agent": {
-                    "id": "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-                },
-                "data_stream": {
-                    "dataset": "endpoint.heartbeat",
-                    "namespace": "default",
-                    "type": ".logs"
-                },
-                "message": "Endpoint heartbeat",
-                "event": {
-                    "ingested": "2023-07-18T20:40:09.279939Z"
-                },
-                "billable": true
-            }
-        },
-        {
-            "name": "actions",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "action_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The action id",
-                    "path": "EndpointActions.action_id"
-                },
-                {
-                    "name": "agents",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Alias field that maps to {agent: {id}}",
-                    "path": "agent.id"
-                },
-                {
-                    "name": "data.alert_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "List of alert ids that triggered the action",
-                    "path": "EndpointActions.data.alert_id"
-                },
-                {
-                    "name": "data.command",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The action that is requested",
-                    "path": "EndpointActions.data.command"
-                },
-                {
-                    "name": "data.comment",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "A comment that describes the action that is requested",
-                    "path": "EndpointActions.data.comment"
-                },
-                {
-                    "name": "expiration",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Request expiration timestamp",
-                    "path": "EndpointActions.expiration"
-                },
-                {
-                    "name": "input_type",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The input type of the action, distinguishes endpoint actions as `endpoint`",
-                    "path": "EndpointActions.input_type"
-                },
-                {
-                    "name": "type",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "Distinguishes the type of input. Usually set to `INPUT_ACTION`",
-                    "path": "EndpointActions.type"
-                },
-                {
-                    "name": "user_id",
-                    "level": "custom",
-                    "type": "alias",
-                    "description": "The user id",
-                    "path": "user.id"
-                },
-                {
-                    "name": "EndpointActions",
-                    "title": "Endpoint Actions",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields to describe the endpoint  action requests and responses.",
-                    "fields": [
-                        {
-                            "name": "action_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action id"
-                        },
-                        {
-                            "name": "data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The action request information"
-                        },
-                        {
-                            "name": "data.alert_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "List of alert ids that triggered the action"
-                        },
-                        {
-                            "name": "data.command",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action that is requested",
-                            "example": "isolate"
-                        },
-                        {
-                            "name": "data.comment",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "A comment that describes the action that is requested"
-                        },
-                        {
-                            "name": "expiration",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "date",
-                            "description": "Request expiration timestamp"
-                        },
-                        {
-                            "name": "input_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The input type of the action, distinguishes endpoint actions as `endpoint`"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Distinguishes the type of input. Usually set to `INPUT_ACTION`"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "error",
-                    "title": "Error",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields can represent errors of any kind.\nUse them for errors that happen while fetching events or in cases where the event itself contains an error.",
-                    "fields": [
-                        {
-                            "name": "code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Error code describing the error."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the error."
-                        },
-                        {
-                            "name": "message",
-                            "level": "core",
-                            "type": "match_only_text",
-                            "description": "Error message."
-                        },
-                        {
-                            "name": "stack_trace",
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "The stack trace of this error in plain text.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of the error, for example the class name of the exception.",
-                            "example": "java.lang.NullPointerException"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "end",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "rule",
-                    "title": "Rule",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Rule fields are used to capture the specifics of any observer or agent rules that generate alerts or other notable events.\nExamples of data sources that would populate the rule fields include: network admission control platforms, network or host IDS/IPS, network firewalls, web application firewalls, url filters, endpoint detection and response (EDR) systems, etc.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A rule ID that is unique within the scope of an agent, observer, or other entity using the rule for detection of this event.",
-                            "example": 101
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the rule or signature generating the event.",
-                            "example": "BLOCK_DNS_over_TLS"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "EndpointActions": {
-                    "data": {
-                        "comment": "testing isolation",
-                        "command": "isolate"
-                    },
-                    "action_id": "cfa1d245-24ad-4867-8043-475d4ee2a111",
-                    "input_type": "endpoint",
-                    "expiration": "2022-04-18T20:44:07.805Z",
-                    "type": "INPUT_ACTION"
-                },
-                "agent": {
-                    "id": [
-                        "c8cad7f3-9e62-43d0-94ed-8c51670fae62"
-                    ]
-                },
-                "@timestamp": "2022-04-04T20:44:07.805Z",
-                "event": {
-                    "agent_id_status": "auth_metadata_missing",
-                    "ingested": "2022-04-04T20:44:07Z"
-                },
-                "user": {
-                    "id": "user@elastic.co"
-                }
-            }
-        },
-        {
-            "name": "file",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Effective_process",
-                    "title": "Effective_process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about an effective process.\nThe effective process is the process that requested the a specific action, without directly performing it.\nProcesses can have effective parents that differ from their regular parents. For example, on Windows, \"wmic process call create notepad\" will ask WmiPrvSE.exe to launch notepad.exe. WmiPrvSE will be notepad's parent, but the wmic will be the effective parent.\nEvents can have effective processes that differ from their regular processes. For example, on Windows, \"reg add \\\\localhost\\HKLM\\Software\\Foo /v Data /t REG_SZ /d 123\"  will result in a registry event from the Remote Registry service (svchost.exe). In this case, the effective process will be reg.exe.",
-                    "fields": [
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the effective process.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Executable name for the effective process.",
-                            "example": "C:\\Windows\\System32\\wbem\\WMIC.exe"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name for the effective process.",
-                            "example": "WMIC.exe"
-                        },
-                        {
-                            "name": "pid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Process ID.",
-                            "example": 4242
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "Persistence",
-                    "title": "Persistence",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a Persistence event.",
-                    "fields": [
-                        {
-                            "name": "args",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Arguments used to execute the persistence item"
-                        },
-                        {
-                            "name": "executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The persistence item's executable"
-                        },
-                        {
-                            "name": "keepalive",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Keep alive option boolean"
-                        },
-                        {
-                            "name": "name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The persistence item's name"
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file's path"
-                        },
-                        {
-                            "name": "runatload",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Run at load option boolean"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.correlation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Information about event this should be correlated with."
-                        },
-                        {
-                            "name": "Ext.correlation.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ID of event that this event is correlated to, e.g. quarantine event associated with an unquarantine event"
-                        },
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "file",
-                    "title": "File",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A file is defined as a set of information that has been created on, or has existed on a filesystem.\nFile objects can be associated with host events, network events, and/or file events (e.g., those produced by File Integrity Monitoring [FIM] products or services). File fields provide details about the affected file associated with the event or metric.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.device.bus_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Bus type of the device, such as Nvme, Usb, FileBackedVirtual,... etc."
-                        },
-                        {
-                            "name": "Ext.device.dos_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DOS name of the device. DOS device name is in the format of driver letters such as C:, D:,..."
-                        },
-                        {
-                            "name": "Ext.device.file_system_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device file system type.\nFollowing are examples of the most frequently seen volume device file system types: NTFS UDF"
-                        },
-                        {
-                            "name": "Ext.device.nt_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "NT name of the device. NT device name is in the format such as: \\Device\\HarddiskVolume2"
-                        },
-                        {
-                            "name": "Ext.device.product_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ProductID of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.serial_number",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Serial Number of the device. It is provided by the vendor of the device if any."
-                        },
-                        {
-                            "name": "Ext.device.vendor_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "VendorID of the device. It is provided by the vendor of the device."
-                        },
-                        {
-                            "name": "Ext.device.volume_device_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Volume device type.\nFollowing are examples of the most frequently seen volume device types: Disk File System CD-ROM File System"
-                        },
-                        {
-                            "name": "Ext.entropy",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Entropy calculation of file's header and footer used to check file integrity."
-                        },
-                        {
-                            "name": "Ext.header_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "Ext.header_data",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "First 16 bytes of file used to check file integrity."
-                        },
-                        {
-                            "name": "Ext.malware_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of malware_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "The concatenated names of all yara signatures"
-                        },
-                        {
-                            "name": "Ext.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "text",
-                            "description": "Malware artifact identifier."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of bytes representing yara signature matches"
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature match."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Primary malware signature hash."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature sha256."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature id."
-                        },
-                        {
-                            "name": "Ext.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature name."
-                        },
-                        {
-                            "name": "Ext.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "An array of malware signature matches"
-                        },
-                        {
-                            "name": "Ext.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary malware signature version."
-                        },
-                        {
-                            "name": "Ext.monotonic_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "File event monotonic ID."
-                        },
-                        {
-                            "name": "Ext.original",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Original file information during a modification event."
-                        },
-                        {
-                            "name": "Ext.original.extension",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file extension prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.gid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "Ext.original.group",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "Ext.original.mode",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file mode prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file name prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.owner",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "Ext.original.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original file path prior to a modification event"
-                        },
-                        {
-                            "name": "Ext.original.uid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "Ext.windows",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Platform-specific Windows fields"
-                        },
-                        {
-                            "name": "Ext.windows.zone_identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Windows zone identifier for a file"
-                        },
-                        {
-                            "name": "accessed",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file was accessed.\nNote that not all filesystems keep track of access time."
-                        },
-                        {
-                            "name": "attributes",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Array of file attributes.\nAttributes names will vary by platform. Here's a non-exhaustive list of values that are expected in this field: archive, compressed, directory, encrypted, execute, hidden, read, readonly, system, write.",
-                            "example": "[\"readonly\", \"system\"]"
-                        },
-                        {
-                            "name": "created",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "File creation time.\nNote that not all filesystems store the creation time."
-                        },
-                        {
-                            "name": "ctime",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file attributes or metadata changed.\nNote that changes to the file content will update `mtime`. This implies `ctime` will be adjusted at the same time, since `mtime` is an attribute of the file."
-                        },
-                        {
-                            "name": "device",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device that is the source of the file.",
-                            "example": "sda"
-                        },
-                        {
-                            "name": "directory",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Directory where the file is located. It should include the drive letter, when appropriate.",
-                            "example": "/home/alice"
-                        },
-                        {
-                            "name": "drive_letter",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1,
-                            "description": "Drive letter where the file is located. This field is only relevant on Windows.\nThe value should be uppercase, and not include the colon.",
-                            "example": "C"
-                        },
-                        {
-                            "name": "extension",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File extension, excluding the leading dot.\nNote that when the file name has multiple extensions (example.tar.gz), only the last one should be captured (\"gz\", not \"tar.gz\").",
-                            "example": "png"
-                        },
-                        {
-                            "name": "gid",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group ID (GID) of the file.",
-                            "example": "1001"
-                        },
-                        {
-                            "name": "group",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Primary group name of the file.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "hash.md5",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "hash.sha1",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "hash.sha512",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "inode",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Inode representing the file in the filesystem.",
-                            "example": "256383"
-                        },
-                        {
-                            "name": "mime_type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MIME type should identify the format of the file or stream of bytes using https://www.iana.org/assignments/media-types/media-types.xhtml[IANA official types], where possible. When more than one type is applicable, the most specific type should be used."
-                        },
-                        {
-                            "name": "mode",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode of the file in octal representation.",
-                            "example": "0640"
-                        },
-                        {
-                            "name": "mtime",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "Last time the file content was modified."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the file including the extension, without the directory.",
-                            "example": "example.png"
-                        },
-                        {
-                            "name": "origin_referrer_url",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 8192,
-                            "description": "The url of the webpage that linked to the file."
-                        },
-                        {
-                            "name": "origin_url",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 8192,
-                            "description": "The url where the file is hosted."
-                        },
-                        {
-                            "name": "owner",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File owner's username.",
-                            "example": "alice"
-                        },
-                        {
-                            "name": "path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full path to the file, including the file name. It should include the drive letter, when appropriate.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/home/alice/example.png"
-                        },
-                        {
-                            "name": "pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "size",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "File size in bytes.\nOnly relevant when `file.type` is \"file\".",
-                            "example": 16384
-                        },
-                        {
-                            "name": "target_path",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Target path for symlinks.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ]
-                        },
-                        {
-                            "name": "type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "File type (file, dir, or symlink).",
-                            "example": "file"
-                        },
-                        {
-                            "name": "uid",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The user ID (UID) or security identifier (SID) of the file owner.",
-                            "example": "1001"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "args_count",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Length of the process.args array.\nThis field can be useful for querying or performing bucket analysis on how many arguments were provided to start a process. More arguments may be an indication of suspicious activity.",
-                            "example": 4
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "ppid",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Parent process' pid.",
-                            "example": 4241,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": true
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.Ext.hardware_breakpoint_set",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether a hardware breakpoint was set for the thread. This field is omitted if false.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "id": "ccb7b1a1-303e-416f-b975-311737e8e125",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "Effective_process": {
-                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI3MzItMTMyOTk3MDczNDEuMjUyNTI3NDAw",
-                    "executable": "C:\\Windows\\System32\\wbem\\WMIC.exe",
-                    "name": "WMIC.exe",
-                    "pid": 2732
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTYwNC0xMzI5MzU0OTEwOS4zNTg1OTc3MDA=",
-                            "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ3Mi0xMzI5MzU0OTEwOS43NjU4MjcwMA=="
-                        ],
-                        "code_signature": [
-                            {
-                                "trusted": true,
-                                "subject_name": "Elasticsearch, Inc.",
-                                "exists": true,
-                                "status": "trusted"
-                            }
-                        ]
-                    },
-                    "args_count": 1,
-                    "parent": {
-                        "pid": 604,
-                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
-                        "group_leader": {
-                            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-                        }
-                    },
-                    "entry_leader": {
-                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
-                        "parent": {
-                            "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-                        }
-                    },
-                    "session_leader": {
-                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-                    },
-                    "group_leader": {
-                        "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw"
-                    },
-                    "code_signature": {
-                        "trusted": true,
-                        "subject_name": "Elasticsearch, Inc.",
-                        "exists": true,
-                        "status": "trusted"
-                    },
-                    "name": "winlogbeat.exe",
-                    "pid": 4512,
-                    "thread": {
-                        "id": 340,
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "allocation_private_bytes": 16384,
-                                    "callsite_leading_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "callsite_trailing_bytes": "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000",
-                                    "protection": "RWX",
-                                    "symbol_info": "C:\\Windows\\System32\\ntdll.dll!RtlUserThreadStart+0x21"
-                                }
-                            ],
-                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll",
-                            "hardware_breakpoint_set": true
-                        }
-                    },
-                    "entity_id": "Y2NiN2IxYTEtMzAzZS00MTZmLWI5NzUtMzExNzM3ZThlMTI1LTQ1MTItMTMyOTM1NDkyODYuNzQ2MjY0MDAw",
-                    "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
-                },
-                "message": "Endpoint file event",
-                "@timestamp": "2022-04-04T18:37:01.5775771Z",
-                "file": {
-                    "Ext": {
-                        "header_data": [],
-                        "entropy": 5.28353871945538,
-                        "device": {
-                            "volume_device_type": "Disk File System"
-                        },
-                        "header_bytes": "7570646174655f74696d653a20323032",
-                        "windows": {
-                            "zone_identifier": -1
-                        },
-                        "monotonic_id": 3526
-                    },
-                    "path": "C:\\ProgramData\\winlogbeat\\.winlogbeat.yml.new",
-                    "extension": "new",
-                    "size": 1406,
-                    "name": ".winlogbeat.yml.new",
-                    "origin_referrer_url": "https://example.com",
-                    "origin_url": "https://example.com/file.zip"
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.file"
-                },
-                "host": {
-                    "hostname": "response-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.9",
-                        "fe80::4d1:ef01:c0ed:299a",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "response-win-1",
-                    "id": "bcbbe9cb-0278-43f9-aa1b-2dc9839bbf6f",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 32114,
-                    "ingested": "2022-04-04T18:37:29Z",
-                    "created": "2022-04-04T18:37:01.5775771Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "creation",
-                    "id": "MYfZFpbNKturKgFp+++++AlT",
-                    "category": [
-                        "file"
-                    ],
-                    "type": [
-                        "creation"
-                    ],
-                    "dataset": "endpoint.events.file"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                }
-            }
-        },
-        {
-            "name": "api",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Target",
-                    "title": "Target",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a target.\nThese fields provide more context about the target process and thread that are related to the data in the document. Useful in a security context where a target process or thread may be acted on by another process or thread.",
-                    "fields": [
-                        {
-                            "name": "process.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "process.Ext.created_suspended",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory allocation containing the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Original memory size requested when the memory was allocated.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "process.Ext.memory_region.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-                            "example": "PRIVATE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The address where bytes_compressed begins.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether bytes_compressed is present in this event.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the memory region.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A sequence of signature names matched.",
-                            "example": "Windows.EICAR.Not-a-virus"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature identifier"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The first matching details."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The first matching details.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of file matching signature."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of file matching signature."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the first yara rule matched."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the first yara rule matched."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Additional matching details if available.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The second matching details.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of second file matching signature.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of second file matching signature.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the second yara rule matched.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.secondary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the second yara rule matched.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature version"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
-                            "example": "C:\\Windows\\System32\\mshtml.dll"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.pehash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
-                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "PE Section List name."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.mapped_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the file at mapped_path is an executable.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.pehash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
-                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "PE Section List name."
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.memory_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether an executable file was found in memory.",
-                            "example": false
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of the memory region.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_start_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 64 bytes at the region base address.",
-                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.region_state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-                            "example": "COMMIT"
-                        },
-                        {
-                            "name": "process.Ext.memory_region.strings",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Array of strings found within the memory region.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "process.Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "process.Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "process.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "process.executable",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "process.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "process.pid",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the destination (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "port",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Port of the destination.",
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dll",
-                    "title": "DLL",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about code libraries dynamically loaded into processes.\n\nMany operating systems refer to \"shared code libraries\" with different names, but this field set refers to all of the following:\n* Dynamic-link library (`.dll`) commonly used on Windows\n* Shared Object (`.so`) commonly used on Unix-like operating systems\n* Dynamic library (`.dylib`) commonly used on macOS",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "path",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Full file path of the library.",
-                            "example": "C:\\Windows\\System32\\kernel32.dll"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "end",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "network",
-                    "title": "Network",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.",
-                    "fields": [
-                        {
-                            "name": "transport",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
-                            "example": "tcp"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
-                            "example": "ipv4"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.api.behaviors",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A list of observed behaviors.\n  \"cross-process\" - the observed activity was between two processes\n  \"parent-child\" - the observed activity was between a parent process and its child\n  \"native_api\" - a call was made directly to the Native API rather than the Win32 API\n  \"direct_syscall\" - a syscall instruction originated outside of the Native API layer\n  \"proxy_call\" - the call stack may indicate of a proxied API call to mask the true source\n  \"sensitive_api\" - executable non-image memory is unexpectedly calling a sensitive API\n  \"shellcode\" - suspicious executable non-image memory is calling a sensitive API\n  \"image_hooked\" - an entry in the callstack appears to have been hooked\n  \"image_indirect_call\" - an entry in the callstack was preceded by a call to a dynamically resolved function\n  \"image_rop\" - no call instruction preceded an entry in the call stack\n  \"image_rwx\" - an entry in the callstack is writable\n  \"unbacked_rwx\" - an entry in the callstack is non-image and writable\n  \"truncated_stack\" - call stack is unexpected truncated due to malicious tampering or system load\n  \"allocate_shellcode\" - a region of non-image executable memory allocated more executable memory\n  \"execute_fluctuation\" - the PAGE_EXECUTE protection is unexpectedly fluctuating\n  \"write_fluctuation\" - the PAGE_WRITE protection of executable memory is unexpectedly fluctuating\n  \"hook_api\" - a change to the memory protection of a small executable image memory region was made\n  \"hollow_image\" - a change to the memory protection of a large executable image memory region was made\n  \"hook_unbacked\" - a change to the memory protection of a small executable non-image memory was made\n  \"hollow_unbacked\" - a change to the memory protection of a large executable non-image memory was made\n  \"guarded_code\" - executable memory was unexpectedly marked as PAGE_GUARD\n  \"hidden_code\" - executable memory was unexpectedly marked as PAGE_NOACCESS\n  \"execute_shellcode\" - a region of non-image executable memory was unexpectedly transferred control\n  \"hardware_breakpoint_set\" - a hardware breakpoint was set\n  \"rapid_background_polling\" - a suspicious process which does rapid input polling via GetAsyncKeyState API was observed\n  \"multiple_polling_processes\" - multiple suspicious processes which do rapid input polling via the GetAsyncKeyState API were observed\n  \"pid_spoofing\" - The acting process details may have been spoofed to hide the true origin\n  \"legacy_api\" - a deprecated or superseded API was called",
-                            "example": "[ \"cross-process\", \"rapid_background_polling\", \"multiple_polling_processes\", \"native_api\", \"shellcode\" ]"
-                        },
-                        {
-                            "name": "Ext.api.metadata",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Information related to the API call."
-                        },
-                        {
-                            "name": "Ext.api.metadata.amsi_filenames",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A list of filenames previously scanned by AMSI.",
-                            "example": "[ \"C:\\script.ps1\" ]"
-                        },
-                        {
-                            "name": "Ext.api.metadata.amsi_logs",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Information related to previous AMSI scans."
-                        },
-                        {
-                            "name": "Ext.api.metadata.amsi_logs.entries",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A subset of the AMSI content buffers scanned prior to this event.",
-                            "example": "[ \"[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport(\"kernel32.dll\")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}\" ]"
-                        },
-                        {
-                            "name": "Ext.api.metadata.amsi_logs.type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The AMSI content type scanned prior to this event.",
-                            "example": "PowerShell"
-                        },
-                        {
-                            "name": "Ext.api.metadata.background_callcount",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "This field indicates a number of all GetAsyncKeyState api calls, including unsuccessful calls, between the last successful GetAsyncKeyState call.",
-                            "example": 6021
-                        },
-                        {
-                            "name": "Ext.api.metadata.client_is_local",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Indicates whether a method was called locally or remotely. It will be true if called locally, and false if called remotely.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.api.metadata.client_machine",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Client process's machine name (provided by the client and potentially untrustworthy).",
-                            "example": "DESKTOP-EXAMPLE"
-                        },
-                        {
-                            "name": "Ext.api.metadata.client_machine_fqdn",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Client process's machine name FQDN (provided by the client and potentially untrustworthy).",
-                            "example": "DESKTOP-EXAMPLE.elastic.co"
-                        },
-                        {
-                            "name": "Ext.api.metadata.client_process_id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Client process id",
-                            "example": 3600
-                        },
-                        {
-                            "name": "Ext.api.metadata.ms_since_last_keyevent",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "This field indicates the elapsed time in milliseconds since the last GetAsyncKeyState event.",
-                            "example": 94
-                        },
-                        {
-                            "name": "Ext.api.metadata.procedure_symbol",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Summary of the hook procedure.",
-                            "example": "taskbar.dll"
-                        },
-                        {
-                            "name": "Ext.api.metadata.return_value",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Return value of RegisterRawInputDevices API call.",
-                            "example": 1
-                        },
-                        {
-                            "name": "Ext.api.metadata.security_descriptor",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The security descriptor of the device.",
-                            "example": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)"
-                        },
-                        {
-                            "name": "Ext.api.metadata.start_address_allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection attributes associated with the starting address of a thread.",
-                            "example": "RCX"
-                        },
-                        {
-                            "name": "Ext.api.metadata.start_address_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module associated with the starting address of a thread.",
-                            "example": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe"
-                        },
-                        {
-                            "name": "Ext.api.metadata.target_address_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the memory region targeted by the API call.",
-                            "example": "Unbacked"
-                        },
-                        {
-                            "name": "Ext.api.metadata.target_address_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path of the memory region targeted by the API call.",
-                            "example": "C:\\programdata\\example.dll"
-                        },
-                        {
-                            "name": "Ext.api.metadata.thread_info_flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Thread info flags.",
-                            "example": 16
-                        },
-                        {
-                            "name": "Ext.api.metadata.visible_windows_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Number of visible windows owned by the caller thread.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.metadata.windows_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Number of windows owned by the caller thread.",
-                            "example": 2
-                        },
-                        {
-                            "name": "Ext.api.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the API, usually the name of the function or system call.",
-                            "example": "VirtualAlloc"
-                        },
-                        {
-                            "name": "Ext.api.parameters",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Parameter values passed to the API call."
-                        },
-                        {
-                            "name": "Ext.api.parameters.address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The target memory address.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.api.parameters.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of memory allocation. Corresponds to `MEMORY_BASIC_INFORMATION.State`",
-                            "example": "COMMIT|RESERVE"
-                        },
-                        {
-                            "name": "Ext.api.parameters.app_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The application name requesting the AMSI scan.",
-                            "example": "PowerShell"
-                        },
-                        {
-                            "name": "Ext.api.parameters.argument1",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The first argument to the procedure.",
-                            "example": 1
-                        },
-                        {
-                            "name": "Ext.api.parameters.argument2",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The second argument to the procedure.",
-                            "example": 2
-                        },
-                        {
-                            "name": "Ext.api.parameters.argument3",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The third argument to the procedure.",
-                            "example": 3
-                        },
-                        {
-                            "name": "Ext.api.parameters.buffer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The content associated with an AMSI scan.",
-                            "example": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Kernel32 {   [DllImport(\"kernel32.dll\")]   public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);}'; [Kernel32]::VirtualAlloc([IntPtr]::Zero, 0x1234, 0x1000, 0x20);"
-                        },
-                        {
-                            "name": "Ext.api.parameters.consumer_details",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Provides specific information about an event consumer, including its configuration, such as the command it executes, associated SID, and the consumer's name."
-                        },
-                        {
-                            "name": "Ext.api.parameters.consumer_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Consumer Name. Consumers specify what should happen when the conditions in the Event Filter are triggered.",
-                            "example": "ExampleConsumer"
-                        },
-                        {
-                            "name": "Ext.api.parameters.consumer_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An example list of consumer type.\n  \"ActiveScriptEventConsumer\" - Executes a predefined script in an arbitrary scripting language when an event is delivered to it.\n  \"CommandLineEventConsumer\" - Launches an arbitrary process in the local system context when an event is delivered to it.\n  \"LogFileEventConsumer\" - Writes customized strings to a text log file when events are delivered to it.\n  \"NTEventLogEventConsumer\" - Logs a specific message to the Windows event log when an event is delivered to it.\n  \"SMTPEventConsumer\" - Sends an email message using SMTP each time an event is delivered to it.",
-                            "example": "CommandLineEventConsumer"
-                        },
-                        {
-                            "name": "Ext.api.parameters.content_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The content name, typically a filename, associated with an AMSI scan.",
-                            "example": "C:\\script.ps1"
-                        },
-                        {
-                            "name": "Ext.api.parameters.context_flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The bitmask of CPU registers operated on by this call. Corresponds to `CONTEXT.ContextFlags`",
-                            "example": 1048607
-                        },
-                        {
-                            "name": "Ext.api.parameters.desired_access",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This parameter indicates the string value of the `DesiredAccess` field  to `OpenProcess` or `OpenThread`."
-                        },
-                        {
-                            "name": "Ext.api.parameters.desired_access_numeric",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "This parameter indicates the numeric value of the `DesiredAccess` field passed to `OpenProcess` or `OpenThread`."
-                        },
-                        {
-                            "name": "Ext.api.parameters.device",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the device object.",
-                            "example": "\\Device\\NPCAP"
-                        },
-                        {
-                            "name": "Ext.api.parameters.driver",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the driver object.",
-                            "example": "\\Driver\\npcap"
-                        },
-                        {
-                            "name": "Ext.api.parameters.eax",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EAX general purpose register. Return value in __cdecl, __stdcall, __thiscall and __fastcall.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.ebp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EBP frame pointer register.",
-                            "example": 15006644
-                        },
-                        {
-                            "name": "Ext.api.parameters.ebx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EBX general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.ecx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 ECX general purpose register. First argument in __fastcall and __thiscall.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.edi",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EDI general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.edx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EDX general purpose register. Second argument in a __fastcall.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.eip",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 EIP instruction pointer register.",
-                            "example": 1472790528
-                        },
-                        {
-                            "name": "Ext.api.parameters.esi",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 ESI general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.esp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x86 ESP stack pointer register.",
-                            "example": 15007744
-                        },
-                        {
-                            "name": "Ext.api.parameters.event_filter_details",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Provide an overview of the query that define when an event should be triggered."
-                        },
-                        {
-                            "name": "Ext.api.parameters.event_filter_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Event filter name. An event filter is a WMI class that defines which events WMI delivers to a consumer.",
-                            "example": "ExampleFilter"
-                        },
-                        {
-                            "name": "Ext.api.parameters.flags",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Mode flag that specifies how to interpret the information provided by UsagePage and Usage. Third member RAWINPUTDEVICE structure.",
-                            "example": "INPUTSINK"
-                        },
-                        {
-                            "name": "Ext.api.parameters.handle_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This parameter indicates whether the detected access was attempt against a process or a thread.",
-                            "example": "process"
-                        },
-                        {
-                            "name": "Ext.api.parameters.hook_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DLL containing the hook procedure.",
-                            "example": "c:\\windows\\system32\\taskbar.dll"
-                        },
-                        {
-                            "name": "Ext.api.parameters.hook_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of hook procedure to be installed.",
-                            "example": "WH_KEYBOARD_LL"
-                        },
-                        {
-                            "name": "Ext.api.parameters.io_control_code",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The I/O control code for the requested device operation.",
-                            "example": 27365
-                        },
-                        {
-                            "name": "Ext.api.parameters.namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "WMI namespace to which the connection is made.",
-                            "example": "root\\Microsoft\\Windows\\DeviceGuard"
-                        },
-                        {
-                            "name": "Ext.api.parameters.operation",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Specifies the connection or request to WMI",
-                            "example": "Win32_Process::Create"
-                        },
-                        {
-                            "name": "Ext.api.parameters.procedure",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The memory address of the procedure or function.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.api.parameters.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory protection for the region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
-                            "example": "RWX|GUARD"
-                        },
-                        {
-                            "name": "Ext.api.parameters.protection_old",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The previous memory protection returned by the API call. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
-                            "example": "RCX"
-                        },
-                        {
-                            "name": "Ext.api.parameters.r8",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 R8 general purpose register. Third argument in a __fastcall.",
-                            "example": 3
-                        },
-                        {
-                            "name": "Ext.api.parameters.r9",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 R9 general purpose register. Fourth argument in a __fastcall.",
-                            "example": 4
-                        },
-                        {
-                            "name": "Ext.api.parameters.rax",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RAX general purpose register. Return value in a __fastcall.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rbp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RBP general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rbx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The x64 RBX general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rcx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RCX general purpose register. First argument in a __fastcall.",
-                            "example": 1
-                        },
-                        {
-                            "name": "Ext.api.parameters.rdi",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RDI general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rdx",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RDX general purpose register. Second argument in a __fastcall.",
-                            "example": 2
-                        },
-                        {
-                            "name": "Ext.api.parameters.rip",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RIP instruction pointer register.",
-                            "example": 140706153693184
-                        },
-                        {
-                            "name": "Ext.api.parameters.rsi",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The x64 RSI general purpose register.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.api.parameters.rsp",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The x64 RSP stack pointer register.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.api.parameters.size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The size.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.api.parameters.usage",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This parameter indicates the specific device (Usage) within the Usage Page. Second member RAWINPUTDEVICE structure.",
-                            "example": "KEYBOARD"
-                        },
-                        {
-                            "name": "Ext.api.parameters.usage_page",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This parameter indicates the top-level collection (Usage Page) of the device. First member RAWINPUTDEVICE structure.",
-                            "example": "GENERIC"
-                        },
-                        {
-                            "name": "Ext.api.summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The summary of the API call and its parameters.",
-                            "example": "VirtualAllocEx( file.exe, NULL, 0x42000, COMMIT|RESERVE, RWX )"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.created_suspended",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "A heuristic indicating if the CREATE_SUSPENDED flag was passed to the Win32 CreateProcess API. Not valid for direct syscalls.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory allocation containing the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Original memory protection requested when the memory was allocated. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Original memory size requested when the memory was allocated.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.memory_region.allocation_type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory allocation type. Example values include \"IMAGE\", \"MAPPED\", and \"PRIVATE\".",
-                            "example": "PRIVATE"
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_address",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The address where bytes_compressed begins.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_allocation_offset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Offset of bytes_address the memory allocation. Equal to bytes_address - allocation_base.",
-                            "example": 0
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_compressed",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Up to 4MB of raw data from the memory allocation. This is compressed with zlib.To reduce data volume, this is de-duplicated on the endpoint, and may be missing from many alerts if the same data would be sent multiple times.",
-                            "example": "eJzzSM3JyVcIzy/KSVEEABxJBD4=",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.memory_region.bytes_compressed_present",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether bytes_compressed is present in this event.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the memory region.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.all_names",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A sequence of signature names matched.",
-                            "example": "Windows.EICAR.Not-a-virus"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.identifier",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature identifier"
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The first matching details."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The first matching details.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of file matching signature."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of file matching signature."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the first yara rule matched."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.primary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the first yara rule matched."
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Additional matching details if available.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.matches",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The second matching details.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.signature.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "hash of second file matching signature.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.signature.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "sha256 hash of second file matching signature.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.signature.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The id of the second yara rule matched.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.secondary.signature.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the second yara rule matched.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "Ext.memory_region.malware_signature.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "malware signature version"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "If the memory corresponds to a file mapping, this is the file's path.",
-                            "example": "C:\\Windows\\System32\\mshtml.dll"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.pehash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
-                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "PE Section List name."
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "Ext.memory_region.mapped_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether the file at mapped_path is an executable.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.dotnet",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether this file is a .NET PE",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's relevant sections, if it is a PE"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.sections.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The section's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The file's streams, if it is a PE"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.md5",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "MD5 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha1",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA1 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha256",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA256 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha384",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA384 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.sha512",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SHA512 hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.ssdeep",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "SSDEEP hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.hash.tlsh",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "TLSH hash."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.Ext.streams.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The stream's name",
-                            "example": ".reloc"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.architecture",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "CPU architecture target for the file.",
-                            "example": "x64"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.company",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal company name of the file, provided at compile-time.",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.description",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal description of the file, provided at compile-time.",
-                            "example": "Paint"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.file_version",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal version of the file, provided at compile-time.",
-                            "example": "6.3.9600.17415"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the Go language imports in a PE file excluding standard library imports. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThe algorithm used to calculate the Go symbol hash and a reference implementation are available [here](https://github.com/elastic/toutoumomoma).",
-                            "example": "10bddcb4cee42080f76c88d9ff964491"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported Go language element names and types."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of Go imports.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.go_stripped",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Set to true if the file is a Go executable that has had its symbols stripped or obfuscated and false if an unobfuscated Go executable."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imphash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An imphash -- or import hash -- can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nLearn more at https://www.fireeye.com/blog/threat-research/2014/01/tracking-malware-import-hashing.html.",
-                            "example": "0c6803c4e922103c4dca5963aad36ddf"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.import_hash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the imports in a PE file. An import hash can be used to fingerprint binaries even after recompilation or other code-level transformations have occurred, which would change more traditional hash values.\nThis is a synonym for imphash.",
-                            "example": "d41d8cd98f00b204e9800998ecf8427e"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imports",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "flattened",
-                            "description": "List of imported element names and types."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imports_names_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.imports_names_var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the list of imported element names and types.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.original_file_name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal name of the file, provided at compile-time.",
-                            "example": "MSPAINT.EXE"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.pehash",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of the PE header and data from one or more PE sections. An pehash can be used to cluster files by transforming structural information about a file into a hash value.\nLearn more at https://www.usenix.org/legacy/events/leet09/tech/full_papers/wicherski/wicherski_html/index.html.",
-                            "example": "73ff189b63cd6be375a7ff25179a38d347651975"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.product",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Internal product name of the file, provided at compile-time.",
-                            "example": "Microsoft® Windows® Operating System"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "nested",
-                            "description": "An array containing an object for each section of the PE file.\nThe keys that should be present in these objects are defined by sub-fields underneath `pe.sections.*`."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.name",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "PE Section List name."
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.physical_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List physical size.",
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.var_entropy",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Variance for Shannon entropy calculation from the section.",
-                            "format": "number"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe.sections.virtual_size",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "long",
-                            "description": "PE Section List virtual size. This is always the same as `physical_size`.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "Ext.memory_region.memory_pe_detected",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Whether an executable file was found in memory.",
-                            "example": false
-                        },
-                        {
-                            "name": "Ext.memory_region.region_base",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Base address of the memory region.",
-                            "example": 2431737462784
-                        },
-                        {
-                            "name": "Ext.memory_region.region_protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Memory protection of the memory region. Example values include \"RWX\" and \"R-X\".",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "Ext.memory_region.region_size",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Size of the memory region.",
-                            "example": 4096
-                        },
-                        {
-                            "name": "Ext.memory_region.region_start_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "First 64 bytes at the region base address.",
-                            "example": "4d5a90000300000004000000ffff0000b80000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000"
-                        },
-                        {
-                            "name": "Ext.memory_region.region_state",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "State of the memory region. Example values include \"RESERVE\", \"COMMIT\", and \"FREE\".",
-                            "example": "COMMIT"
-                        },
-                        {
-                            "name": "Ext.memory_region.strings",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Array of strings found within the memory region.",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "Ext.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Indicates the protection level of this process.  Uses the same syntax as Process Explorer. Examples include PsProtectedSignerWinTcb, PsProtectedSignerWinTcb-Light, and PsProtectedSignerWindows-Light."
-                        },
-                        {
-                            "name": "Ext.token.integrity_level_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Human readable integrity level.",
-                            "example": "one of \"system\", \"high\", \"medium\", \"low\", \"untrusted\""
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "command_line",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "Full command line that started the process, including the absolute path to the executable, and all arguments.\nSome arguments may be filtered to protect sensitive information.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh -l user 10.0.0.16"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "thread.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Fields describing a stack frame.  call_stack is expected to be an array where each array element represents a stack frame.",
-                            "enabled": false
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory allocation/image that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_leading_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes preceding the callsite"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.callsite_trailing_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hex opcode bytes after the callsite (where control will return to)"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.instruction_pointer",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The return address of this stack frame."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.module_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path to the DLL/module containing `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Protection of the page containing this instruction.  This is `R-X' by default if omitted."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.protection_provenance",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the memory region that last modified the protection of this page.  \"Unbacked\" can indicate shellcode."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack.symbol_info",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The nearest symbol for `instruction_pointer`."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_contains_unbacked",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Indicates whether the creating thread's stack contains frames pointing outside any known executable image."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The module that installed the final API hook in the call stack."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_hook_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_hook_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_hook_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_hook_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_hook_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "The final non-win32 module in the call stack."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.allocation_private_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The number of bytes in this memory region that are both +X and non-shareable. Non-zero values can indicate code hooking, patching, or hollowing."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.hash",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Hashes of the call_stack_final_user_module."
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.hash.sha256",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The sha256 of the call_stack_final_user_module.",
-                            "example": "d25ff1e6c6460a7f9de39198d182058c1712726008d187e1953b83abe977e4a0"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file name of the call_stack_final_user_module.",
-                            "example": "example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file path of the call_stack_final_user_module.",
-                            "example": "C:\\Program Files\\Example\\example.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.protection",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The memory protection for the acting region of pages. Corresponds to `MEMORY_BASIC_INFORMATION.Protect`",
-                            "example": "RWX"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.protection_provenance",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name of the memory region that caused the last modification of the protection of this page. \"Unbacked\" may indicate shellcode.",
-                            "example": "third_party_hook.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.protection_provenance_path",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The path of the module that caused the last modification the protection of this page.",
-                            "example": "C:\\Program Files\\Hook Inc\\third_party_hook.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_final_user_module.reason",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The unexpected call_stack_summary that led to an \"Undetermined\" protection_provenance.",
-                            "example": "ntdll.dll|kernelbase.dll"
-                        },
-                        {
-                            "name": "thread.Ext.call_stack_summary",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Concatentation of the non-repeated modules in the call stack.",
-                            "example": "ntdll.dll|example.exe|kernel32.dll|ntdll.dll"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "@timestamp": "2023-01-09T19:38:51.5141503Z",
-                "Target": {
-                    "process": {
-                        "Ext": {
-                            "created_suspended": true,
-                            "protection": "PsProtectedSignerWinTcb",
-                            "memory_region": {
-                                "allocation_base": 1649160290304,
-                                "allocation_protection": "RWX",
-                                "allocation_size": 4096,
-                                "allocation_type": "PRIVATE",
-                                "bytes_address": 1649160290304,
-                                "bytes_allocation_offset": 0,
-                                "bytes_compressed": "eJztwbEJACAMALA+5uAtWnAoOPg/+EWnJO9k1bo742XuMRsEAAAA0OsD8lge9g==",
-                                "bytes_compressed_present": true,
-                                "hash": {
-                                    "sha256": "0b28b598ef70fd2377613fd88a50d52047ae31c16f2c688f3aa4e0b98d63730c"
-                                },
-                                "memory_pe_detected": false,
-                                "region_base": 1649160290304,
-                                "region_protection": "R--",
-                                "region_size": 4096,
-                                "region_state": "COMMIT",
-                                "strings": [
-                                    "shellcode",
-                                    "seed=AAAA"
-                                ]
-                            },
-                            "token": {
-                                "integrity_level_name": "high"
-                            }
-                        },
-                        "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTI1NzMyLTE2OTkwMDE3NDAuOTU4NTY4MDAw",
-                        "executable": "C:\\Temp\\1_StayRunningWin32_x64.exe",
-                        "name": "1_StayRunningWin32_x64.exe",
-                        "pid": 25732
-                    }
-                },
-                "dll": {
-                    "Ext": {
-                        "code_signature": [
-                            {
-                                "exists": true,
-                                "status": "trusted",
-                                "subject_name": "Microsoft Windows",
-                                "trusted": true
-                            }
-                        ]
-                    },
-                    "hash": {
-                        "sha256": "8b9731a4b83e801cda7b918f8194608e91f86b3a86ffb6bb24230b1cc28e1a54"
-                    },
-                    "path": "c:\\windows\\system32\\drivers\\pktmon.sys"
-                },
-                "destination": {
-                    "ip": "2001:4860:4860::8844",
-                    "port": 139
-                },
-                "event": {
-                    "category": [
-                        "api",
-                        "intrusion_detection"
-                    ],
-                    "created": "2023-01-09T19:38:51.5141503Z",
-                    "dataset": "endpoint.events.api",
-                    "id": "MvlgiHxIZtj1+Abi++++++ul",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "outcome": "success",
-                    "provider": "Microsoft-Windows-Threat-Intelligence",
-                    "sequence": 3802,
-                    "type": [
-                        "credential_access"
-                    ]
-                },
-                "host": {
-                    "architecture": "x86_64",
-                    "hostname": "DESKTOP-OCG8CR6",
-                    "id": "dabadaba-0000-0000-0000-000000000000",
-                    "ip": [
-                        "169.254.104.226",
-                        "fe80::6037:d589:2ee9:772f",
-                        "172.22.6.230",
-                        "fe80::80ea:8e8d:e1f2:6622",
-                        "169.254.74.35",
-                        "fe80::900c:a9d3:fd8:9345",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "mac": [
-                        "00-15-5D-00-09-18",
-                        "00-15-5D-00-09-19",
-                        "00-15-5D-00-09-17"
-                    ],
-                    "name": "DESKTOP-OCG8CR6",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows 11 Enterprise N"
-                        },
-                        "family": "windows",
-                        "full": "Windows 11 Enterprise N 22H2 (10.0.22621.963)",
-                        "kernel": "22H2 (10.0.22621.963)",
-                        "name": "Windows",
-                        "platform": "windows",
-                        "type": "windows",
-                        "version": "22H2 (10.0.22621.963)"
-                    }
-                },
-                "message": "Endpoint API event - hand-crafted with a superset of fields",
-                "network": {
-                    "transport": "tcp",
-                    "type": "ipv6"
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTgxMi0xNjczMjkxNTMzLjcxNjczMTgwMA==",
-                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ5NjAtMTY3Mjk2NTgzMC4yODc0OTYxMDA=",
-                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTY2MjgtMTY3Mjk2NTc3Mi41MTg4MDA1MDA=",
-                            "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTQ2MDAtMTY3Mjk2NTcxMy40NzY1NDUyMDA="
-                        ],
-                        "api": {
-                            "behaviors": [
-                                "cross-process",
-                                "rapid_background_polling",
-                                "multiple_polling_processes",
-                                "pid_spoofing"
-                            ],
-                            "metadata": {
-                                "target_address_name": "Unbacked",
-                                "target_address_path": "c:\\windows\\system32\\ntdll.dll",
-                                "return_value": 1,
-                                "windows_count": 2,
-                                "visible_windows_count": 0,
-                                "thread_info_flags": 16,
-                                "start_address_module": "C:\\Windows\\System32\\DellTPad\\ApMsgFwd.exe",
-                                "start_address_allocation_protection": "RCX",
-                                "procedure_symbol": "taskbar.dll",
-                                "ms_since_last_keyevent": 94,
-                                "background_callcount": 6021,
-                                "security_descriptor": "O:BAG:SYD:P(A;;FA;;;SY)(A;;FA;;;BA)S:AI(ML;;NW;;;LW)",
-                                "client_machine": "DESKTOP-EXAMPLE",
-                                "client_machine_fqdn": "DESKTOP-EXAMPLE",
-                                "client_process_id": 3600,
-                                "client_is_local": true,
-                                "amsi_filenames": [
-                                    "C:\\script.ps1"
-                                ],
-                                "amsi_logs": {
-                                    "entries": [
-                                        "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
-                                    ],
-                                    "type": "PowerShell"
-                                }
-                            },
-                            "name": "OpenProcess",
-                            "parameters": {
-                                "desired_access": [
-                                    "PROCESS_QUERY_LIMITED_INFORMATION",
-                                    "PROCESS_VM_READ"
-                                ],
-                                "desired_access_numeric": 4112,
-                                "handle_type": "process",
-                                "address": 2904525045760,
-                                "allocation_type": "COMMIT|RESERVE",
-                                "protection": "R-X",
-                                "protection_old": "R-X",
-                                "size": 16,
-                                "context_flags": 1048607,
-                                "r8": 8,
-                                "r9": 9,
-                                "rax": 10,
-                                "rbp": 3,
-                                "rbx": 11,
-                                "rcx": 2883351609344,
-                                "rdi": 5,
-                                "rdx": 13,
-                                "rip": 140706538588528,
-                                "rsi": 4,
-                                "rsp": 2,
-                                "eax": 10,
-                                "ebp": 3,
-                                "ebx": 11,
-                                "ecx": 12,
-                                "edi": 5,
-                                "edx": 0,
-                                "eip": 1,
-                                "esi": 4,
-                                "esp": 2,
-                                "argument1": 2583984274656,
-                                "argument2": 4105953215,
-                                "argument3": 31058890,
-                                "procedure": 140705553857280,
-                                "usage_page": "GENERIC",
-                                "usage": "KEYBOARD",
-                                "flags": "INPUTSINK",
-                                "hook_type": "WH_KEYBOARD_LL",
-                                "hook_module": "c:\\windows\\system32\\taskbar.dll",
-                                "device": "\\Device\\PktMonDev",
-                                "io_control_code": 27365,
-                                "event_filter_name": "ExampleFilter",
-                                "event_filter_details": "__EventFilter{EventNamespace = \"root\\CimV2\"; Name = \"ExampleFilter\";};",
-                                "consumer_name": "ExampleConsumer",
-                                "consumer_type": "CommandLineEventConsumer",
-                                "consumer_details": "CommandLineEventConsumer{Name = \"ExampleConsumer\";};",
-                                "namespace": "root\\Microsoft\\Windows\\DeviceGuard",
-                                "operation": "Win32_Process::Create",
-                                "app_name": "PowerShell",
-                                "content_name": "C:\\script.ps1",
-                                "buffer": "[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true);"
-                            },
-                            "summary": "VirtualAllocEx( charmap.exe, NULL, 0x10, COMMIT|RESERVE, R-X )"
-                        },
-                        "code_signature": [
-                            {
-                                "exists": true,
-                                "status": "errorBadDigest",
-                                "subject_name": "Microsoft Windows",
-                                "trusted": false
-                            }
-                        ],
-                        "memory_region": {
-                            "allocation_base": 140712018378752,
-                            "allocation_protection": "RCX",
-                            "allocation_size": 45056,
-                            "allocation_type": "IMAGE",
-                            "mapped_path": "C:\\Program Files\\Python39\\DLLs\\libffi-7.dll",
-                            "region_base": 140712018395136,
-                            "region_protection": "R-X",
-                            "region_size": 8192,
-                            "region_state": "COMMIT"
-                        },
-                        "token": {
-                            "integrity_level_name": "system"
-                        }
-                    },
-                    "code_signature": {
-                        "exists": true,
-                        "status": "errorBadDigest",
-                        "subject_name": "Microsoft Windows",
-                        "trusted": false
-                    },
-                    "command_line": "",
-                    "entity_id": "YWFhYWFhYWEtYWFhYS1hYWFhLWFhYWEtYWFhYWFhYWFhYWFhLTkxNi0xNjczMjkzMTMwLjk0NjAwMjAw",
-                    "executable": "c\\git\\endpoint-dev\\Tools\\Leia\\modules\\exe_malware\\mimikatz.exe",
-                    "name": "mimikatz.exe",
-                    "pid": 916,
-                    "thread": {
-                        "Ext": {
-                            "call_stack": [
-                                {
-                                    "allocation_private_bytes": 4096,
-                                    "protection_provenance": "dabapi.dll",
-                                    "symbol_info": "c:\\windows\\system32\\ntdll.dll!ZwProtectVirtualMemory+0x14"
-                                },
-                                {
-                                    "symbol_info": "c:\\windows\\system32\\kernelbase.dll!VirtualProtect+0x36"
-                                },
-                                {
-                                    "allocation_private_bytes": 8192,
-                                    "callsite_leading_bytes": "c048895424204c8bc9488d0d801f0000418d500248ff15052a00000f1f4400004883c438c3cccccccccccccccccccccc4883ec2048b880bf1acaf87f0000ffd0",
-                                    "callsite_trailing_bytes": "4883c420c3ec48498363e800498d4320ba2500000049c743e004000000440fb7ca4c8d05d0320000ba2b000000498943d848ff15f82a00000f1f4400004883c4",
-                                    "protection": "RWX",
-                                    "protection_provenance": "eventstests.exe",
-                                    "symbol_info": "c:\\windows\\system32\\dabapi.dll!DabApiBufferFree+0x10"
-                                },
-                                {
-                                    "symbol_info": "Unknown"
-                                }
-                            ],
-                            "call_stack_final_user_module": {
-                                "allocation_private_bytes": 4096,
-                                "code_signature": [
-                                    {
-                                        "exists": true,
-                                        "status": "trusted",
-                                        "subject_name": "Microsoft Windows",
-                                        "trusted": true
-                                    }
-                                ],
-                                "hash": {
-                                    "sha256": "0386c57d59ee1292bb74d9878358da7a0ba00e5b56ed52fd6171b9e6d29d85aa"
-                                },
-                                "name": "dabapi.dll",
-                                "path": "c:\\windows\\system32\\dabapi.dll",
-                                "protection": "RWX",
-                                "protection_provenance": "eventstests.exe",
-                                "protection_provenance_path": "c:\\dev\\eventstests.exe",
-                                "reason": "ntdll.dll"
-                            },
-                            "call_stack_summary": "ntdll.dll|kernelbase.dll|kernel32.dll|cmd.exe|kernel32.dll|ntdll.dll"
-                        },
-                        "id": 11628
-                    }
-                },
-                "user": {
-                    "domain": "DESKTOP-OCG8CR6",
-                    "id": "S-1-5-21-3820246941-898183108-3095036578-1001",
-                    "name": "User"
-                }
-            }
-        },
-        {
-            "name": "network",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "destination",
-                    "title": "Destination",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Destination fields capture details about the receiver of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nDestination fields are usually populated in conjunction with source fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "address",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
-                        },
-                        {
-                            "name": "as.number",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
-                            "example": 15169
-                        },
-                        {
-                            "name": "as.organization.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Organization name.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Google LLC"
-                        },
-                        {
-                            "name": "bytes",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Bytes sent from the destination to the source.",
-                            "example": 184,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "domain",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The domain name of the destination system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.",
-                            "example": "foo.example.com"
-                        },
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the destination (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "packets",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Packets sent from the destination to the source.",
-                            "example": 12
-                        },
-                        {
-                            "name": "port",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Port of the destination.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "registered_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered destination domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "top_level_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "dns",
-                    "title": "DNS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing DNS queries and answers.\nDNS events should either represent a single DNS query prior to getting answers (`dns.type:query`) or they should represent a full exchange and contain the query details as well as all of the answers that were provided for this query (`dns.type:answer`).",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.options",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "DNS options field, uint64, representing as a keyword to avoid overflows in ES"
-                        },
-                        {
-                            "name": "Ext.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "DNS status field, uint32"
-                        },
-                        {
-                            "name": "question.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The name being queried.\nIf the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \\t, \\r, and \\n respectively.",
-                            "example": "www.example.com"
-                        },
-                        {
-                            "name": "question.registered_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "question.subdomain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The subdomain is all of the labels under the registered_domain.\nIf the domain has multiple levels of subdomain, such as \"sub2.sub1.example.com\", the subdomain field should contain \"sub2.sub1\", with no trailing period.",
-                            "example": "www"
-                        },
-                        {
-                            "name": "question.top_level_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        },
-                        {
-                            "name": "question.type",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The type of record being queried.",
-                            "example": "AAAA"
-                        },
-                        {
-                            "name": "resolved_ip",
-                            "level": "extended",
-                            "type": "ip",
-                            "description": "Array containing all IPs seen in `answers.data`.\nThe `answers` array can be difficult to use, because of the variety of data formats it can contain. Extracting all IP addresses seen in there to `dns.resolved_ip` makes it possible to index them as IP addresses, and makes them easier to visualize and query for.",
-                            "example": "[\"10.10.10.10\", \"10.10.10.11\"]"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "group",
-                    "title": "Group",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The group fields are meant to represent groups that are relevant to the event.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "http",
-                    "title": "HTTP",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields related to HTTP activity. Use the `url` field set to store the url of the request.",
-                    "fields": [
-                        {
-                            "name": "request.body.bytes",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Size in bytes of the request body.",
-                            "example": 887,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "request.body.content",
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "The full HTTP request body.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Hello world"
-                        },
-                        {
-                            "name": "request.bytes",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Total size in bytes of the request (body and headers).",
-                            "example": 1437,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "response.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "response.Ext.version",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "HTTP version"
-                        },
-                        {
-                            "name": "response.body.bytes",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Size in bytes of the response body.",
-                            "example": 887,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "response.body.content",
-                            "level": "extended",
-                            "type": "wildcard",
-                            "description": "The full HTTP response body.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Hello world"
-                        },
-                        {
-                            "name": "response.bytes",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Total size in bytes of the response (body and headers).",
-                            "example": 1437,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "response.status_code",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "HTTP response status code.",
-                            "example": 404,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "network",
-                    "title": "Network",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The network is defined as the communication path over which a host or network event happens.\nThe network.* fields should be populated with details about the network activity associated with an event.",
-                    "fields": [
-                        {
-                            "name": "bytes",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Total bytes transferred in both directions.\nIf `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum.",
-                            "example": 368,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "community_id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A hash of source and destination IPs and ports, as well as the protocol used in a communication. This is a tool-agnostic standard to identify flows.\nLearn more at https://github.com/corelight/community-id-spec.",
-                            "example": "1:hO+sN4H+MG5MY/8hIrXPqc4ZQz0="
-                        },
-                        {
-                            "name": "direction",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Direction of the network traffic.\nWhen mapping events from a host-based monitoring context, populate this field from the host's point of view, using the values \"ingress\" or \"egress\".\nWhen mapping events from a network or perimeter-based monitoring context, populate this field from the point of view of the network perimeter, using the values \"inbound\", \"outbound\", \"internal\" or \"external\".\nNote that \"internal\" is not crossing perimeter boundaries, and is meant to describe communication between two hosts within the perimeter. Note also that \"external\" is meant to describe traffic between two hosts that are external to the perimeter. This could for example be useful for ISPs or VPN service providers.",
-                            "example": "inbound"
-                        },
-                        {
-                            "name": "iana_number",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "IANA Protocol Number (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml). Standardized list of protocols. This aligns well with NetFlow and sFlow related logs which use the IANA Protocol Number.",
-                            "example": 6
-                        },
-                        {
-                            "name": "packets",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Total packets transferred in both directions.\nIf `source.packets` and `destination.packets` are known, `network.packets` is their sum.",
-                            "example": 24
-                        },
-                        {
-                            "name": "protocol",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`.\nThe field value must be normalized to lowercase for querying.",
-                            "example": "http"
-                        },
-                        {
-                            "name": "transport",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.)\nThe field value must be normalized to lowercase for querying.",
-                            "example": "tcp"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "In the OSI Model this would be the Network Layer. ipv4, ipv6, ipsec, pim, etc\nThe field value must be normalized to lowercase for querying.",
-                            "example": "ipv4"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "process",
-                    "title": "Process",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "These fields contain information about a process.\nThese fields can help you correlate metrics information with a process id/name from a log message.  The `process.pid` often stays in the metric itself and is copied to the global field for correlation.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.ancestry",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "An array of entity_ids indicating the ancestors for this event"
-                        },
-                        {
-                            "name": "Ext.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Nested version of ECS code_signature fieldset."
-                        },
-                        {
-                            "name": "Ext.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "Ext.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "Ext.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "Ext.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.exists",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The identifier used to sign the process.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.",
-                            "example": "com.apple.xpc.proxy"
-                        },
-                        {
-                            "name": "code_signature.status",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT"
-                        },
-                        {
-                            "name": "code_signature.subject_name",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation"
-                        },
-                        {
-                            "name": "code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The team identifier used to sign the process.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.",
-                            "example": "EQHXZ8M8AV"
-                        },
-                        {
-                            "name": "code_signature.trusted",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "code_signature.valid",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true"
-                        },
-                        {
-                            "name": "entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "entry_leader.parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "executable",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Absolute path to the process executable.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "/usr/bin/ssh"
-                        },
-                        {
-                            "name": "group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Process name.\nSometimes called program name or similar.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "ssh"
-                        },
-                        {
-                            "name": "parent.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "parent.group_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "pid",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Process id.",
-                            "example": 4242,
-                            "format": "string"
-                        },
-                        {
-                            "name": "session_leader.entity_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the process.\nThe implementation of this is specified by the data source, but some examples of what could be used here are a process-generated UUID, Sysmon Process GUIDs, or a hash of some uniquely identifying components of a process.\nConstructing a globally unique identifier is a common practice to mitigate PID reuse as well as to identify a specific process over time, across multiple monitored hosts.",
-                            "example": "c2c455d9f99375d"
-                        },
-                        {
-                            "name": "thread.id",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Thread ID.",
-                            "example": 4242,
-                            "format": "string"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "source",
-                    "title": "Source",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Source fields capture details about the sender of a network exchange/packet. These fields are populated from a network event, packet, or other event containing details of a network transaction.\nSource fields are usually populated in conjunction with destination fields. The source and destination fields are considered the baseline and should always be filled if an event contains source and destination details from a network transaction. If the event also contains identification of the client and server roles, then the client and server fields should also be populated.",
-                    "fields": [
-                        {
-                            "name": "address",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Some event source addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket.  You should always store the raw address in the `.address` field.\nThen it should be duplicated to `.ip` or `.domain`, depending on which one it is."
-                        },
-                        {
-                            "name": "as.number",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Unique number allocated to the autonomous system. The autonomous system number (ASN) uniquely identifies each network on the Internet.",
-                            "example": 15169
-                        },
-                        {
-                            "name": "as.organization.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Organization name.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Google LLC"
-                        },
-                        {
-                            "name": "bytes",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Bytes sent from the source to the destination.",
-                            "example": 184,
-                            "format": "bytes"
-                        },
-                        {
-                            "name": "domain",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The domain name of the source system.\nThis value may be a host name, a fully qualified domain name, or another host naming format. The value may derive from the original event or be added from enrichment.",
-                            "example": "foo.example.com"
-                        },
-                        {
-                            "name": "geo.city_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "City name.",
-                            "example": "Montreal"
-                        },
-                        {
-                            "name": "geo.continent_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Two-letter code representing continent's name.",
-                            "example": "NA"
-                        },
-                        {
-                            "name": "geo.continent_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the continent.",
-                            "example": "North America"
-                        },
-                        {
-                            "name": "geo.country_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country ISO code.",
-                            "example": "CA"
-                        },
-                        {
-                            "name": "geo.country_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Country name.",
-                            "example": "Canada"
-                        },
-                        {
-                            "name": "geo.location",
-                            "level": "core",
-                            "type": "geo_point",
-                            "description": "Longitude and latitude.",
-                            "example": "{ \"lon\": -73.614830, \"lat\": 45.505918 }"
-                        },
-                        {
-                            "name": "geo.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User-defined description of a location, at the level of granularity they care about.\nCould be the name of their data centers, the floor number, if this describes a local physical entity, city names.\nNot typically used in automated geolocation.",
-                            "example": "boston-dc"
-                        },
-                        {
-                            "name": "geo.postal_code",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Postal code associated with the location.\nValues appropriate for this field may also be known as a postcode or ZIP code and will vary widely from country to country.",
-                            "example": 94040
-                        },
-                        {
-                            "name": "geo.region_iso_code",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region ISO code.",
-                            "example": "CA-QC"
-                        },
-                        {
-                            "name": "geo.region_name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Region name.",
-                            "example": "Quebec"
-                        },
-                        {
-                            "name": "geo.timezone",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The time zone of the location, such as IANA time zone name.",
-                            "example": "America/Argentina/Buenos_Aires"
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "IP address of the source (IPv4 or IPv6)."
-                        },
-                        {
-                            "name": "packets",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Packets sent from the source to the destination.",
-                            "example": 12
-                        },
-                        {
-                            "name": "port",
-                            "level": "core",
-                            "type": "long",
-                            "description": "Port of the source.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "registered_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The highest registered source domain, stripped of the subdomain.\nFor example, the registered domain for \"foo.example.com\" is \"example.com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last two labels will not work well for TLDs such as \"co.uk\".",
-                            "example": "example.com"
-                        },
-                        {
-                            "name": "top_level_domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The effective top level domain (eTLD), also known as the domain suffix, is the last part of the domain name. For example, the top level domain for example.com is \"com\".\nThis value can be determined precisely with a list like the public suffix list (http://publicsuffix.org). Trying to approximate this by simply taking the last label will not work well for effective TLDs such as \"co.uk\".",
-                            "example": "co.uk"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "user",
-                    "title": "User",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The user fields describe information about the user that is relevant to the event.\nFields can have one entry or multiple entries. If a user has more than one id, provide an array that includes all of them.",
-                    "fields": [
-                        {
-                            "name": "Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "User info prior to any setuid operations."
-                        },
-                        {
-                            "name": "Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "One or multiple unique identifiers of the user."
-                        },
-                        {
-                            "name": "Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user."
-                        },
-                        {
-                            "name": "domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the user is a member of.\nFor example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "email",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User email address."
-                        },
-                        {
-                            "name": "full_name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "User's full name, if available.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Albert Einstein"
-                        },
-                        {
-                            "name": "group.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "group.Ext.real",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Group info prior to any setgid operations."
-                        },
-                        {
-                            "name": "group.Ext.real.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.Ext.real.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "group.domain",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the directory the group is a member of. For example, an LDAP or Active Directory domain name."
-                        },
-                        {
-                            "name": "group.id",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier for the group on the system/platform."
-                        },
-                        {
-                            "name": "group.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the group."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique user hash to correlate information for a user in anonymized form.\nUseful if `user.id` or `user.name` contain confidential information and cannot be used."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of the user.",
-                            "example": "S-1-5-21-202424912787-2692429404-2351956786-1000"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Short name or login of the user.",
-                            "multi_fields": [
-                                {
-                                    "name": "text",
-                                    "type": "match_only_text",
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "a.einstein"
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "id": "afd348c6-0ec9-4961-805e-8ed2fc4c043b",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "process": {
-                    "Ext": {
-                        "ancestry": [
-                            "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTYxMi0xMzI5MzU0OTEwOS43MzU5NDk3MDA=",
-                            "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTQ3Ni0xMzI5MzU0OTEwOS4zODExMTM3MDA="
-                        ],
-                        "code_signature": [
-                            {
-                                "trusted": false,
-                                "subject_name": "Google LLC",
-                                "exists": true,
-                                "status": "errorExpired"
-                            }
-                        ]
-                    },
-                    "parent": {
-                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
-                        "group_leader": {
-                            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-                        }
-                    },
-                    "entry_leader": {
-                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
-                        "parent": {
-                            "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-                        }
-                    },
-                    "session_leader": {
-                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-                    },
-                    "group_leader": {
-                        "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA="
-                    },
-                    "code_signature": {
-                        "trusted": false,
-                        "subject_name": "Google LLC",
-                        "exists": true,
-                        "status": "errorExpired"
-                    },
-                    "name": "GCEWindowsAgent.exe",
-                    "pid": 580,
-                    "entity_id": "YWZkMzQ4YzYtMGVjOS00OTYxLTgwNWUtOGVkMmZjNGMwNDNiLTU4MC0xMzI5MzU0OTExMy40ODIyMTUwMDA=",
-                    "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
-                },
-                "destination": {
-                    "geo": {
-                        "continent_name": "North America",
-                        "country_iso_code": "US",
-                        "country_name": "United States",
-                        "location": {
-                            "lon": -97.822,
-                            "lat": 37.751
-                        }
-                    },
-                    "as": {
-                        "number": 15169,
-                        "organization": {
-                            "name": "GOOGLE"
-                        }
-                    },
-                    "address": "64.233.191.95",
-                    "port": 443,
-                    "bytes": 4923,
-                    "ip": "64.233.191.95"
-                },
-                "source": {
-                    "address": "10.201.0.32",
-                    "port": 54924,
-                    "bytes": 498,
-                    "ip": "10.201.0.32"
-                },
-                "dns": {
-                    "Ext": {
-                        "status": 123,
-                        "options": 9223372036854775808
-                    },
-                    "resolved_ip": [
-                        "10.10.10.10",
-                        "10.10.10.11"
-                    ],
-                    "question": {
-                        "name": "foo",
-                        "type": "A"
-                    }
-                },
-                "message": "Endpoint network event",
-                "network": {
-                    "transport": "tcp",
-                    "type": "ipv4",
-                    "direction": "egress"
-                },
-                "@timestamp": "2022-04-04T18:52:00.6007809Z",
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "logs",
-                    "dataset": "endpoint.events.network"
-                },
-                "host": {
-                    "hostname": "mgmt-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.32",
-                        "fe80::f8e6:a511:69ea:27c4",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "mgmt-win-1",
-                    "id": "51b19c6c-27e3-4c80-ac2a-b72ed52c40c9",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 36090,
-                    "ingested": "2022-04-04T18:52:21Z",
-                    "created": "2022-04-04T18:52:00.6007809Z",
-                    "kind": "event",
-                    "module": "endpoint",
-                    "action": "disconnect_received",
-                    "id": "MYfZG5h8j1qej16H+++++CFe",
-                    "category": [
-                        "network"
-                    ],
-                    "type": [
-                        "end"
-                    ],
-                    "dataset": "endpoint.events.network"
-                },
-                "user": {
-                    "domain": "NT AUTHORITY",
-                    "name": "SYSTEM",
-                    "id": "S-1-5-18"
-                }
-            }
-        },
-        {
-            "name": "metrics",
-            "fields": [
-                {
-                    "name": "@timestamp",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "date",
-                    "description": "Date/time when the event originated.\nThis is the date/time extracted from the event, typically representing when the event was generated by the source.\nIf the event source has no original timestamp, this value is typically populated by the first time the event was received by the pipeline.\nRequired field for all events.",
-                    "required": true,
-                    "example": "2016-05-23T08:05:34.853Z"
-                },
-                {
-                    "name": "message",
-                    "default_field": true,
-                    "level": "core",
-                    "type": "match_only_text",
-                    "description": "For log events the message field contains the log message, optimized for viewing in a log viewer.\nFor structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event.\nIf multiple messages exist, they can be combined into one message.",
-                    "example": "Hello World"
-                },
-                {
-                    "name": "Endpoint",
-                    "title": "Endpoint",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the state of the Elastic Endpoint when an event occurs.",
-                    "fields": [
-                        {
-                            "name": "metrics",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Metrics fields hold the endpoint and system's performance metrics"
-                        },
-                        {
-                            "name": "metrics.cpu",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "CPU statistics"
-                        },
-                        {
-                            "name": "metrics.cpu.endpoint",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "CPU metrics for the endpoint"
-                        },
-                        {
-                            "name": "metrics.cpu.endpoint.histogram",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "histogram",
-                            "description": "This field defines an elasticsearch histogram field (https://www.elastic.co/guide/en/elasticsearch/reference/current/histogram.html#histogram) The values field includes 20 buckets (each bucket is 5%) representing the cpu usage The counts field includes 20 buckets of how many times the endpoint's cpu usage fell into each bucket"
-                        },
-                        {
-                            "name": "metrics.cpu.endpoint.latest",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "half_float",
-                            "description": "Average CPU over the last sample interval"
-                        },
-                        {
-                            "name": "metrics.cpu.endpoint.mean",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "half_float",
-                            "description": "Average CPU load used by the endpoint"
-                        },
-                        {
-                            "name": "metrics.disks",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "An array of disk information for the host",
-                            "enabled": false
-                        },
-                        {
-                            "name": "metrics.disks.device",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Device name"
-                        },
-                        {
-                            "name": "metrics.disks.endpoint_drive",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "This field will be present and set to true only for the drive that holds the installed endpoint"
-                        },
-                        {
-                            "name": "metrics.disks.free",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The number of bytes marked as free on the disk"
-                        },
-                        {
-                            "name": "metrics.disks.fstype",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The file system type for the drive"
-                        },
-                        {
-                            "name": "metrics.disks.mount",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The disks mount location"
-                        },
-                        {
-                            "name": "metrics.disks.total",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The size of the disk in bytes"
-                        },
-                        {
-                            "name": "metrics.documents_volume",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Statistics about sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.alerts.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.alerts.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.alerts.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.alerts.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of API Event sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent API Event documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "An array of API Event document statistics per source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of API Event sent documents from source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent API Event documents from source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.source",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "API Event document source name"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed API Event documents from source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.sources.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed API Event documents from source"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed API Event documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.api_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed API Event documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.diagnostic_alerts.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.diagnostic_alerts.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.diagnostic_alerts.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.diagnostic_alerts.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.dns_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.dns_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.dns_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.dns_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.file_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.file_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.file_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.file_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.library_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.library_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.library_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.library_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.network_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.network_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.network_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.network_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.overall.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.overall.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.overall.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.overall.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.process_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.process_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.process_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.process_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.registry_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.registry_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.registry_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.registry_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.security_events.sent_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.security_events.sent_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of sent documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.security_events.suppressed_bytes",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Total size of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.documents_volume.security_events.suppressed_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of suppressed documents"
-                        },
-                        {
-                            "name": "metrics.event_filter.active_global_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The number of active global event filters",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.event_filter.active_user_count",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The number of active user event filters",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.malicious_behavior_rules",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "An array of performance information about each malicious behavior rule",
-                            "enabled": false
-                        },
-                        {
-                            "name": "metrics.malicious_behavior_rules.endpoint_uptime_percent",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "Perfect of Endpoint's update spent running the rule",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.malicious_behavior_rules.id",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The rule id",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.memory",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Memory statistics"
-                        },
-                        {
-                            "name": "metrics.memory.endpoint",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Endpoint memory utilization"
-                        },
-                        {
-                            "name": "metrics.memory.endpoint.private",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "The memory private to the endpoint"
-                        },
-                        {
-                            "name": "metrics.memory.endpoint.private.latest",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "The memory usage by the endpoint for the last sample interval"
-                        },
-                        {
-                            "name": "metrics.memory.endpoint.private.mean",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Average memory usage by the endpoint since its start"
-                        },
-                        {
-                            "name": "metrics.system_impact",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "An array of system impact information",
-                            "enabled": false,
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.authentication_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing authentication events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.authentication_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on authentication events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.dns_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing DNS events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.dns_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on DNS events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.file_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing file events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.file_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on file events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.library_load_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing library load events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.library_load_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on library load events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.malware.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing malware scanning due to the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.malware.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on malware scanning due to the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.network_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing network events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.network_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on network events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.overall.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing activity for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.overall.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent monitoring the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "nested",
-                            "description": "Code signature of the process",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.exists",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if a signature is present.",
-                            "example": "true",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.signing_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "description": "'The identifier used to sign the binary.\nThis is used to identify the application manufactured by a software vendor. The field is relevant to Apple *OS only.'",
-                            "example": "com.apple.xpc.proxy",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.status",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Additional information about the certificate status.\nThis is useful for logging cryptographic errors with the certificate validity or trust status. Leave unpopulated if the validity or trust of the certificate was unchecked.",
-                            "example": "ERROR_UNTRUSTED_ROOT",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.subject_name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "Subject name of the code signer",
-                            "example": "Microsoft Corporation",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.team_id",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "description": "'The team identifier used to sign the binary.\nThis is used to identify the team or vendor of a software product. The field is relevant to Apple *OS only.'",
-                            "example": "EQHXZ8M8AV",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.trusted",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Stores the trust status of the certificate chain.\nValidating the trust of the certificate chain may be complicated, and this field should only be populated by tools that actively check the status.",
-                            "example": "true",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.code_signature.valid",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "boolean",
-                            "description": "Boolean to capture if the digital signature is verified against the binary content.\nLeave unpopulated if a certificate was unchecked.",
-                            "example": "true",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process.executable",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "Path to the process executable for the impact entry",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing process events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.process_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on process events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.registry_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing registry events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.registry_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on registry events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.threat_intelligence_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing ETW Threat-Intelligence events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.threat_intelligence_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on ETW Threat-Intelligence events for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.win32k_events.week_idle_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent queueing ETW Win32k events (currently, only keylogging events) for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.system_impact.win32k_events.week_ms",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "unsigned_long",
-                            "description": "The total milliseconds spent on ETW Win32k events (currently, only keylogging events) for the process over the last week",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.threads",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Statistics about the individual Endpoint threads (array)",
-                            "enabled": false
-                        },
-                        {
-                            "name": "metrics.threads.cpu.mean",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "double",
-                            "description": "The thread's average CPU use",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.threads.name",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "description": "The thread name",
-                            "doc_values": false,
-                            "index": false
-                        },
-                        {
-                            "name": "metrics.uptime",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Number of seconds since boot"
-                        },
-                        {
-                            "name": "metrics.uptime.endpoint",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of seconds since the endpoint was started"
-                        },
-                        {
-                            "name": "metrics.uptime.system",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "long",
-                            "description": "Number of seconds since the system was started"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "agent",
-                    "title": "Agent",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The agent fields contain the data about the software entity, if any, that collects, detects, or observes events on a host, or takes measurements on a host.\nExamples include Beats. Agents may also run on observers. ECS agent.* fields shall be populated with details of the agent running on the host or observer where the event happened or the measurement was taken.",
-                    "fields": [
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique identifier of this agent (if one exists).\nExample: For Beats this would be beat.id.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of the agent.\nThe agent type always stays the same and should be given by the agent used. In case of Filebeat the agent would always be Filebeat also if two Filebeat instances are run on the same machine.",
-                            "example": "filebeat"
-                        },
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Version of the agent.",
-                            "example": "6.0.0-rc2"
-                        }
-                    ],
-                    "group": 2,
-                    "footnote": "Examples: In the case of Beats for logs, the agent.name is filebeat. For APM, it is the agent running in the app/service. The agent information does not change if data is sent through queuing systems like Kafka, Redis, or processing systems such as Logstash or APM Server."
-                },
-                {
-                    "name": "data_stream",
-                    "title": "data_stream",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Fields describing the new indexing strategy <type>-<dataset>-<namespace>",
-                    "fields": [
-                        {
-                            "name": "dataset",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream dataset name.",
-                            "example": "nginx.access"
-                        },
-                        {
-                            "name": "namespace",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream namespace.",
-                            "example": "production"
-                        },
-                        {
-                            "name": "type",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "constant_keyword",
-                            "description": "Data stream type.",
-                            "example": "logs"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "ecs",
-                    "title": "ECS",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "Meta-information specific to ECS.",
-                    "fields": [
-                        {
-                            "name": "version",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "ECS version this event conforms to. `ecs.version` is a required field and must exist in all events.\nWhen querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events.",
-                            "required": true,
-                            "example": "1.0.0"
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "event",
-                    "title": "Event",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "The event fields are used for context information about the log or metric event itself.\nA log is defined as an event containing details of something that happened. Log events must include the time at which the thing happened. Examples of log events include a process starting on a host, a network packet being sent from a source to a destination, or a network connection between a client and a server being initiated or closed. A metric is defined as an event containing one or more numerical measurements and the time at which the measurement was taken. Examples of metric events include memory pressure measured on a host and device temperature. See the `event.kind` definition in this section for additional details about metric and state events.",
-                    "fields": [
-                        {
-                            "name": "action",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "The action captured by the event.\nThis describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer.",
-                            "example": "user-password-change"
-                        },
-                        {
-                            "name": "category",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the second level in the ECS category hierarchy.\n`event.category` represents the \"big buckets\" of ECS categories. For example, filtering on `event.category:process` yields all events relating to process activity. This field is closely related to `event.type`, which is used as a subcategory.\nThis field is an array. This will allow proper categorization of some events that fall in multiple categories.",
-                            "example": "authentication"
-                        },
-                        {
-                            "name": "code",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Identification code for this event, if one exists.\nSome event sources use event codes to identify messages unambiguously, regardless of message language or wording adjustments over time. An example of this is the Windows Event ID.",
-                            "example": 4648
-                        },
-                        {
-                            "name": "created",
-                            "level": "core",
-                            "type": "date",
-                            "description": "`event.created` contains the date/time when the event was first read by an agent, or by your pipeline.\nThis field is distinct from `@timestamp` in that `@timestamp` typically contain the time extracted from the original event.\nIn most situations, these two timestamps will be slightly different. The difference can be used to calculate the delay between your source generating an event, and the time when your agent first processed it. This can be used to monitor your agent's or pipeline's ability to keep up with your event source.\nIn case the two timestamps are identical, `@timestamp` should be used.",
-                            "example": "2016-05-23T08:05:34.857Z"
-                        },
-                        {
-                            "name": "dataset",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the dataset.\nIf an event source publishes more than one type of log or events (e.g. access log, error log), the dataset is used to specify which one the event comes from.\nIt's recommended but not required to start the dataset name with the module name, followed by a dot, then the dataset name.",
-                            "example": "apache.access"
-                        },
-                        {
-                            "name": "end",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.end` contains the date when the event ended or when the activity was last observed."
-                        },
-                        {
-                            "name": "hash",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hash (perhaps logstash fingerprint) of raw field to be able to demonstrate log integrity.",
-                            "example": "123456789012345678901234567890ABCD"
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique ID to describe the event.",
-                            "example": "8a4f500d"
-                        },
-                        {
-                            "name": "ingested",
-                            "default_field": false,
-                            "level": "core",
-                            "type": "date",
-                            "description": "Timestamp when an event arrived in the central data store.\nThis is different from `@timestamp`, which is when the event originally occurred.  It's also different from `event.created`, which is meant to capture the first time an agent saw the event.\nIn normal conditions, assuming no tampering, the timestamps should chronologically look like this: `@timestamp` < `event.created` < `event.ingested`.",
-                            "example": "2016-05-23T08:05:35.101Z"
-                        },
-                        {
-                            "name": "kind",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the highest level in the ECS category hierarchy.\n`event.kind` gives high-level information about what type of information the event contains, without being specific to the contents of the event. For example, values of this field distinguish alert events from metric events.\nThe value of this field can be used to inform how these kinds of events should be handled. They may warrant different retention, different access control, it may also help understand whether the data is coming in at a regular interval or not.",
-                            "example": "alert"
-                        },
-                        {
-                            "name": "module",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the module this data is coming from.\nIf your monitoring agent supports the concept of modules or plugins to process events of a given source (e.g. Apache logs), `event.module` should contain the name of this module.",
-                            "example": "apache"
-                        },
-                        {
-                            "name": "outcome",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the lowest level in the ECS category hierarchy.\n`event.outcome` simply denotes whether the event represents a success or a failure from the perspective of the entity that produced the event.\nNote that when a single transaction is described in multiple events, each event may populate different values of `event.outcome`, according to their perspective.\nAlso note that in the case of a compound event (a single event that contains multiple logical events), this field should be populated with the value that best captures the overall success or failure from the perspective of the event producer.\nFurther note that not all events will have an associated outcome. For example, this field is generally not populated for metric events, events with `event.type:info`, or any events for which an outcome does not make logical sense.",
-                            "example": "success"
-                        },
-                        {
-                            "name": "provider",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Source of the event.\nEvent transports such as Syslog or the Windows Event Log typically mention the source of an event. It can be the name of the software that generated the event (e.g. Sysmon, httpd), or of a subsystem of the operating system (kernel, Microsoft-Windows-Security-Auditing).",
-                            "example": "kernel"
-                        },
-                        {
-                            "name": "sequence",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Sequence number of the event.\nThe sequence number is a value published by some event sources, to make the exact ordering of events unambiguous, regardless of the timestamp precision.",
-                            "format": "string"
-                        },
-                        {
-                            "name": "severity",
-                            "level": "core",
-                            "type": "long",
-                            "description": "The numeric severity of the event according to your event source.\nWhat the different severity values mean can be different between sources and use cases. It's up to the implementer to make sure severities are consistent across events from the same source.\nThe Syslog severity belongs in `log.syslog.severity.code`. `event.severity` is meant to represent the severity according to the event source (e.g. firewall, IDS). If the event source does not publish its own severity, you may optionally copy the `log.syslog.severity.code` to `event.severity`.",
-                            "example": 7,
-                            "format": "string"
-                        },
-                        {
-                            "name": "start",
-                            "level": "extended",
-                            "type": "date",
-                            "description": "`event.start` contains the date when the event started or when the activity was first observed."
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "This is one of four ECS Categorization Fields, and indicates the third level in the ECS category hierarchy.\n`event.type` represents a categorization \"sub-bucket\" that, when used along with the `event.category` field values, enables filtering events down to a level appropriate for single visualization.\nThis field is an array. This will allow proper categorization of some events that fall in multiple event types."
-                        }
-                    ],
-                    "group": 2
-                },
-                {
-                    "name": "host",
-                    "title": "Host",
-                    "default_field": true,
-                    "type": "group",
-                    "description": "A host is defined as a general computing instance.\nECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.",
-                    "fields": [
-                        {
-                            "name": "architecture",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system architecture.",
-                            "example": "x86_64"
-                        },
-                        {
-                            "name": "domain",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the domain of which the host is a member.\nFor example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider.",
-                            "example": "CONTOSO"
-                        },
-                        {
-                            "name": "hostname",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Hostname of the host.\nIt normally contains what the `hostname` command returns on the host machine."
-                        },
-                        {
-                            "name": "id",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Unique host id.\nAs hostname is not always unique, use values that are meaningful in your environment.\nExample: The current usage of `beat.name`."
-                        },
-                        {
-                            "name": "ip",
-                            "level": "core",
-                            "type": "ip",
-                            "description": "Host ip addresses."
-                        },
-                        {
-                            "name": "mac",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Host MAC addresses.\nThe notation format from RFC 7042 is suggested: Each octet (that is, 8-bit byte) is represented by two [uppercase] hexadecimal digits giving the value of the octet as an unsigned integer. Successive octets are separated by a hyphen.",
-                            "example": "[\"00-00-5E-00-53-23\", \"00-00-5E-00-53-24\"]",
-                            "pattern": "^[A-F0-9]{2}(-[A-F0-9]{2}){5,}$"
-                        },
-                        {
-                            "name": "name",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Name of the host.\nIt can contain what hostname returns on Unix systems, the fully qualified domain name (FQDN), or a name specified by the user. The recommended value is the lowercase FQDN of the host."
-                        },
-                        {
-                            "name": "os.Ext",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "object",
-                            "description": "Object for all custom defined fields to live in."
-                        },
-                        {
-                            "name": "os.Ext.variant",
-                            "default_field": false,
-                            "level": "custom",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "A string value or phrase that further aid to classify or qualify the operating system (OS).  For example the distribution for a Linux OS will be entered in this field.",
-                            "example": "Ubuntu"
-                        },
-                        {
-                            "name": "os.family",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "OS family (such as redhat, debian, freebsd, windows).",
-                            "example": "debian"
-                        },
-                        {
-                            "name": "os.full",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, including the version or code name.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS Mojave"
-                        },
-                        {
-                            "name": "os.kernel",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system kernel version as a raw string.",
-                            "example": "4.4.0-112-generic"
-                        },
-                        {
-                            "name": "os.name",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system name, without the version.",
-                            "multi_fields": [
-                                {
-                                    "name": "caseless",
-                                    "type": "keyword",
-                                    "normalizer": "lowercase",
-                                    "ignore_above": 1024,
-                                    "default_field": false
-                                },
-                                {
-                                    "name": "text",
-                                    "type": "text",
-                                    "norms": false,
-                                    "default_field": false
-                                }
-                            ],
-                            "example": "Mac OS X"
-                        },
-                        {
-                            "name": "os.platform",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system platform (such centos, ubuntu, windows).",
-                            "example": "darwin"
-                        },
-                        {
-                            "name": "os.type",
-                            "default_field": false,
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Use the `os.type` field to categorize the operating system into one of the broad commercial families.\nIf the OS you're dealing with is not listed as an expected value, the field should not be populated. Please let us know by opening an issue with ECS, to propose its addition.",
-                            "example": "macos"
-                        },
-                        {
-                            "name": "os.version",
-                            "level": "extended",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Operating system version as a raw string.",
-                            "example": "10.14.1"
-                        },
-                        {
-                            "name": "type",
-                            "level": "core",
-                            "type": "keyword",
-                            "ignore_above": 1024,
-                            "description": "Type of host.\nFor Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment."
-                        },
-                        {
-                            "name": "uptime",
-                            "level": "extended",
-                            "type": "long",
-                            "description": "Seconds the host has been up.",
-                            "example": 1325
-                        }
-                    ],
-                    "group": 2
-                }
-            ],
-            "sample_event": {
-                "agent": {
-                    "build": {
-                        "original": "version: 8.3.0-SNAPSHOT, compiled: Fri Apr 1 06:00:00 2022, branch: main, commit: f8b0ed879ad40ee1ae561ced31ec8a4027a2bf53"
-                    },
-                    "id": "4c9c9cb3-f80f-44d8-9c89-6168243b7f21",
-                    "type": "endpoint",
-                    "version": "8.3.0-SNAPSHOT"
-                },
-                "message": "Endpoint metrics",
-                "@timestamp": "2022-04-04T18:38:15.7178887Z",
-                "Endpoint": {
-                    "metrics": {
-                        "system_impact": [
-                            {
-                                "file_events": {
-                                    "week_ms": 418
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows Publisher",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\svchost.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 7483
-                                },
-                                "process_events": {
-                                    "week_ms": 78
-                                },
-                                "registry_events": {
-                                    "week_ms": 248
-                                },
-                                "dns_events": {
-                                    "week_ms": 16
-                                },
-                                "network_events": {
-                                    "week_ms": 8
-                                },
-                                "overall": {
-                                    "week_ms": 11744
-                                },
-                                "authentication_events": {
-                                    "week_ms": 155
-                                },
-                                "library_load_events": {
-                                    "week_ms": 3028
-                                },
-                                "cred_access_events": {
-                                    "week_ms": 10
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 250
-                                },
-                                "win32k_events": {
-                                    "week_ms": 50
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 46
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 2
-                                },
-                                "process_events": {
-                                    "week_ms": 19
-                                },
-                                "registry_events": {
-                                    "week_ms": 3
-                                },
-                                "overall": {
-                                    "week_ms": 8290
-                                },
-                                "library_load_events": {
-                                    "week_ms": 7890
-                                },
-                                "cred_access_events": {
-                                    "week_ms": 20
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 300
-                                },
-                                "win32k_events": {
-                                    "week_ms": 10
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 1641
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Elasticsearch, Inc.",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Winlogbeat\\winlogbeat.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 2589
-                                },
-                                "process_events": {
-                                    "week_ms": 419
-                                },
-                                "registry_events": {
-                                    "week_ms": 1
-                                },
-                                "network_events": {
-                                    "week_ms": 32
-                                },
-                                "overall": {
-                                    "week_ms": 5046
-                                },
-                                "library_load_events": {
-                                    "week_ms": 4
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 360
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 2
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows Publisher",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\lsass.exe"
-                                },
-                                "process_events": {
-                                    "week_ms": 3
-                                },
-                                "registry_events": {
-                                    "week_ms": 83
-                                },
-                                "overall": {
-                                    "week_ms": 4761
-                                },
-                                "authentication_events": {
-                                    "week_ms": 3177
-                                },
-                                "library_load_events": {
-                                    "week_ms": 26
-                                },
-                                "cred_access_events": {
-                                    "week_ms": 1350
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 120
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\conhost.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 16
-                                },
-                                "process_events": {
-                                    "week_ms": 26
-                                },
-                                "registry_events": {
-                                    "week_ms": 3
-                                },
-                                "overall": {
-                                    "week_ms": 3261
-                                },
-                                "library_load_events": {
-                                    "week_ms": 2966
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 250
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 51
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false,
-                                            "status": "errorCode_endpoint: Initital state, no attempt to load signature was made"
-                                        }
-                                    ],
-                                    "executable": "System"
-                                },
-                                "malware": {
-                                    "week_ms": 1978
-                                },
-                                "overall": {
-                                    "week_ms": 2029
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web\\e266326169887aa7cb26b9e2aa421ee4\\System.Web.ni.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 1015
-                                },
-                                "overall": {
-                                    "week_ms": 1015
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 8
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Elasticsearch, Inc.",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\metricbeat-8.3.0-SNAPSHOT-windows-x86_64\\metricbeat.exe"
-                                },
-                                "process_events": {
-                                    "week_ms": 502
-                                },
-                                "dns_events": {
-                                    "week_ms": 84
-                                },
-                                "network_events": {
-                                    "week_ms": 1
-                                },
-                                "overall": {
-                                    "week_ms": 1162
-                                },
-                                "library_load_events": {
-                                    "week_ms": 417
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 150
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": false,
-                                            "subject_name": "Google LLC",
-                                            "exists": true,
-                                            "status": "errorExpired"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Google\\Compute Engine\\agent\\GCEWindowsAgent.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 627
-                                },
-                                "process_events": {
-                                    "week_ms": 89
-                                },
-                                "registry_events": {
-                                    "week_ms": 2
-                                },
-                                "dns_events": {
-                                    "week_ms": 7
-                                },
-                                "network_events": {
-                                    "week_ms": 8
-                                },
-                                "overall": {
-                                    "week_ms": 1068
-                                },
-                                "library_load_events": {
-                                    "week_ms": 85
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 250
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\Microsoft.P521220ea#\\39ce4aafe1a3bc56fb1435f6550dd7a3\\Microsoft.PowerShell.Commands.Utility.ni.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 760
-                                },
-                                "overall": {
-                                    "week_ms": 760
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 15
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\metricbeat-7.10.0-windows-x86_64\\metricbeat.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 29
-                                },
-                                "process_events": {
-                                    "week_ms": 634
-                                },
-                                "registry_events": {
-                                    "week_ms": 1
-                                },
-                                "dns_events": {
-                                    "week_ms": 8
-                                },
-                                "network_events": {
-                                    "week_ms": 4
-                                },
-                                "overall": {
-                                    "week_ms": 744
-                                },
-                                "library_load_events": {
-                                    "week_ms": 3
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 50
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\spoolsv.exe"
-                                },
-                                "process_events": {
-                                    "week_ms": 8
-                                },
-                                "registry_events": {
-                                    "week_ms": 40
-                                },
-                                "overall": {
-                                    "week_ms": 795
-                                },
-                                "library_load_events": {
-                                    "week_ms": 627
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 120
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Elasticsearch, Inc.",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Packetbeat\\packetbeat.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 74
-                                },
-                                "process_events": {
-                                    "week_ms": 432
-                                },
-                                "registry_events": {
-                                    "week_ms": 1
-                                },
-                                "network_events": {
-                                    "week_ms": 1
-                                },
-                                "overall": {
-                                    "week_ms": 599
-                                },
-                                "library_load_events": {
-                                    "week_ms": 61
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 30
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 20
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Corporation",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        },
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Corporation",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\csc.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 350
-                                },
-                                "process_events": {
-                                    "week_ms": 19
-                                },
-                                "registry_events": {
-                                    "week_ms": 1
-                                },
-                                "overall": {
-                                    "week_ms": 480
-                                },
-                                "library_load_events": {
-                                    "week_ms": 70
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 20
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 6
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Elasticsearch, Inc.",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Elastic\\Agent\\data\\elastic-agent-e80913\\install\\filebeat-8.3.0-SNAPSHOT-windows-x86_64\\filebeat.exe"
-                                },
-                                "process_events": {
-                                    "week_ms": 395
-                                },
-                                "dns_events": {
-                                    "week_ms": 51
-                                },
-                                "network_events": {
-                                    "week_ms": 2
-                                },
-                                "overall": {
-                                    "week_ms": 494
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 40
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Google LLC",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Program Files\\Google\\Compute Engine\\vss\\GoogleVssProvider.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 439
-                                },
-                                "overall": {
-                                    "week_ms": 439
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\VSSVC.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 45
-                                },
-                                "process_events": {
-                                    "week_ms": 13
-                                },
-                                "registry_events": {
-                                    "week_ms": 124
-                                },
-                                "overall": {
-                                    "week_ms": 476
-                                },
-                                "authentication_events": {
-                                    "week_ms": 8
-                                },
-                                "library_load_events": {
-                                    "week_ms": 216
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 70
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\SYSTEM32\\mispace.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 353
-                                },
-                                "overall": {
-                                    "week_ms": 353
-                                }
-                            },
-                            {
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "exists": false
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Web.28b9ef5a#\\b1cbeb46534d9974961496306f2f1a28\\System.Web.Extensions.ni.dll"
-                                },
-                                "malware": {
-                                    "week_ms": 305
-                                },
-                                "overall": {
-                                    "week_ms": 305
-                                }
-                            },
-                            {
-                                "file_events": {
-                                    "week_ms": 25
-                                },
-                                "process": {
-                                    "code_signature": [
-                                        {
-                                            "trusted": true,
-                                            "subject_name": "Microsoft Windows",
-                                            "exists": true,
-                                            "status": "trusted"
-                                        }
-                                    ],
-                                    "executable": "C:\\Windows\\System32\\wbem\\WMIADAP.exe"
-                                },
-                                "malware": {
-                                    "week_ms": 247
-                                },
-                                "process_events": {
-                                    "week_ms": 4
-                                },
-                                "registry_events": {
-                                    "week_ms": 5
-                                },
-                                "overall": {
-                                    "week_ms": 345
-                                },
-                                "library_load_events": {
-                                    "week_ms": 14
-                                },
-                                "threat_intelligence_events": {
-                                    "week_ms": 50
-                                }
-                            }
-                        ],
-                        "memory": {
-                            "endpoint": {
-                                "private": {
-                                    "mean": 288590259,
-                                    "latest": 493723648
-                                }
-                            }
-                        },
-                        "disks": [
-                            {
-                                "endpoint_drive": true,
-                                "total": 53564403712,
-                                "free": 25891106816,
-                                "device": "\\Device\\HarddiskVolume3",
-                                "mount": "C:\\",
-                                "fstype": "NTFS"
-                            },
-                            {
-                                "total": 100663296,
-                                "free": 73579520,
-                                "device": "\\Device\\HarddiskVolume2",
-                                "mount": "",
-                                "fstype": "FAT32"
-                            }
-                        ],
-                        "documents_volume": {
-                            "file_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 3485,
-                                "sent_bytes": 7302875
-                            },
-                            "security_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 259,
-                                "sent_bytes": 422247
-                            },
-                            "library_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 114,
-                                "sent_bytes": 287954
-                            },
-                            "process_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 201,
-                                "sent_bytes": 602914
-                            },
-                            "registry_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 605,
-                                "sent_bytes": 1288593
-                            },
-                            "dns_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 5250,
-                                "sent_bytes": 11364752
-                            },
-                            "network_events": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 1753,
-                                "sent_bytes": 3479631
-                            },
-                            "overall": {
-                                "suppressed_count": 0,
-                                "suppressed_bytes": 0,
-                                "sent_count": 11667,
-                                "sent_bytes": 24748966
-                            }
-                        },
-                        "cpu": {
-                            "endpoint": {
-                                "mean": 0.324235176435677,
-                                "latest": 62.6406111450215
-                            }
-                        },
-                        "threads": [
-                            {
-                                "name": "actionsAPIThread",
-                                "cpu": {
-                                    "mean": 0.00456829602558246
-                                }
-                            },
-                            {
-                                "name": "stateReportThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "checkinAPIThread",
-                                "cpu": {
-                                    "mean": 0.0365463682046597
-                                }
-                            },
-                            {
-                                "name": "KernelAsyncMessageQueueConsumerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "Cron",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "File Cache",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "FileLogThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "LoggingLimitThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "CredentialAccessEventDispatcherThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelPortConsumerThread",
-                                "cpu": {
-                                    "mean": 0.00456454263282819
-                                }
-                            },
-                            {
-                                "name": "KernelPortConsumerThread",
-                                "cpu": {
-                                    "mean": 0.00456454263282819
-                                }
-                            },
-                            {
-                                "name": "RulesEngineThread",
-                                "cpu": {
-                                    "mean": 0.0091324200913242
-                                }
-                            },
-                            {
-                                "name": "KernelPortConsumerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelAsyncMessageQueueConsumerThread",
-                                "cpu": {
-                                    "mean": 0.00456454263282819
-                                }
-                            },
-                            {
-                                "name": "KernelSyncQueueConsumerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "DocumentLoggingThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "DocumentLoggingMaintenance",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "BulkConsumerThread",
-                                "cpu": {
-                                    "mean": 0.00455871626549964
-                                }
-                            },
-                            {
-                                "name": "DocumentLoggingConsumerThread",
-                                "cpu": {
-                                    "mean": 0.113967906637491
-                                }
-                            },
-                            {
-                                "name": "DocumentLoggingLimitThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.022822713164141
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.022822713164141
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelSyncMessageThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "ArtifactManifestDownload",
-                                "cpu": {
-                                    "mean": 0.12311901504788
-                                }
-                            },
-                            {
-                                "name": "PolicyReloadThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "CredentialAccessClassifierThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "KernelPortConsumerThread",
-                                "cpu": {
-                                    "mean": 0.0136936278984846
-                                }
-                            },
-                            {
-                                "name": "PerformanceMonitorWorkerThread",
-                                "cpu": {
-                                    "mean": 0.00912200684150513
-                                }
-                            },
-                            {
-                                "name": "MetadataThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "EventsQueueThread",
-                                "cpu": {
-                                    "mean": 0.0729760547320411
-                                }
-                            },
-                            {
-                                "name": "DelayedAlertEnrichment",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "MaintainProcessMap",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "FileScoreThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "DiagnosticMalwareThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "QuarantineManagerWorkerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "EventProcessingThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "HostIsolationMonitorThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "serviceCommsThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "grpcConnectionManagerThread",
-                                "cpu": {
-                                    "mean": 0.0
-                                }
-                            },
-                            {
-                                "name": "RansomwareGlobalUserThread"
-                            },
-                            {
-                                "name": "RansomwareProcessMonitorThread"
-                            },
-                            {
-                                "name": "RansomwareFileCacheCleanupThread"
-                            },
-                            {
-                                "name": "RansomwareParseUnverifiedThread"
-                            },
-                            {
-                                "name": "RansomwareLuaVerifiedThread"
-                            }
-                        ],
-                        "uptime": {
-                            "endpoint": 21930,
-                            "system": 21992
-                        }
-                    }
-                },
-                "ecs": {
-                    "version": "1.11.0"
-                },
-                "data_stream": {
-                    "namespace": "default",
-                    "type": "metrics",
-                    "dataset": "endpoint.metrics"
-                },
-                "host": {
-                    "hostname": "data-viz-win-1",
-                    "os": {
-                        "Ext": {
-                            "variant": "Windows Server 2019 Datacenter"
-                        },
-                        "kernel": "1809 (10.0.17763.2686)",
-                        "name": "Windows",
-                        "family": "windows",
-                        "type": "windows",
-                        "version": "1809 (10.0.17763.2686)",
-                        "platform": "windows",
-                        "full": "Windows Server 2019 Datacenter 1809 (10.0.17763.2686)"
-                    },
-                    "ip": [
-                        "10.201.0.13",
-                        "fe80::f40a:aed0:618a:972d",
-                        "127.0.0.1",
-                        "::1"
-                    ],
-                    "name": "data-viz-win-1",
-                    "id": "2beebb8e-e5f0-46ca-8635-97ba7bb8ccca",
-                    "mac": [
-                        "00-00-5E-00-53-23"
-                    ],
-                    "architecture": "x86_64"
-                },
-                "event": {
-                    "agent_id_status": "verified",
-                    "sequence": 35124,
-                    "ingested": "2022-04-04T18:38:16Z",
-                    "created": "2022-04-04T18:38:15.7178887Z",
-                    "kind": "metric",
-                    "module": "endpoint",
-                    "action": "endpoint_metrics",
-                    "id": "MYfZG00oEwD2/fqT+++++Byi",
-                    "category": [
-                        "host"
-                    ],
-                    "type": [
-                        "info"
-                    ],
-                    "dataset": "endpoint.metrics"
-                }
-            }
-        }
-    ]
-}
\ No newline at end of file

From 6b628af463af4436f9821252b30b3a4355500f9d Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 4 Apr 2025 16:58:31 +0000
Subject: [PATCH 21/25] PR Feedback

---
 scripts/generate-docs/pydocgen/__main__.py    |   6 ++
 scripts/generate-docs/pydocgen/markdown.py    | 100 ++++++++++++------
 .../pydocgen/models/custom_documentation.py   |   4 +-
 3 files changed, 74 insertions(+), 36 deletions(-)

diff --git a/scripts/generate-docs/pydocgen/__main__.py b/scripts/generate-docs/pydocgen/__main__.py
index 2c2afabf4..8d531ed9e 100644
--- a/scripts/generate-docs/pydocgen/__main__.py
+++ b/scripts/generate-docs/pydocgen/__main__.py
@@ -78,6 +78,12 @@ def main():
         help="Set logging verbosity level",
     )
 
+    parser.add_argument(
+        "--overrides",
+        type=pathlib.Path,
+        default=pathlib.Path.cwd().resolve() / "custom_documentation" / "src" / "documentation_overrides.yaml",
+    )
+
     parser.add_argument(
         "--csv",
         type=pathlib.Path,
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index 65523124f..5f91284a2 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -197,8 +197,16 @@ def get_kql_query_string(filter: Filter) -> str:
 
                 f.write(f"## Fields\n\n")
                 for field in custom_doc.fields.endpoint:
-                    description = None
-                    example = None
+                    meta = {
+                        "ecs": {
+                            "description": None,
+                            "example": None,
+                        },
+                        "endpoint": {
+                            "description": None,
+                            "example": None,
+                        },
+                    }
                     event_name = custom_doc.filepath.stem
 
                     #
@@ -211,11 +219,9 @@ def get_kql_query_string(filter: Filter) -> str:
                         #
                         # The package field description may contain newlines, so we replace them with spaces
                         #
-                        description = package_field.description.replace(
-                            "\n", "  "
-                        ).replace("\r", "  ")
-                        if package_field.example:
-                            example = package_field.example
+                        meta["ecs"]["description"] = package_field.description.replace(
+                            "\n", "  ").replace("\r", "  ")
+                        meta["ecs"]["example"] = package_field.example
 
                     #
                     # This query will look for an override for the field in the following order:
@@ -258,41 +264,65 @@ def get_kql_query_string(filter: Filter) -> str:
                     ).first()
 
                     if override_meta:
-                        override = override_meta.override
-                        if override.description:
-                            description = override.description
-                            logging.debug(
-                                f"Found description override for field {field} in {event_name}"
-                            )
-                        if override.example:
-                            example = override.example
-                            logging.debug(
-                                f"Found example override for field {field} in {event_name}"
-                            )
+                        meta["endpoint"]["description"] = override_meta.override.description
+                        meta["endpoint"]["example"] = override_meta.override.example
 
-                    if csv_writer and (not description or not example):
+                    if csv_writer and (not meta["ecs"]["description"] or not meta["ecs"]["example"]):
                         csv_writer.add_row(
                             field_name=field,
                             event_name=event_name,
-                            has_description=bool(description),
-                            has_example=bool(example),
+                            has_description=bool(meta["ecs"]["description"]),
+                            has_example=bool(meta["ecs"]["example"]),
                         )
 
-                    description = (
-                        description if description else "No description available"
-                    )
-                    example = example if example else None
-
-                    f.write(f"#### `{field}`\n\n")
-                    f.write("<div style='margin-left: 20px;'>\n")
-                    f.write("<table>\n")
-                    f.write(f"<tr><td>Description</td><td>{description}</td></tr>\n")
-                    if example:
-                        f.write(
-                            f"<tr><td>Example</td><td><code>{example}</code></td></tr>\n"
+                    if "._" in field or ".*" in field:
+                        logging.info(
+                            f"Skipping field {field} because it is a wildcard or special field"
                         )
-                    f.write("</table>\n\n<br>\n\n")
-                    f.write("</div>\n\n")
+                        continue
+
+                    f.write(f"### `{field}`\n\n")
+
+                    if not any([
+                        meta["ecs"]["description"],
+                        meta["endpoint"]["description"],
+                        meta["endpoint"]["example"],
+                        meta["ecs"]["example"],
+                    ]):
+                        f.write("No description or example found\n\n")
+                        f.write("<br>\n\n")
+                        continue
+
+                    if meta["ecs"]["description"]:
+                        f.write("**ECS Description**\n\n")
+                        f.write(f">{meta['ecs']['description']}\n\n")
+                    if meta["endpoint"]["description"]:
+                        f.write("**Extended Description**\n\n")
+                        f.write(f"> {meta['endpoint']['description']}\n\n")
+                    if meta["endpoint"]["example"]:
+                        f.write("**Example**\n\n")
+                        f.write(f">{meta['endpoint']['example']}\n\n")
+                    elif meta["ecs"]["example"]:
+                        f.write("**Example**\n\n")
+                        f.write(f">{meta['ecs']['example']}\n\n")
+                    f.write("<br>\n\n")
+
+                    # f.write("<table>\n")
+                    # if meta["ecs"]["description"]:
+                    #     f.write(f"<tr><td><strong>Description</strong></td><td>{meta['ecs']['description']}</td></tr>\n")
+                    # if meta["endpoint"]["description"]:
+                    #     f.write(
+                    #         f"<tr><td><strong>Endpoint Description</strong></td><td>{meta['endpoint']['description']}</td></tr>\n"
+                    #     )
+                    # if meta["endpoint"]["example"]:
+                    #     f.write(
+                    #         f"<tr><td><strong>ECS Example</strong></td><td><code>{meta['endpoint']['example']}</code></td></tr>\n"
+                    #     )
+                    # elif meta["ecs"]["example"]:
+                    #     f.write(
+                    #         f"<tr><td><strong>Endpoint Example</strong></td><td><code>{meta['ecs']['example']}</code></td></tr>\n"
+                    #     )
+                    # f.write("</table>\n\n")
 
             logging.debug(f"wrote markdown to {output_filename}")
 
diff --git a/scripts/generate-docs/pydocgen/models/custom_documentation.py b/scripts/generate-docs/pydocgen/models/custom_documentation.py
index 88b597b84..2baa8c8de 100644
--- a/scripts/generate-docs/pydocgen/models/custom_documentation.py
+++ b/scripts/generate-docs/pydocgen/models/custom_documentation.py
@@ -175,9 +175,11 @@ def from_yaml(
         cls, yaml_path: pathlib.Path = DOCUMENTATION_OVERRIDE_PATH
     ) -> "DocumentationOverrideMap":
         logging.debug(f"Reading documentation overrides from {yaml_path}")
+        if not yaml_path.exists():
+            raise FileNotFoundError(f"Documentation override file {yaml_path} does not exist")
         doc_overrides = cls()
         with yaml_path.open("r") as f:
             data = yaml.safe_load(f)
             for item in data:
-                doc_overrides.append(item["name"], OverrideMapping(**item["overrides"]))
+                doc_overrides.append(item["name"], OverrideMapping(**item))
         return doc_overrides

From 48f6d68c75c99fece2c12b260bdd6c74ad65354b Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 4 Apr 2025 17:58:53 +0000
Subject: [PATCH 22/25] update markdown generation

---
 scripts/generate-docs/pydocgen/markdown.py | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index 5f91284a2..0d61d9841 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -307,23 +307,6 @@ def get_kql_query_string(filter: Filter) -> str:
                         f.write(f">{meta['ecs']['example']}\n\n")
                     f.write("<br>\n\n")
 
-                    # f.write("<table>\n")
-                    # if meta["ecs"]["description"]:
-                    #     f.write(f"<tr><td><strong>Description</strong></td><td>{meta['ecs']['description']}</td></tr>\n")
-                    # if meta["endpoint"]["description"]:
-                    #     f.write(
-                    #         f"<tr><td><strong>Endpoint Description</strong></td><td>{meta['endpoint']['description']}</td></tr>\n"
-                    #     )
-                    # if meta["endpoint"]["example"]:
-                    #     f.write(
-                    #         f"<tr><td><strong>ECS Example</strong></td><td><code>{meta['endpoint']['example']}</code></td></tr>\n"
-                    #     )
-                    # elif meta["ecs"]["example"]:
-                    #     f.write(
-                    #         f"<tr><td><strong>Endpoint Example</strong></td><td><code>{meta['ecs']['example']}</code></td></tr>\n"
-                    #     )
-                    # f.write("</table>\n\n")
-
             logging.debug(f"wrote markdown to {output_filename}")
 
         if csv_writer:

From ff7a1096426cbc5fe978e7e2fbae2ee8399127c1 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Fri, 4 Apr 2025 18:20:15 +0000
Subject: [PATCH 23/25] fix overrides, fix missing csv

---
 .../src/documentation_overrides.yaml          | 38 +++++++++----------
 scripts/generate-docs/pydocgen/__main__.py    |  2 +-
 scripts/generate-docs/pydocgen/markdown.py    |  2 +-
 .../pydocgen/models/custom_documentation.py   |  4 +-
 4 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/custom_documentation/src/documentation_overrides.yaml b/custom_documentation/src/documentation_overrides.yaml
index f0b67bba9..69478a687 100644
--- a/custom_documentation/src/documentation_overrides.yaml
+++ b/custom_documentation/src/documentation_overrides.yaml
@@ -1,22 +1,20 @@
 - name: Endpoint.policy.applied.artifacts.global.channel
-  overrides:
-    default:
-      description: The channel of the artifact.
-      example: default example
-      type: keyword
-    os:
-      linux:
-        description: The channel of the linux artifact.
-        example: stable
-      windows:
-        description: The channel of the windows artifact.
-      macos:
-        description: The channel of the macos artifact.
-    event:
-      linux_malicious_behavior_alert:
-        description: The channel of the artifact for linux malicious behavior alert.
-        example: stable
+  default:
+    description: The channel of the artifact.
+    example: default example
+    type: keyword
+  os:
+    linux:
+      description: The channel of the linux artifact.
+      example: stable
+    windows:
+      description: The channel of the windows artifact.
+    macos:
+      description: The channel of the macos artifact.
+  event:
+    linux_malicious_behavior_alert:
+      description: The channel of the artifact for linux malicious behavior alert.
+      example: stable
 - name: agent.type
-  overrides:
-    default:
-      example: endpoint
\ No newline at end of file
+  default:
+    example: endpoint
\ No newline at end of file
diff --git a/scripts/generate-docs/pydocgen/__main__.py b/scripts/generate-docs/pydocgen/__main__.py
index 8d531ed9e..74176ede5 100644
--- a/scripts/generate-docs/pydocgen/__main__.py
+++ b/scripts/generate-docs/pydocgen/__main__.py
@@ -99,7 +99,7 @@ def main():
         logging.info(f"Removing existing database {args.database} since --no-cache was specified")
         args.database.unlink()
 
-    generate_custom_documentation_markdown(args.database, args.output_dir)
+    generate_custom_documentation_markdown(args.database, args.output_dir, args.csv)
     logging.info(f"Generated markdown documentation to {args.output_dir}")
 
 if __name__ == "__main__":
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index 0d61d9841..c7ec6bcfd 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -159,7 +159,7 @@ def get_kql_query_string(filter: Filter) -> str:
 
     csv_writer = None
     if csv_path:
-        csv_writer = MetadataCsvWriter()
+        csv_writer = MetadataCsvWriter(csv_path)
 
     # Generate markdown for each custom document
     with Session(engine) as session:
diff --git a/scripts/generate-docs/pydocgen/models/custom_documentation.py b/scripts/generate-docs/pydocgen/models/custom_documentation.py
index 2baa8c8de..aad81277f 100644
--- a/scripts/generate-docs/pydocgen/models/custom_documentation.py
+++ b/scripts/generate-docs/pydocgen/models/custom_documentation.py
@@ -1,3 +1,4 @@
+import json
 import logging
 import pathlib
 import yaml
@@ -7,7 +8,7 @@
 from ..paths import CUSTOM_DOCUMENTATION_DIR, DOCUMENTATION_OVERRIDE_PATH
 
 #
-# See any of the files at custom_documentation/src/endpoint/data_stream/*/*.yaml for examples 
+# See any of the files at custom_documentation/src/endpoint/data_stream/*/*.yaml for examples
 # of the data these models parse
 #
 class Overview(BaseModel):
@@ -175,6 +176,7 @@ def from_yaml(
         cls, yaml_path: pathlib.Path = DOCUMENTATION_OVERRIDE_PATH
     ) -> "DocumentationOverrideMap":
         logging.debug(f"Reading documentation overrides from {yaml_path}")
+        print(f"Reading documentation overrides from {yaml_path}")
         if not yaml_path.exists():
             raise FileNotFoundError(f"Documentation override file {yaml_path} does not exist")
         doc_overrides = cls()

From cc0ffef85da2b788101af1a19e895584ba1edb3e Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Wed, 4 Jun 2025 17:25:00 +0000
Subject: [PATCH 24/25] better markdown generation, updated overrides

---
 .../src/documentation_overrides.yaml          | 205 ++++++++-
 scripts/generate-docs/pydocgen/database.py    | 128 +++++-
 scripts/generate-docs/pydocgen/markdown.py    | 399 +++++++++++-------
 .../pydocgen/models/custom_documentation.py   |   9 +-
 4 files changed, 585 insertions(+), 156 deletions(-)

diff --git a/custom_documentation/src/documentation_overrides.yaml b/custom_documentation/src/documentation_overrides.yaml
index 69478a687..cd444099d 100644
--- a/custom_documentation/src/documentation_overrides.yaml
+++ b/custom_documentation/src/documentation_overrides.yaml
@@ -1,20 +1,211 @@
 - name: Endpoint.policy.applied.artifacts.global.channel
   default:
     description: The channel of the artifact.
-    example: default example
+    example: stable
     type: keyword
   os:
     linux:
       description: The channel of the linux artifact.
-      example: stable
     windows:
       description: The channel of the windows artifact.
     macos:
       description: The channel of the macos artifact.
-  event:
-    linux_malicious_behavior_alert:
-      description: The channel of the artifact for linux malicious behavior alert.
-      example: stable
+  # event:
+  #   linux_malicious_behavior_alert:
+  #     description: The channel of the artifact for linux malicious behavior alert.
+  #     example: stable
+
 - name: agent.type
   default:
-    example: endpoint
\ No newline at end of file
+    example: endpoint
+
+- name: Endpoint.policy.applied.artifacts.global.identifiers.name
+  default:
+    example: global-configuration-v1
+
+- name: Endpoint.policy.applied.artifacts.global.snapshot
+  default:
+    example: "latest"
+
+- name: Endpoint.policy.applied.artifacts.user.identifiers.name
+  os:
+    linux:
+      example: endpoint-trustlist-linux-v1
+    windows:
+      example: endpoint-trustlist-windows-v1
+    macos:
+      example: endpoint-trustlist-macos-v1
+
+- name: Endpoint.policy.applied.artifacts.user.version
+  default:
+    example: "1.0.0"
+
+- name: agent.build.original
+  default:
+    example: "version: 9.1.0, compiled: Mon Jun 2 15:00:00 2025, branch: main, commit: 3fd26249705c5a467960870702589686ef04da43"
+
+- name: data_stream.dataset
+  default:
+    example: endpoint.alerts
+
+- name: event.action
+  default:
+    description: |-
+      Possible values for Endpoint include:
+      - elastic_endpoint_telemetry
+      - endpoint_metadata
+      - endpoint_policy_response
+      - endpoint_metrics
+      - endpoint_heartbeat
+      - malicious_file
+      - endpoint_unquarantine
+      - lookup_result
+      - lookup_requested
+      - creation
+      - deletion
+      - demand
+      - clone
+      - link
+      - exchange
+      - execution
+      - modification
+      - open
+      - query
+      - save
+      - overwrite
+      - rename
+      - extended_attributes_delete
+      - mount
+      - unknown
+      - load
+      - connection_accepted
+      - connection_attempted
+      - disconnect_received
+      - http_request
+      - udp_datagram_outgoing
+      - udp_datagram_incoming
+      - icmp_outgoing
+      - icmp_incoming
+      - already_running
+      - fork
+      - end
+      - exec
+      - gid_change
+      - start
+      - session_id_change
+      - uid_change
+      - remote_thread
+      - process_open
+      - text_output
+      - memfd_create
+      - shmget
+      - ptrace
+      - load_module
+      - log_on
+      - log_off
+      - workstation_locked
+      - workstation_unlocked
+      - ssh_log_on
+      - rdp_log_on
+      - service-installed
+      - scheduled-task-created
+      - scheduled-task-updated
+      - added-user-account
+      - group-membership-enumerated
+      - user-member-enumerated
+      - token-right-adjusted
+      - network-share-object-added
+      - network-share-object-access-checked
+      - vault-credentials-were-read
+      - gatekeeper_override
+      - mbr-overwrite
+      - files-encrypted
+      - canary-activity
+      - rule_detection
+      - rule_prevention
+      - api
+      - launch_daemon
+      - mount
+      - unmount
+
+- name: event.category
+  default:
+    type: array of keyword
+    example: '["malware", "intrusion_detection"]'
+    description: |-
+      Possible values for Endpoint include:
+        - authentication
+        - configuration
+        - driver
+        - file
+        - host
+        - iam
+        - intrusion_detection
+        - library
+        - malware
+        - network
+        - process
+        - registry
+        - session
+        - rule
+        - credential_hardening
+        - api
+        - volume_device
+        - security
+
+- name: event.dataset
+  default:
+    example: endpoint.alerts
+
+- name: event.module
+  default:
+    example: endpoint
+    description: |-
+      The module for Endpoint is always `endpoint`
+
+- name: event.risk_score
+  default:
+    example: "99"
+    description: Endpoint risk score uses a scale of 0 to 100, where 100 is the highest risk.
+
+- name: event.severity
+  default:
+    example: "73"
+    description: Endpoint severity uses a scale of 0 to 100, where 100 is the highest risk.
+
+- name: event.type
+  default:
+    example: '["info", "allowed"]'
+    type: array of keyword
+    description: |-
+      Possible values for Endpoint include:
+      - allowed
+      - change
+      - creation
+      - deletion
+      - denied
+      - end
+      - info
+      - protocol
+      - start
+      - access
+      - admin
+      - user
+      - group
+
+- name: event.kind
+  default:
+    description: |-
+      Possible values for Endpoint include:
+        - alert
+        - event
+        - metric
+        - state
+
+- name: event.outcome
+  default:
+    description: |-
+      Possible values for Endpoint include:
+        - success
+        - failure
+        - unknown
diff --git a/scripts/generate-docs/pydocgen/database.py b/scripts/generate-docs/pydocgen/database.py
index c2a1d6484..675cc67b7 100644
--- a/scripts/generate-docs/pydocgen/database.py
+++ b/scripts/generate-docs/pydocgen/database.py
@@ -1,13 +1,15 @@
 import pathlib
 import logging
 
-from sqlmodel import SQLModel, Field, create_engine, Session, select, Relationship
+from sqlmodel import SQLModel, Field, create_engine, Session, select, Relationship, and_
 from sqlalchemy import Engine, Column, JSON
 
 from .models.custom_documentation import DocumentationOverrideMap
 from .models.packages import Package, PackageList
 
-from typing import Optional
+from typing import Optional, Literal, TypeAlias
+
+OsNameList: TypeAlias = list[Literal["windows", "linux", "macos"]]
 
 
 #
@@ -43,6 +45,7 @@ class PackageField(SQLModel, table=True):
     name: str
     description: str
     example: Optional[str] = None
+    type: Optional[str] = None
     package_reference_id: Optional[int] = Field(foreign_key="package_references.id")
     package_reference: Optional[PackageReference] = Relationship()
 
@@ -163,6 +166,7 @@ def add_to_db(field: PackageField, session: Session):
                             description=sub_field.description,
                             package_reference_id=package_ref.id,
                             example=sub_field.example,
+                            type=sub_field.type,
                         ),
                         session,
                     )
@@ -173,12 +177,132 @@ def add_to_db(field: PackageField, session: Session):
                         description=field.description,
                         package_reference_id=package_ref.id,
                         example=field.example,
+                        type=field.type,
                     ),
                     session,
                 )
     session.commit()
 
 
+class OverrideQueryResult:
+    """
+    Represents the result of querying for field overrides, prioritized by event, OS, and default.
+
+    This class retrieves and stores a prioritized list of field overrides for a given field name,
+    event name, and OS name from the database. The priority order is: event-specific override (highest),
+    then OS-specific override, and finally the default override (lowest).
+
+    Properties such as `description`, `example`, and `type` return the value from the highest-priority
+    override that provides a non-empty value, or None if none are found.
+
+    Args:
+        session: SQLModel session used to query the database.
+        field_name: Name of the field to retrieve overrides for.
+        event_name: Name of the event to prioritize event-specific overrides.
+        os_name: Name of the OS to prioritize OS-specific overrides.
+    """
+
+    def __init__(
+        self, session: Session, field_name: str, event_name: str, os_names: OsNameList
+    ):
+        """
+        Initialize OverrideQueryResult.
+
+        Args:
+            session: SQLModel session.
+            field_name: Name of the field.
+            event_name: Name of the event.
+            os_name: Name of the OS.
+        """
+        self.overrides: list[OverrideField] = []
+
+        overrides = session.exec(
+            select(OverrideRelationship).where(OverrideRelationship.name == field_name)
+        ).all()
+
+        #
+        # These functions resolve the overrides for event, os, and default respectively.
+        #
+        def event_override() -> OverrideField | None:
+            """
+            Returns the event override if it exists, otherwise None.
+            """
+            return next((o.override for o in overrides if o.event == event_name), None)
+
+        def os_override() -> OverrideField | None:
+            """
+            Returns the OS Override if it exists.  There can be multiple os overrides, so the relevant
+            ones for this document are saved in markdown table format.
+            """
+            description = None
+            example = None
+            type = None
+            for o in overrides:
+                if o.os:
+                    if o.os in os_names:
+                        if o.override.description:
+                            if not description:
+                                description = f"|OS|Description|\n|---|---|\n"
+                            description += f"|{o.os}|{o.override.description}|\n"
+                        if o.override.example:
+                            if not example:
+                                example = f"|OS|Example|\n|---|---|\n"
+                            example += f"|{o.os}|{o.override.example}|\n"
+                        if o.override.type:
+                            if not type:
+                                type = f"|OS|Type|\n|---|---|\n"
+                            type += f"|{o.os}|{o.override.type}|\n"
+
+            return (
+                OverrideField(
+                    description=description,
+                    example=example,
+                    type=type,
+                )
+                if any([description, example, type])
+                else None
+            )
+
+        def default_override() -> OverrideField | None:
+            """
+            Returns the default override if it exists, otherwise None.
+            """
+            return next((o.override for o in overrides if o.default), None)
+
+        # We save the overrides in order of priority, so that we can return the highest-priority override
+        self.overrides = [event_override(), os_override(), default_override()]
+
+    @property
+    def description(self) -> str | None:
+        """
+        Returns the description from the highest-priority override that provides a non-empty value, or None.
+        """
+        for override in self.overrides:
+            if override and override.description:
+                return override.description
+        return None
+
+    @property
+    def example(self) -> str | None:
+        """
+        Returns the example from the highest-priority override that provides a non-empty value, or None.
+        """
+        for override in self.overrides:
+            if override and override.example:
+                return override.example
+        return None
+
+    @property
+    def type(self) -> str | None:
+        """
+        Returns the type from the highest-priority override that provides a non-empty value, or None.
+        """
+        for override in self.overrides:
+            if override and override.type:
+                return override.type
+        return None
+
+
 def getDatabase(db_path: pathlib.Path) -> Engine:
     """
     getDatabase creates a database if it does not exist, otherwise it uses the existing database
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index c7ec6bcfd..cbf0513d9 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -1,18 +1,184 @@
 import csv
+import hashlib
 import logging
+import os
 import pathlib
+from typing import List, TextIO
+
+from sqlmodel import Session, select
+
+from .database import OsNameList, OverrideQueryResult, PackageField, getDatabase
 from .models import CustomDocumentationList, Filter
-from .database import getDatabase, PackageField, OverrideRelationship
 
-from sqlmodel import (
-    Session,
-    select,
-    or_,
-    and_,
-    case,
-)
 
-from typing import List
+def quote_markdown_string(s: str) -> str:
+    """
+    quote_markdown_string prepends each line of a string with a '>' character
+    Args:
+        s: string to quote
+
+    Returns:
+        quoted string
+    """
+    return "\n".join(f"> {line}" for line in s.splitlines())
+
+
+def generate_random_sha256() -> str:
+    """
+    generate_random_sha256 generates a random SHA256 hash for use in example fields
+
+    Returns:
+        random SHA256 hash
+    """
+    return hashlib.sha256(os.urandom(32)).hexdigest()
+
+
+class FieldMetadata:
+    """
+    FieldMetadata contains all the information necessary to generate markdown for a field
+    it queries the package field database for ECS metadata and the overrides database
+    for endpoint-specific metadata. It also generates a random SHA256 hash if the field is a
+    SHA256 hash and no example is provided.f
+    """
+
+    def __init__(
+        self, field: str, session: Session, event_name: str, os_names: OsNameList
+    ) -> None:
+        """
+        __init__ queries the database for ECS metadata and endpoint-specific metadata.  Also
+        generates a random SHA256 hash if the field is a SHA256 hash and no example is provided.
+
+        Args:
+            field: field name
+            session: active sqlmodel session for querying the database
+            event_name: name of the event
+            os_name: os name (e.g., "windows", "linux", "macos")
+        """
+        self.field = field
+        self.event_name = event_name
+        self.os_names = os_names
+
+        self.endpoint_description: str | None = None
+        self.endpoint_example: str | None = None
+        self.endpoint_type: str | None = None
+        self.ecs_description: str | None = None
+        self.ecs_example: str | None = None
+        self.ecs_type: str | None = None
+
+        self._populate_ecs_metadata(session)
+        self._populate_endpoint_metadata(session)
+
+        if not self.ecs_example and self.field.endswith(".sha256"):
+            # If the field is a SHA256 hash, generate a random example if none is provided
+            self.ecs_example = generate_random_sha256()
+
+    def _populate_ecs_metadata(self, session: Session) -> None:
+        """
+        _populate_ecs_metadata populates the ECS metadata for a field
+        based on the package field database
+
+        Args:
+            session: SQLAlchemy session
+        """
+        package_field: PackageField = session.exec(
+            select(PackageField).where(PackageField.name == self.field)
+        ).first()
+        if package_field:
+            #
+            # The package field description may contain newlines, so we replace them with spaces
+            #
+            self.ecs_description = package_field.description
+            self.ecs_example = package_field.example
+            self.ecs_type = package_field.type
+
+    def _populate_endpoint_metadata(self, session: Session) -> None:
+        """
+        _populate_endpoint_metadata populates the endpoint metadata for a field
+        based on the overrides database
+
+        Args:
+            session: SQLAlchemy session
+            field: field name
+            event_name: event name
+            os_name: OS name
+        """
+        result = OverrideQueryResult(
+            session, self.field, self.event_name, self.os_names
+        )
+        if result.description:
+            self.endpoint_description = result.description
+        if result.example:
+            self.endpoint_example = result.example
+        if result.type:
+            self.endpoint_type = result.type
+
+    def has_data(self) -> bool:
+        """
+        has_data checks if the metadata has any data populated
+
+        Returns:
+            True if any metadata is populated, False otherwise
+        """
+        return any(
+            [
+                self.ecs_description,
+                self.ecs_example,
+                self.ecs_type,
+                self.endpoint_description,
+                self.endpoint_example,
+                self.endpoint_type,
+            ]
+        )
+
+    def missing_data(self) -> bool:
+        """
+        missing_data checks if the metadata is missing any data
+
+        Returns:
+            True if any metadata is missing, False otherwise
+        """
+        return not all(
+            [
+                self.ecs_description,
+                self.ecs_example,
+                self.ecs_type,
+                self.endpoint_description,
+                self.endpoint_example,
+                self.endpoint_type,
+            ]
+        )
+
+    def write_markdown(self, f: TextIO) -> None:
+        """
+        write_markdown writes the field metadata to a markdown file
+        Args:
+            f: file object to write to
+        """
+        f.write(f"### `{self.field}`\n\n")
+        if not self.has_data():
+            f.write("No description or example found\n\n")
+            f.write("<br>\n\n")
+            return
+
+        if self.ecs_description:
+            f.write("**ECS Description**\n\n")
+            f.write(f"{quote_markdown_string(self.ecs_description)}\n\n")
+        if self.endpoint_description:
+            f.write("**Extended Description**\n\n")
+            f.write(f"{quote_markdown_string(self.endpoint_description)}\n\n")
+        if self.endpoint_example:
+            f.write("**Example**\n\n")
+            f.write(f"{quote_markdown_string(self.endpoint_example)}\n\n")
+        elif self.ecs_example:
+            f.write("**Example**\n\n")
+            f.write(f"{quote_markdown_string(self.ecs_example)}\n\n")
+        if self.endpoint_type:
+            f.write("**Type**\n\n")
+            f.write(f"{quote_markdown_string(self.endpoint_type)}\n\n")
+        elif self.ecs_type:
+            f.write("**Type**\n\n")
+            f.write(f"{quote_markdown_string(self.ecs_type)}\n\n")
+        f.write("<br>\n\n")
 
 
 class MetadataCsvWriter:
@@ -22,35 +188,44 @@ class MetadataCsvWriter:
     can be imported into a spreadsheet to track missing documentation
     """
 
+    FIELD_NAME = "Field Name"
+    FIELD_EVENT_NAME = "Event Name"
+    FIELD_HAS_ECS_DESCRIPTION = "Has ECS Description"
+    FIELD_HAS_ECS_EXAMPLE = "Has ECS Example"
+    FIELD_HAS_ECS_TYPE = "Has ECS Type"
+    FIELD_HAS_ENDPOINT_DESCRIPTION = "Has Endpoint Description"
+    FIELD_HAS_ENDPOINT_EXAMPLE = "Has Endpoint Example"
+
     def __init__(self, csv_path: pathlib.Path):
 
         self.csv_path = csv_path
         self.fields = [
-            "Field Name",
-            "Event Name",
-            "Has Description",
-            "Has Example",
+            self.FIELD_NAME,
+            self.FIELD_EVENT_NAME,
+            self.FIELD_HAS_ECS_DESCRIPTION,
+            self.FIELD_HAS_ECS_EXAMPLE,
+            self.FIELD_HAS_ECS_TYPE,
+            self.FIELD_HAS_ENDPOINT_DESCRIPTION,
+            self.FIELD_HAS_ENDPOINT_EXAMPLE,
         ]
         self.rows = []
 
-    def add_row(
-        self, field_name: str, event_name: str, has_description: bool, has_example: bool
-    ):
+    def add_row(self, field: FieldMetadata):
         """
         add_row adds a row to the CSV output
 
         Args:
-            name: field name
-            file: source file path
-            has_description: boolean indicating if the field has a description
-            has_example: boolean indicating if the field has an example
+            field: FieldMetadata object containing the field information
         """
         self.rows.append(
             {
-                "Field Name": field_name,
-                "Event Name": event_name,
-                "Has Description": has_description,
-                "Has Example": has_example,
+                self.FIELD_NAME: field.field,
+                self.FIELD_EVENT_NAME: field.event_name,
+                self.FIELD_HAS_ECS_DESCRIPTION: bool(field.ecs_description),
+                self.FIELD_HAS_ECS_EXAMPLE: bool(field.ecs_example),
+                self.FIELD_HAS_ECS_TYPE: bool(field.ecs_type),
+                self.FIELD_HAS_ENDPOINT_DESCRIPTION: bool(field.endpoint_description),
+                self.FIELD_HAS_ENDPOINT_EXAMPLE: bool(field.endpoint_example),
             }
         )
 
@@ -67,7 +242,9 @@ def write_csv(self):
 
 
 def generate_custom_documentation_markdown(
-    db_path: pathlib.Path, output_dir: pathlib.Path, csv_path: pathlib.Path = None
+    db_path: pathlib.Path,
+    output_dir: pathlib.Path,
+    csv_path: pathlib.Path | None = None,
 ):
     """
     Generate markdown files for custom documentation
@@ -75,7 +252,8 @@ def generate_custom_documentation_markdown(
 
     def get_output_filepath(src_path: pathlib.Path) -> pathlib.Path:
         """
-        get_output_filepath determines the output filename for a given source path
+        get_output_filepath determines the output filename for writing markdown, based
+        on the source path of the package
 
         Args:
             src_path: yaml file path
@@ -101,13 +279,17 @@ def get_formatted_os_name(os: str) -> str:
         Returns:
             _description_
         """
-        if os == "windows":
-            return "Windows"
-        if os == "linux":
-            return "Linux"
-        if os == "macos":
-            return "macOS"
-        return os
+        match os:
+            case "windows":
+                return "Windows"
+            case "linux":
+                return "Linux"
+            case "macos":
+                return "macOS"
+            case _:
+                raise ValueError(
+                    f"Unknown OS name: {os}. Please add it to the get_formatted_os_name function."
+                )
 
     def get_formatted_os_string(os_list: List[str]) -> str:
         """
@@ -157,13 +339,14 @@ def get_kql_query_string(filter: Filter) -> str:
     # Get the custom documentation
     custom_docs = CustomDocumentationList.from_files()
 
-    csv_writer = None
+    csv_writer: MetadataCsvWriter | None = None
     if csv_path:
         csv_writer = MetadataCsvWriter(csv_path)
 
     # Generate markdown for each custom document
     with Session(engine) as session:
         for custom_doc in custom_docs:
+
             # Get the output filename and create the parent directories
             output_filename = get_output_filepath(custom_doc.filepath)
             output_filename.parent.mkdir(parents=True, exist_ok=True)
@@ -194,120 +377,44 @@ def get_kql_query_string(filter: Filter) -> str:
                 )
                 f.write("</tr>\n")
                 f.write("</table>\n\n")
-
                 f.write(f"## Fields\n\n")
+
+                #
+                # Write markdown for the individual Fields
+                #
                 for field in custom_doc.fields.endpoint:
-                    meta = {
-                        "ecs": {
-                            "description": None,
-                            "example": None,
-                        },
-                        "endpoint": {
-                            "description": None,
-                            "example": None,
-                        },
-                    }
-                    event_name = custom_doc.filepath.stem
-
-                    #
-                    # Look for the description and example from mapped values (packages directory)
-                    #
-                    package_field = session.exec(
-                        select(PackageField).where(PackageField.name == field)
-                    ).first()
-                    if package_field:
-                        #
-                        # The package field description may contain newlines, so we replace them with spaces
-                        #
-                        meta["ecs"]["description"] = package_field.description.replace(
-                            "\n", "  ").replace("\r", "  ")
-                        meta["ecs"]["example"] = package_field.example
-
-                    #
-                    # This query will look for an override for the field in the following order:
-                    # 1. Event name
-                    # 2. OS
-                    # 3. Default
-                    #
-                    # If no override is found, the package field description will be used
-                    #
-                    override_meta = session.exec(
-                        select(OverrideRelationship)
-                        .where(
-                            and_(
-                                # field must match
-                                OverrideRelationship.name == field,
-                                # one of the following must match
-                                or_(
-                                    (OverrideRelationship.event == event_name),
-                                    (
-                                        OverrideRelationship.os
-                                        == custom_doc.identification.os[0]
-                                    ),
-                                    (OverrideRelationship.default == True),
-                                ),
-                            )
-                        )
-                        .order_by(
-                            # The order of precedence is event, os, default, so we order by that
-                            case(
-                                (OverrideRelationship.event == event_name, 1),
-                                (
-                                    OverrideRelationship.os
-                                    == custom_doc.identification.os[0],
-                                    2,
-                                ),
-                                (OverrideRelationship.default == True, 3),
-                                else_=4,
+                    field_metadata = FieldMetadata(
+                        field=field,
+                        session=session,
+                        event_name=custom_doc.filepath.stem,
+                        os_names=custom_doc.identification.os,
+                    )
+
+                    if csv_writer:
+                        if not all(
+                            [field_metadata.ecs_description, field_metadata.ecs_example]
+                        ):
+                            csv_writer.add_row(field_metadata)
+
+                    # Check if the field we are writing is a wildcard or special field
+                    # If it is, we skip it unless it has a specific description or example
+                    # Wildcard fields are those that end with "._" or ".*"
+                    if any(["._" in field, ".*" in field]):
+                        if (
+                            custom_doc.fields.details
+                            and field in custom_doc.fields.details
+                        ):
+                            field_metadata.ecs_description = custom_doc.fields.details[
+                                field
+                            ].description
+                        else:
+                            logging.info(
+                                f"Skipping field {field} because it is a wildcard or special field that does not have a specific description or example"
                             )
-                        )
-                    ).first()
-
-                    if override_meta:
-                        meta["endpoint"]["description"] = override_meta.override.description
-                        meta["endpoint"]["example"] = override_meta.override.example
-
-                    if csv_writer and (not meta["ecs"]["description"] or not meta["ecs"]["example"]):
-                        csv_writer.add_row(
-                            field_name=field,
-                            event_name=event_name,
-                            has_description=bool(meta["ecs"]["description"]),
-                            has_example=bool(meta["ecs"]["example"]),
-                        )
-
-                    if "._" in field or ".*" in field:
-                        logging.info(
-                            f"Skipping field {field} because it is a wildcard or special field"
-                        )
-                        continue
-
-                    f.write(f"### `{field}`\n\n")
-
-                    if not any([
-                        meta["ecs"]["description"],
-                        meta["endpoint"]["description"],
-                        meta["endpoint"]["example"],
-                        meta["ecs"]["example"],
-                    ]):
-                        f.write("No description or example found\n\n")
-                        f.write("<br>\n\n")
-                        continue
-
-                    if meta["ecs"]["description"]:
-                        f.write("**ECS Description**\n\n")
-                        f.write(f">{meta['ecs']['description']}\n\n")
-                    if meta["endpoint"]["description"]:
-                        f.write("**Extended Description**\n\n")
-                        f.write(f"> {meta['endpoint']['description']}\n\n")
-                    if meta["endpoint"]["example"]:
-                        f.write("**Example**\n\n")
-                        f.write(f">{meta['endpoint']['example']}\n\n")
-                    elif meta["ecs"]["example"]:
-                        f.write("**Example**\n\n")
-                        f.write(f">{meta['ecs']['example']}\n\n")
-                    f.write("<br>\n\n")
-
+                            continue
+                    field_metadata.write_markdown(f)
             logging.debug(f"wrote markdown to {output_filename}")
 
-        if csv_writer:
-            csv_writer.write_csv()
+    # If we have a CSV writer, write the CSV file
+    if csv_writer:
+        csv_writer.write_csv()
diff --git a/scripts/generate-docs/pydocgen/models/custom_documentation.py b/scripts/generate-docs/pydocgen/models/custom_documentation.py
index aad81277f..1b7902eb5 100644
--- a/scripts/generate-docs/pydocgen/models/custom_documentation.py
+++ b/scripts/generate-docs/pydocgen/models/custom_documentation.py
@@ -50,12 +50,19 @@ class Identification(BaseModel):
     data_stream: str
 
 
+class Detail(BaseModel):
+    """
+    Details for the package
+    """
+    description: Optional[str] = None
+
+
 class Fields(BaseModel):
     """
     Fields for the package
     """
     endpoint: List[str]
-
+    details: Optional[Dict[str, Detail]] = None
 
 class CustomDocumentation(BaseModel):
     """

From 355f75f1b48e2e03224f74dee842b249a07e7868 Mon Sep 17 00:00:00 2001
From: Brian McKinney <brian.mckinney@elastic.co>
Date: Wed, 4 Jun 2025 19:58:07 +0000
Subject: [PATCH 25/25] some typing fixes

---
 scripts/generate-docs/pydocgen/database.py    | 24 +++++++------------
 scripts/generate-docs/pydocgen/markdown.py    |  7 +++---
 .../pydocgen/models/custom_documentation.py   |  6 +++--
 3 files changed, 17 insertions(+), 20 deletions(-)

diff --git a/scripts/generate-docs/pydocgen/database.py b/scripts/generate-docs/pydocgen/database.py
index 675cc67b7..84c084cd5 100644
--- a/scripts/generate-docs/pydocgen/database.py
+++ b/scripts/generate-docs/pydocgen/database.py
@@ -4,21 +4,19 @@
 from sqlmodel import SQLModel, Field, create_engine, Session, select, Relationship, and_
 from sqlalchemy import Engine, Column, JSON
 
-from .models.custom_documentation import DocumentationOverrideMap
+from .models.custom_documentation import DocumentationOverrideMap, OsNameList
 from .models.packages import Package, PackageList
 
 from typing import Optional, Literal, TypeAlias
 
-OsNameList: TypeAlias = list[Literal["windows", "linux", "macos"]]
 
 
 #
 # These models represent the database tables for mapped fields
 #
 class PackageReference(SQLModel, table=True):
-    __tablename__ = "package_references"
-    id: Optional[int] = Field(default=None, primary_key=True)
-    package_data: Optional[str] = Field(default=None, sa_column=Column(JSON))
+    id: int = Field(default=None, primary_key=True)
+    package_data: str = Field(default="{}", sa_column=Column(JSON))
 
 
 class PackageField(SQLModel, table=True):
@@ -39,14 +37,12 @@ class PackageField(SQLModel, table=True):
     Returns:
         _description_
     """
-
-    __tablename__ = "package_fields"
     id: Optional[int] = Field(default=None, primary_key=True)
     name: str
-    description: str
+    description: Optional[str] = None
     example: Optional[str] = None
     type: Optional[str] = None
-    package_reference_id: Optional[int] = Field(foreign_key="package_references.id")
+    package_reference_id: Optional[int] = Field(foreign_key="packagereference.id")
     package_reference: Optional[PackageReference] = Relationship()
 
     @property
@@ -60,21 +56,19 @@ def package(self) -> Package:
 # These models reprensent the database tables for overrides
 #
 class OverrideField(SQLModel, table=True):
-    __tablename__ = "overrides"
-    id: Optional[int] = Field(default=None, primary_key=True)
+    id: int = Field(default=None, primary_key=True)
     description: Optional[str] = None
     example: Optional[str] = None
     type: Optional[str] = None
 
 
 class OverrideRelationship(SQLModel, table=True):
-    __tablename__ = "override_relationships"
-    id: Optional[int] = Field(default=None, primary_key=True)
+    id: int = Field(default=None, primary_key=True)
     name: str
     event: Optional[str] = None
     os: Optional[str] = None
     default: bool = False
-    override_id: int = Field(foreign_key="overrides.id")
+    override_id: int = Field(foreign_key="overridefield.id")
     override: OverrideField = Relationship(sa_relationship_kwargs={"lazy": "joined"})
 
 
@@ -214,7 +208,7 @@ def __init__(
             event_name: Name of the event.
             os_name: Name of the OS.
         """
-        self.overrides: list[OverrideField] = []
+        self.overrides: list[OverrideField | None] = []
 
         overrides = session.exec(
             select(OverrideRelationship).where(OverrideRelationship.name == field_name)
diff --git a/scripts/generate-docs/pydocgen/markdown.py b/scripts/generate-docs/pydocgen/markdown.py
index cbf0513d9..785a8caba 100644
--- a/scripts/generate-docs/pydocgen/markdown.py
+++ b/scripts/generate-docs/pydocgen/markdown.py
@@ -7,7 +7,8 @@
 
 from sqlmodel import Session, select
 
-from .database import OsNameList, OverrideQueryResult, PackageField, getDatabase
+from .models.custom_documentation import OsNameList
+from .database import OverrideQueryResult, PackageField, getDatabase
 from .models import CustomDocumentationList, Filter
 
 
@@ -80,7 +81,7 @@ def _populate_ecs_metadata(self, session: Session) -> None:
         Args:
             session: SQLAlchemy session
         """
-        package_field: PackageField = session.exec(
+        package_field: PackageField | None = session.exec(
             select(PackageField).where(PackageField.name == self.field)
         ).first()
         if package_field:
@@ -291,7 +292,7 @@ def get_formatted_os_name(os: str) -> str:
                     f"Unknown OS name: {os}. Please add it to the get_formatted_os_name function."
                 )
 
-    def get_formatted_os_string(os_list: List[str]) -> str:
+    def get_formatted_os_string(os_list: OsNameList) -> str:
         """
         get_formatted_os_string some documents have multiple os's, this function will format them
         correctly for the markdown output
diff --git a/scripts/generate-docs/pydocgen/models/custom_documentation.py b/scripts/generate-docs/pydocgen/models/custom_documentation.py
index 1b7902eb5..77643c8f0 100644
--- a/scripts/generate-docs/pydocgen/models/custom_documentation.py
+++ b/scripts/generate-docs/pydocgen/models/custom_documentation.py
@@ -3,10 +3,12 @@
 import pathlib
 import yaml
 from pydantic import BaseModel, Field, field_validator
-from typing import List, Optional, Iterator, Dict
+from typing import List, Optional, Iterator, Dict, TypeAlias, Literal
 
 from ..paths import CUSTOM_DOCUMENTATION_DIR, DOCUMENTATION_OVERRIDE_PATH
 
+OsNameList: TypeAlias = list[Literal["windows", "linux", "macos"]]
+
 #
 # See any of the files at custom_documentation/src/endpoint/data_stream/*/*.yaml for examples
 # of the data these models parse
@@ -46,7 +48,7 @@ class Identification(BaseModel):
     Identification of the package
     """
     filter: Filter
-    os: List[str]
+    os: OsNameList
     data_stream: str